non-admin user accesses "limits" api failed with 403 if "default" policy rule changed

[Gao Zexu]

If "default" rule in cinder policy is changed to "rule:admin_api" or other style that does not contain '["project_id:%(project_id)s"]', non-admin user accesses the limits api will be failed with 403 error.

The rule "limits_extension:used_limits" is used by "UsedLimitsController" which is a controller extension and it extends "limits" api. Most of controller extensions authorize user's
context by applying the function "extensions.soft_extension_authorizer()", but "UsedLimitsController" applies "extensions.extension_authorizer" and this causes 403 Forbidden error.

I think it's a bug, because "UsedLimitsController" is intend to collect infos for authorized user rather than forbid unauthorized user to access "limits" api.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/226149

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/226149
Committed: https://git.openstack.org/cgit/openstack/cinder/commit/?id=4bdeb045e491a86aeb8a1487798e598a2fa56e2f
Submitter: Jenkins
Branch: master

commit 4bdeb045e491a86aeb8a1487798e598a2fa56e2f
Author: Gaozexu <email address hidden>
Date: Tue Sep 22 11:35:37 2015 +0800

    Fix UsedLimitsController's authorizer to soft

    The rule "limits_extension:used_limits" is used by
    "UsedLimitsController" which is a controller extension and it extends
    "limits" api. Most of controller extensions authorize user's context
    by applying the function "extensions.soft_extension_authorizer()",
    but "UsedLimitsController" applies "extensions.extension_authorizer"
    and this may cause 403 Forbidden error.

    In this patch, I changed UsedLimitsController's authorizer to
    "soft_extension_authorizer".

    APIImpact

    Co-Authored-By: ZhuChunzhan <email address hidden>

    Change-Id: I8a4163ca89236b35c2c6ba10bcd98f8c42ef9089
    Closes-Bug: #1497868

[Thierry Carrez (ttx)]

This issue was fixed in the openstack/cinder 8.0.0.0b1 development milestone.