Assign floating IP to port owned by another tenant is not override-able with RBAC policy

[Michael Johnson]

In neutron/db/l3_db.py:

    def _internal_fip_assoc_data(self, context, fip, tenant_id):
        """Retrieve internal port data for floating IP.
        Retrieve information concerning the internal port where
        the floating IP should be associated to.
        """
        internal_port = self._core_plugin.get_port(context, fip['port_id'])
        if internal_port['tenant_id'] != tenant_id and not context.is_admin:
            port_id = fip['port_id']
            msg = (_('Cannot process floating IP association with '
                     'Port %s, since that port is owned by a '
                     'different tenant') % port_id)
            raise n_exc.BadRequest(resource='floatingip', msg=msg)

This code does not allow operators to override the ability to assign floating IPs to ports on another tenant using RBAC policy. It also does not allow members of the advsvc role to take this action.

This code should be fixed to use the standard neutron RBAC and allow the advsvc role to take this action.

[Adam Harwell (adam-harwell)]

Yep, sorry about that. :D

[Michael Johnson (johnsom)]

It's in different code.

1796854 did not fix this if that is what you are implying.

[William Fichtner (will-ficht)]

Please correct me if I'm wrong, here the issue is, a user with advsvc role from another tenant is not able to assign Floating IP to a port not owned by him though RBAC gives him such power. Is it?