rbac: after deletion of global-config-acl, admin not able create it

[shajuvk]

We need to either block admin from deletion of global-config-acl or the creation of it should be allowed after deletion:

root@a5s7:/opt/contrail/utils# python rbacutil.py --name "default-global-system-config:default-api-access-list" --op read
Rbac is enabled

Oper = read
Name = ['default-global-system-config', 'default-api-access-list']
UUID = None
API Server = 127.0.0.1:8082

Rules (3):
----------
 1 fqname-to-id *:CRUD,
 2 id-to-fqname *:CRUD,
 3 documentation *:R,

root@a5s7:/opt/contrail/utils# python rbacutil.py --name "default-global-system-config:default-api-access-list" --op delete
Rbac is enabled

Oper = delete
Name = ['default-global-system-config', 'default-api-access-list']
UUID = None
API Server = 127.0.0.1:8082

Rules (3):
----------
 1 fqname-to-id *:CRUD,
 2 id-to-fqname *:CRUD,
 3 documentation *:R,

Confirm (y/n): y
root@a5s7:/opt/contrail/utils# python rbacutil.py --name "default-global-system-config:default-api-access-list" --op read
Permission Denied
Rbac not supported

root@a5s7:/opt/contrail/utils# env | grep OS
OS_PASSWORD=contrail123
OS_AUTH_URL=http://192.168.10.2:5000/v2.0/
OS_USERNAME=admin
OS_TENANT_NAME=admin
OS_NO_CACHE=1
LESSCLOSE=/usr/bin/lesspipe %s %s
root@a5s7:/opt/contrail/utils# python rbacutil.py --name "default-global-system-config:default-api-access-list" --op create
Permission Denied
Rbac not supported

[shajuvk (shajuvk)]

Marking it as blocker, it is functionality blocker

[Deepinder Setia (dsetia)]

Shaju, can you check if this is still a problem?

[Deepinder Setia (dsetia)]

I think this might have been fixed by https://review.opencontrail.org/#/c/22683/

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/23073
Submitter: Deepinder Setia (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/23073
Committed: http://github.org/Juniper/contrail-controller/commit/5d0a563f681d796f3c5aca8fd2c319e3463b0aa0
Submitter: Zuul
Branch: R3.1

commit 5d0a563f681d796f3c5aca8fd2c319e3463b0aa0
Author: Deepinder Setia <email address hidden>
Date: Mon Aug 8 17:29:02 2016 -0700

Skip redundant (and sometimes spurious) checks if admin.

Change-Id: Iac78e812a98fe6a09444613e146d6f4cffc24834
Closes-Bug: 1607989

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/23322
Submitter: Deepinder Setia (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/23322
Committed: http://github.org/Juniper/contrail-controller/commit/8dd22ef3e30fcc6ba26962500f7a6dbc068bcf34
Submitter: Zuul
Branch: R3.0

commit 8dd22ef3e30fcc6ba26962500f7a6dbc068bcf34
Author: Deepinder Setia <email address hidden>
Date: Mon Aug 8 17:29:02 2016 -0700

Skip redundant (and sometimes spurious) checks if admin.

Closes-Bug: 1607989

Conflicts:
 src/config/api-server/vnc_rbac.py

Change-Id: Ib28628a9d9b4b263ad29d83359d86397eca99dd2