Domain tokens issued from a saml2 auth incorrectly includes group roles marked as inherited

[Henry Nash]

When building the roles in a Keystone token from a saml2 token, we call assignment_api.get_roles_for_groups() to add in any group roles. This appears to ignore the inheritance flag on the assignment - and puts in all group roles whether inherited or not. This means the wrong roles can end up in the resulting Keystone token.

The implication is that domain scoped tokens would incorrectly get roles that were meant to be inherited (only) to projects within that domain.

[Henry Nash (henry-nash)]

I found this doing a WIP code experiment for making assignments pluggable (see: https://review.openstack.org/#/c/129397/). It is clear that we have far too many ways of trying to work out what roles are effective on a given project or domain. Once we have improved the backend list_role_assignments() method (see: https://review.openstack.org/#/c/116682/), we should consider re-writing many of the these calls to be based on the common method.

[Morgan Fainberg (mdrnstm)]

OS-INHERIT should be made a core-API and moved out of the extension.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/132872

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/132872
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=1f54bebe65897b57845e09bd4e8d12ccc9323139
Submitter: Jenkins
Branch: master

commit 1f54bebe65897b57845e09bd4e8d12ccc9323139
Author: Henry Nash <email address hidden>
Date: Wed Nov 5 15:09:54 2014 +0000

    Fix domain federation tokens for inherited roles.

    Currently domain-scoped federation-generated tokens incorrectly
    include group roles that are inherited to projects within that domain.
    This error is also exposed via the /auth/domains and
    /OS-FEDERATION/domains API calls. This patch fixes this.

    Change-Id: I2b5c1e3d695dd7b27bf3b15361fccb5c13bdd554
    Closes-bug: 1385533
    Closes-bug: 1385643

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: feature/hierarchical-multitenancy
Review: https://review.openstack.org/138182

[OpenStack Infra (hudson-openstack)]

Change abandoned by Morgan Fainberg (<email address hidden>) on branch: feature/hierarchical-multitenancy
Review: https://review.openstack.org/138182

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/juno
Review: https://review.openstack.org/142546

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/142546
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=5ec73571b7a1698f21c6c7d7ab95d42708d3d9e6
Submitter: Jenkins
Branch: stable/juno

commit 5ec73571b7a1698f21c6c7d7ab95d42708d3d9e6
Author: Henry Nash <email address hidden>
Date: Wed Nov 5 15:09:54 2014 +0000

    Fix domain federation tokens for inherited roles.

    Currently domain-scoped federation-generated tokens incorrectly
    include group roles that are inherited to projects within that domain.
    This error is also exposed via the /auth/domains and
    /OS-FEDERATION/domains API calls. This patch fixes this.

    (cherry picked from commit 1f54bebe65897b57845e09bd4e8d12ccc9323139)

    Backport note: New tests were added to test_backend_kvs.KVSIdentity
    because the KVS backend didn't support the function in Juno.

    Change-Id: I2b5c1e3d695dd7b27bf3b15361fccb5c13bdd554
    Closes-bug: 1385533
    Closes-bug: 1385643