roles接口请求报错403后，其他页面401无法访问

[liqi]

使用普通用户角色“_member_”登录之后，role接口报错403
其他页面，像云主机、云硬盘、网络等页面都报错401“您没有权限访问网络。”，实际没有接口调用

http://172.20.150.41:9999/api/openstack/regionone/keystone/v3/system/users/14f07eb319c4433bbc5ecfca1ccfd289/roles

{
    "error": {
        "code": 403,
        "message": "You are not authorized to perform the requested action: identity:list_system_grants_for_user.",
        "title": "Forbidden"
    }
}

如附件图示

[Wu Wenxiang (wu-wenxiang)]

This issue also confuse me.

Symptom:
-----------------------------------
1. Login Horizon with common user A, list servers OK.
2. Login Skyline with same common user A, could list the nova servers, F12 show no http requests sent from network, however webpage show 401, do not allow to list servers

Root Cause Analysis:
-----------------------------------
1. Horizon don't know whether a user could do an action at a resource or not. It simply pass request to recording service, & service (Nova) do the check by its policy file. So it works.
2. Skyline check the action by itself, with /policy API. If you do not configure it, the default value follows community, like: https://docs.openstack.org/nova/2023.2/configuration/sample-policy.html

How to fix:
-----------------------------------
1. By default, list servers need "project_reader_api": "role:reader and project_id:%(project_id)s"
2. You should config your customized role, for example: member, _member_, projectAdmin, etc, create implied reader role. "openstack implied role create --implied-role member projectAdmin", or "openstack implied role create --implied-role reader _member_"

# openstack implied role list
+----------------------------------+-----------------+----------------------------------+-------------------+
| Prior Role ID | Prior Role Name | Implied Role ID | Implied Role Name |
+----------------------------------+-----------------+----------------------------------+-------------------+
| fe21c5a0d17149c2a7b02bf39154d110 | admin | 4376fc38ba6a44e794671af0a9c60ef5 | member |
| 4376fc38ba6a44e794671af0a9c60ef5 | member | e081e01b7a4345bc85f8d3210b95362d | reader |
| bee8fa36149e434ebb69b61d12113031 | projectAdmin | 4376fc38ba6a44e794671af0a9c60ef5 | member |
| 77cec9fc7e764bd4bf60581869c048de | _member_ | e081e01b7a4345bc85f8d3210b95362d | reader |
+----------------------------------+-----------------+----------------------------------+-------------------+

[Wu Wenxiang (wu-wenxiang)]

By the way, 403 has no relationship this issue.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/openstack/skyline-apiserver/+/906345

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/skyline-apiserver/+/906345
Committed: https://opendev.org/openstack/skyline-apiserver/commit/b1a693d0a3a9ff1c44f0e1e56279fd238c0ea047
Submitter: "Zuul (22348)"
Branch: master

commit b1a693d0a3a9ff1c44f0e1e56279fd238c0ea047
Author: Wenxiang Wu <[e-mail]>
Date: Tue Jan 23 14:13:45 2024 +0800

    docs: add FAQ in README.rst

    Closes-Bug: #2049807
    Change-Id: I9beb1c1e7ba2d8c0378d4eabe8dbd05ffeb06c69

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/skyline-apiserver 4.0.0.0rc1 release candidate.