Juniper Openstack

RBAC - When RBAC is enabled, new admin token gets fetched and been used as owner rather than using the actual user token

Bug #1583241 reported by Akila
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Juniper Openstack
Status tracked in Trunk
R3.0
Fix Committed
High
Deepinder Setia
Juniper Openstack r3.0.3.0
R3.1
Fix Committed
High
Deepinder Setia
Juniper Openstack r3.1.0.0-fcs
Trunk
Fix Committed
High
Deepinder Setia

Bug Description

When rbac is enabled, new admin token gets fetched and been used as owner rather than using the actual user token, as a result the perms2 shows owner as admin rather than tenant.

root@a5d02e33:~# contrail-version
Package Version Build-ID | Repo | Package Name
-------------------------------------- ------------------------------ ----------------------------------
contrail-analytics 3.1.0.0-2730 2730
contrail-config 3.1.0.0-2730 2730
contrail-config-openstack 3.1.0.0-2730 2730
contrail-control 3.1.0.0-2730 2730
contrail-dns 3.1.0.0-2730 2730
contrail-docs 3.1.0.0-2730 2730
contrail-f5 3.1.0.0-2730 2730
contrail-fabric-utils 3.1.0.0-2730 2730
contrail-heat 3.1.0.0-2730 2730
contrail-install-packages 3.1.0.0-2730~kilo 2730
contrail-lib 3.1.0.0-2730 2730
contrail-nodemgr 3.1.0.0-2730 2730
contrail-nova-networkapi 3.1.0.0-2730 2730
contrail-openstack 3.1.0.0-2730 2730
contrail-openstack-analytics 3.1.0.0-2730 2730
contrail-openstack-config 3.1.0.0-2730 2730
contrail-openstack-control 3.1.0.0-2730 2730
contrail-openstack-dashboard 3.1.0.0-2730 2730
contrail-openstack-database 3.1.0.0-2730 2730
contrail-openstack-webui 3.1.0.0-2730 2730
contrail-setup 3.1.0.0-2730 2730
contrail-utils 3.1.0.0-2730 2730
contrail-web-controller 3.1.0.0-2730 2730
contrail-web-core 3.1.0.0-2730 2730
ifmap-python-client 0.1-2 2730
ifmap-server 0.3.2-1contrail2 2730
neutron-plugin-contrail 3.1.0.0-2730 2730
nova-api 1:2015.1.2-0ubuntu2~cloud0.1contrail2730
nova-common 1:2015.1.2-0ubuntu2~cloud0.1contrail2730
nova-conductor 1:2015.1.2-0ubuntu2~cloud0.1contrail2730
nova-console 1:2015.1.2-0ubuntu2~cloud0.1contrail2730
nova-consoleauth 1:2015.1.2-0ubuntu2~cloud0.1contrail2730
nova-novncproxy 1:2015.1.2-0ubuntu2~cloud0.1contrail2730
nova-objectstore 1:2015.1.2-0ubuntu2~cloud0.1contrail2730
nova-scheduler 1:2015.1.2-0ubuntu2~cloud0.1contrail2730
python-contrail 3.1.0.0-2730 2730
python-neutronclient 1:2.3.11-0ubuntu1~cloud0.3contrail2730
python-nova 1:2015.1.2-0ubuntu2~cloud0.1contrail2730
root@a5d02e33:~#

On denugging it is seen that this issue is seen when multi_tenancy is not set "/etc/contrail/contrail-api.conf"

Tags: config rbac
Akila (akila-a)
information type: Proprietary → Public
Akila (akila-a)
summary: - When rbac is enabled, new admin token gets fetched and been used as
- owner rather than using the actual user token
+ RBAC - When RBAC is enabled, new admin token gets fetched and been used
+ as owner rather than using the actual user token
Jeba Paulaiyan (jebap)
tags: added: config
Changed in juniperopenstack:
importance: Undecided → High
Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : [Review update] R3.1

Review in progress for https://review.opencontrail.org/22792
Submitter: Deepinder Setia (<email address hidden>)

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : A change has been merged

Reviewed: https://review.opencontrail.org/22792
Committed: http://github.org/Juniper/contrail-provisioning/commit/da76c6c402c2a5a2fe90901010c2ca00fedafd9d
Submitter: Zuul
Branch: R3.1

commit da76c6c402c2a5a2fe90901010c2ca00fedafd9d
Author: Deepinder Setia <email address hidden>
Date: Wed Aug 3 00:19:05 2016 -0700

When rbac is configured (aaa_mode is rbac), setup neutron pipeline
to pass user token to API server

Change-Id: I0d9e9b6559423ae74ba042333e1a5b54f0e91c84
Closes-Bug: #1583241

Revision history for this message
OpenContrail Admin (ci-admin-f) wrote : [Review update] R3.0

Review in progress for https://review.opencontrail.org/23317
Submitter: Deepinder Setia (<email address hidden>)

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.