When creating firewall with following conditions, current neutron behaves as follows:
[How to reproduce]
step1. Create firewall-policy with following attributes(CLI/REST-API):
=> shared : false
=> tenant_id : admin-tenant
ex.
$ source openrc admin admin
$ neutron firewall-policy-create policy-admin
step2. Create firewall with following attributes(execute REST-API):
=> tenant_id : general-user-tenant
=> firewall_policy_id : specify the id which is created at step1.
ex.
$ source openrc demo demo
$ export TOKEN=`keystone token-get | grep ' id ' | get_field 2`
$ curl -i -X POST -d '{"firewall":{"firewall_policy_id": "05b28301-d7f8-4dbe-9cf0-ef33b6648ae8", "name":"firewall-demo"}}' -H "content-type: application/json" -H "x-auth-token: $TOKEN" http://localhost:9696/v2.0/fw/firewalls
[Response]
{
"NeutronError": {
"message": "Firewall Policy 05b28301-d7f8-4dbe-9cf0-ef33b6648ae8 could not be found.",
"type": "FirewallPolicyNotFound",
"detail": ""
}
}
Response is the above. That is, general-user doesn't have the authorizations to refer
the firewall-policy exists on admin tenant.
BUT, the firewall is created at general-user-tenant.
[Status]
$ source openrc demo demo
$ neutron firewall-show firewall-demo
+--------------------+--------------------------------------+
| Field | Value |
+--------------------+--------------------------------------+
| admin_state_up | True |
| description | |
| firewall_policy_id | 05b28301-d7f8-4dbe-9cf0-ef33b6648ae8 |
| id | cdfbbcb5-7d2f-4819-ad60-e73cb8de02ad |
| name | firewall-demo |
| router_ids | |
| status | PENDING_CREATE |
| tenant_id | 8241aeed3bf84489b545a3329a6f54b8 |
+--------------------+--------------------------------------+
And that, only the user who has the access authorizations into the firewall_policy can delete this resource.
In the above case, the general user can not delete the firewall resource.
Fix proposed to branch: master
Review: https:/