Nova and Keystone are case insensitive when checking roles.
nova:
if self.is_admin is None:
self.is_admin = 'admin' in [x.lower() for x in self.roles]
keystone:
def _check_role(self, match, target_dict, cred_dict):
"""Check that there is a matching role in the cred dict."""
return match.lower() in [x.lower() for x in cred_dict['roles']]
However, glance is case sensitive:
roles_header = req.headers.get('X-Roles', '')
roles = [r.strip() for r in roles_header.split(',')]
...
'is_admin': self.conf.admin_role in roles,
By default, self.conf.admin_role == 'admin', so, keystone's `Admin` role (that could migrate from a diablo database) will not be acceptable.
Let's fix it:
roles = [r.strip().lower() for r in roles_header.split(',')]
Fix proposed to branch: master
Review: https:/