assigning a domain-specific role in domain A for a user to a project in domain B should be prohibited

[Guang Yee]

Domain-specific roles are visible in their owning domains only. Therefore, assigning a domain-specific role in a domain to users for a project in another domain should be prohibited.

To reproduce:

1. create a domain-specific "foo_domain_role" in the "foo" domain.
2. create a project "bar_project" in "bar" domain.
3. create a user "bar_user" in "bar" domain.
4. now assign the role "foo_domain_role" to user "bar_user" for "bar_project", this should yield 403 instead of 201.

[Henry Nash (henry-nash)]

Is this using policy.json or policy.v3cloudsample.json? And is the assignment done with http, or osc?

[Guang Yee (guang-yee)]

This is using vanilla devstack and policy.json. Assignment was done via "openstack role add".

[Dolph Mathews (dolph)]

I agree with the assertion in the bug. I would think that this would return a 4xx error (not sure I agree with a 403, but...) for both of the following reasons:

1. A domain-specific role should not be assignable to users owned by another domain.

2. A domain-specific role should not be assignable to projects owned by another domain.

It appears that neither one of these are being checked? Is there a use case to not check against one of these?

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/365177

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/365177
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=73bdbe1f87ac3571bb5a348158ad1e4ece73fbcc
Submitter: Jenkins
Branch: master

commit 73bdbe1f87ac3571bb5a348158ad1e4ece73fbcc
Author: Sean Perry <email address hidden>
Date: Fri Sep 2 16:48:54 2016 -0700

    Project domain must match role domain for assignment

    When assigning a Domain specific role to a user it is OK if the user
    is from a different domain, but the project's domain must match the
    role's domain.

    Closes-Bug: 1590587
    Change-Id: I1d63415de0130794939998c3e142ebdce9ddf39d

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystone 10.0.0.0rc1 release candidate.