Service provider API doesn't use default roles

[Lance Bragstad]

In Rocky, keystone implemented support to ensure at least three default roles were available [0]. The service provider (federation) API doesn't incorporate these defaults into its default policies [1], but it should.

[0] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/rocky/define-default-roles.html
[1] https://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/policies/service_provider.py?id=fb73912d87b61c419a86c0a9415ebdcf1e186927

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/620156

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/620157

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/620158

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/620156
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=acd5d027ecc3d5b8819b0f5772ce114cdbd7a680
Submitter: Zuul
Branch: master

commit acd5d027ecc3d5b8819b0f5772ce114cdbd7a680
Author: Lance Bragstad <email address hidden>
Date: Mon Nov 26 19:46:30 2018 +0000

    Update service provider policies for system reader

    The service provider policies were not taking the default roles work
    we did last release into account. This commit changes the default
    policies to rely on the ``reader`` role for get and list service
    providers. Subsequent patches will incorporate:

     - system member test coverage
     - system admin functionality
     - domain users test coverage
     - project users test coverage

     Related-Bug: 1804520
     Related-Bug: 1804522

    Change-Id: I54fde6f6395b55a0798157346af3188bc756ba50

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/620157
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=e22bafa25bced833115530401ef878f5e1d1c7eb
Submitter: Zuul
Branch: master

commit e22bafa25bced833115530401ef878f5e1d1c7eb
Author: Lance Bragstad <email address hidden>
Date: Mon Nov 26 20:29:00 2018 +0000

    Add service provider tests for system member role

    From keystone's perspective, the ``member`` and ``reader`` roles are
    effectively the same, isolating writable service provider operations
    to the ``admin`` role.

    This commit adds explicit testing to make sure the ``member`` role is
    allowed to perform readable and not writable service provider
    operations. Subsequent patches will incorporate.

     - system admin functionality
     - domain users test coverage
     - project users test coverage

     Related-Bug: 1804520
     Related-Bug: 1804522

    Change-Id: Iecc39d5e4f1a4dc9293e67ee86f23f9a119793a8

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/620158
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=7ce5e3e24e8291c0af387a72ce7b47c3b28a9f74
Submitter: Zuul
Branch: master

commit 7ce5e3e24e8291c0af387a72ce7b47c3b28a9f74
Author: Lance Bragstad <email address hidden>
Date: Mon Nov 26 20:43:09 2018 +0000

    Update service provider policies for system admin

    This change makes the policy definitions for admin service
    provider operations consistent with the other service provider
    policies. Subsequent patches will incorporate:

     - domain users test coverage
     - project users test coverage

    Change-Id: I621192f089d1b29e2585d0030716348274e50bf1
    Related-Bug: 1804520
    Closes-Bug: 1804522

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystone 15.0.0.0rc1 release candidate.