Need to enforce project ownership of subCAs

[Dave McCowan]

The add-to-project and create CA commands can only be performed by a project administrator when the target CA is either a root CA or a subCA owned by the admin's project.

Checks should be added to enforce this condition.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/230062
Committed: https://git.openstack.org/cgit/openstack/barbican/commit/?id=8bbf06caae29c1cafa16f4ed8db83938b9cf94f3
Submitter: Jenkins
Branch: master

commit 8bbf06caae29c1cafa16f4ed8db83938b9cf94f3
Author: Dave McCowan <email address hidden>
Date: Thu Oct 1 14:13:15 2015 -0400

    Enforce project ownership of subCAs

    The add-to-project and create CA commands can only be performed by
    a project administrator when the target CA is either a root CA
    or a subCA owned by the admin's project.

    This CR adds checks to enforce this condition.

    Change-Id: Ifbd7bb471b137a5549a8e627344f8f02adda2ed1
    Closes-bug: #1501862

[Thierry Carrez (ttx)]

We are tracking pre-release using a single series line (FixCommitted = Fixed in master, FixReleased = Fixed in liberty release branch)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/liberty
Review: https://review.openstack.org/230891

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/230891
Committed: https://git.openstack.org/cgit/openstack/barbican/commit/?id=6845b19f99646d955d6edf18d166709efdc6cfef
Submitter: Jenkins
Branch: stable/liberty

commit 6845b19f99646d955d6edf18d166709efdc6cfef
Author: Dave McCowan <email address hidden>
Date: Thu Oct 1 14:13:15 2015 -0400

    Enforce project ownership of subCAs

    The add-to-project and create CA commands can only be performed by
    a project administrator when the target CA is either a root CA
    or a subCA owned by the admin's project.

    This CR adds checks to enforce this condition.

    Change-Id: Ifbd7bb471b137a5549a8e627344f8f02adda2ed1
    Closes-bug: #1501862
    (cherry picked from commit 8bbf06caae29c1cafa16f4ed8db83938b9cf94f3)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/235154

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/235154
Committed: https://git.openstack.org/cgit/openstack/barbican/commit/?id=63b69bd2778410fcc7f0530adc72fc8ed4585d0c
Submitter: Jenkins
Branch: master

commit 7a324b4d03e917f1c990282b39cacb9d543383c9
Author: Chris Solis <email address hidden>
Date: Mon Sep 28 23:19:19 2015 -0500

    Fix db_manage to initialize mysql from base

    Change the db_manage script to include types when
    altering tables and drop constraints before altering tables
    because mysql will not allow actions on a table with constraints.

    Change-Id: Iafacd662f013cb846bcb3f4ecc50e586e04d55b8
    Closes-bug: #1500687
    (cherry picked from commit 2333d5c13a5e57bd6c763b1547c143d7f504ccc3)

commit 6845b19f99646d955d6edf18d166709efdc6cfef
Author: Dave McCowan <email address hidden>
Date: Thu Oct 1 14:13:15 2015 -0400

    Enforce project ownership of subCAs

    The add-to-project and create CA commands can only be performed by
    a project administrator when the target CA is either a root CA
    or a subCA owned by the admin's project.

    This CR adds checks to enforce this condition.

    Change-Id: Ifbd7bb471b137a5549a8e627344f8f02adda2ed1
    Closes-bug: #1501862
    (cherry picked from commit 8bbf06caae29c1cafa16f4ed8db83938b9cf94f3)

commit 588e5d3c48faef86b0746decb72a6ffb3d6d44d6
Author: Dave McCowan <email address hidden>
Date: Fri Sep 25 17:30:46 2015 -0400

    Check a CA's status as project and preferred CA before deleting

    If a CA is preferred and not the last CA of a project, it should
    not be deleted. A user is informed of this with a 409 status code.

    Otherwise, the CA can be deleted as well as any record of it in the
    CA project list and the CA preferred list.

    Change-Id: I9a1ee91252ee17746cfcffd11cba520270d09f21
    Closes-bug: #1499876
    (cherry picked from commit 4afaee095a78cbc473278ac42bb2f9de949af0a8)

commit d582aa6226014b54f30b78bb509893440a780de7
Author: Ade Lee <email address hidden>
Date: Fri Sep 25 00:19:38 2015 -0400

    Add subca functionality to the dogtag plugin

    The Dogtag CA plugin has been modified to support
    subordinate CAs. This includes updating the list of
    CAs read from the CA when the the ca list is refreshed.

    Unit tests for the Dogtag CA have been updated, and functional
    tests have been added for the Dogtag CA for subca creation.

    Also added some exceptions to convey issues in subca creation
    and deletion.

    Closes-Bug: #1502320
    Partially-Implements: blueprint add-cas
    Change-Id: I1766cb4a2069ea56d386067c9aa2811a50410a9d
    (cherry picked from commit be40fa7d0393cb30b4c03ce7ee4dcb6c990761a9)

commit 85c7d957495309fb8c9af010c93dd080dc63e97e
Author: Douglas Mendizábal <email address hidden>
Date: Mon Oct 5 00:51:57 2015 -0500

    Update .gitreview to match stable/liberty

    Change-Id: I194ec20f1d9f641455aebfd99e3bad5a38cf7725

commit 3cf0501dfc267dc77936b810b10c583e31cccf64
Author: jfwood <email address hidden>
Date: Mon Sep 28 09:02:33 2015 -0500

    Exit with error code when db_manage.py fails

    The DB migration script db_manage.py always returned a 0 ex...

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/barbican 1.0.0 release.