Admin auth check seems to override policy rules.

[Charles V Bock]

This check for the admin role seems to fly in the face of the RBAC control that keystone now gives us.
since is_superuser is based solely on the user having the role of admin.

        if not user.is_superuser:
            raise exceptions.NotAuthorized

https://github.com/openstack/horizon/blob/master/openstack_dashboard/api/keystone.py#L144

For instance if I give access to the list-users call for people with role "user_lister" this check effectively overrides my policy every time.

This only happens in horizon, via curl / direct API calls there is no such interference.

Thoughts?

[Charles V Bock (charles-v-bock)]

Re-evaluating this... will reopen if Its still an issue.

[Charles V Bock (charles-v-bock)]

Yes this does seem valid, especially with the more diverse v3 policy system.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/133032

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/juno
Review: https://review.openstack.org/133535

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/133032
Committed: https://git.openstack.org/cgit/openstack/horizon/commit/?id=45ae78ce85c8ecc211c7c957c6409955588f831a
Submitter: Jenkins
Branch: master

commit 45ae78ce85c8ecc211c7c957c6409955588f831a
Author: Justin Pomeroy <email address hidden>
Date: Thu Nov 6 07:30:38 2014 -0600

    Honor keystone policy file when creating client

    When creating the keystone client for an admin the user is checked
    for the specific role of "admin" to determine if they are authorized
    to use the admin URL. This patch changes this logic so that the
    policy file is honored instead of a specific role.

    Closes-Bug: #1336418
    Change-Id: I600334dff17a5564f97cbcce67ff6d3619142961

[OpenStack Infra (hudson-openstack)]

Change abandoned by Justin Pomeroy (<email address hidden>) on branch: stable/juno
Review: https://review.openstack.org/133535