"Create Role" and "Delete Role" buttons are missing for a domain admin user

[Dmitrii Shcherbakov]

This bug is similar to https://bugs.launchpad.net/ubuntu/+source/horizon/+bug/1775224 so I am pasting the initial description without modification.

The setup with xenial + Queens UCA and 18.02 charms is as follows:
https://paste.ubuntu.com/p/BQn3JHr5yZ/

adma and admb are users with Admin role granted on their respective domain level so they can manage users, groups and roles due to how policy rules shipped via charms are structured http://paste.ubuntu.com/p/ybpvMsmWHC/
    "identity:create_user": "rule:cloud_admin or rule:admin_and_matching_user_domain_id",

While it is possible to do CRUD on roles from CLI, e.g. adma user can create new roles in domain a, there is no visible way to do that from the dashboard for create and delete operations.

A user with an admin-project/domain scoped token has that ability and sees all necessary buttons (https://specs.openstack.org/openstack/keystone-specs/specs/mitaka/is_admin_project.html, see
https://github.com/openstack/keystone/blob/stable/queens/keystone/conf/resource.py#L59-L77)

The problem does not seem to be related to oslo.policy directly (policy files seem to be correct) - just to how horizon handles domain administrators.

Trying to invoke a modal window directly via http://<horizon-address>/identity/roles/create/ does not work as it does, e.g. with users in bug 1775224.

[James Page (james-page)]

Dmitrii - is this something that's specific to the way that you're deploying Horizon, or do you think this is a more general upstream bug in Horizon?

[Dmitrii Shcherbakov (dmitriis)]

James,

I think this looks like a more general upstream problem. Billy pointed us to https://review.openstack.org/#/c/345186/ in the support case.

[Corey Bryant (corey.bryant)]

Adding upstream as this seems to be pointing to a general upstream issue.

[Akihiro Motoki (amotoki)]

Since Queens release, the default policy file shipped with horizon is based on individual back-end projects. keystone policy.json (and keystone default policy defined as policy-in-code) defines "rule:admin_required" as the default policy for "identity:create_role" and "identity:delete_role". Thus, it is not surprising that "Create Role" and "Delete Role" buttons are missing for a domain admin.

To use the domain admin feature, you need to customize policy.json file for keystone.

What keystone policy is used for horizon (and keystone)?

[Akihiro Motoki (amotoki)]

I agree that the current horizon does not support role create/delete operations by domain admin.

[Akihiro Motoki (amotoki)]

My comment in #7 is based on role_create(). I didn't check it works with domain admin, so my comment might be wrong.
https://github.com/openstack/horizon/blob/master/openstack_dashboard/api/keystone.py#L710-L712