RBAC - default-domain:default-api-access list needs to be updated with creds to certain objects
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Juniper Openstack |
Won't Fix
|
High
|
Deepinder Setia | ||
R3.1 |
Won't Fix
|
High
|
Deepinder Setia | ||
Trunk |
Won't Fix
|
High
|
Deepinder Setia |
Bug Description
RBAC - default-
Currently the default-api-access does not have 'project' read access for any role including admin, because of which the admin is not able to create a network in his tennant. This fails at the o=project, op=R step:
root@a5d02e33:~# neutron net-create test-rbac
An unknown exception occurred.
root@a5d02e33:~#
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
--- admin=no, u=new-rbac-admin, r='admin,_member_'
root@a5d02e33:~# keystone token-get
+------
| Property | Value |
+------
| expires | 2016-05-
| id | 53ba33256b6f4ff
| tenant_id | a1c652329baf451
| user_id | 2d999d17d736480
+------
root@a5d02e33:~#
root@a5d02e33:~# curl -H 'X-AUTH-TOKEN: 53ba33256b6f4ff
Permission Denied
root@a5d02e33:~# keystone tenant-list
+------
| id | name | enabled |
+------
| 10357a4826cb406
| 2fa850a59eec4c9
| 38f63c3f64f44f6
| a1c652329baf451
| 254090e351f54ab
| 44091587af0946c
+------
root@a5d02e33:~# keystone user-role-list --user new-rbac-admin --tenant a1c652329baf451
+------
| id | name | user_id | tenant_id |
+------
| 9fe2ff9ee4384b1
| 08843657439f4db
+------
root@a5d02e33:~#
root@a5d02e33:~# env | grep OS
OS_PASSWORD=rbac123
OS_AUTH_URL=http://
OS_USERNAME=
OS_TENANT_
OS_NO_CACHE=1
LESSCLOSE=
root@a5d02e33:~#
After adding "project *:R" admin is able to create network:
10.87.143.116 - - [2016-05-19 11:06:53] "GET /project/
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
root@a5d02e33:~# neutron net-create net-2
Created a new network:
+------
| Field | Value |
+------
| admin_state_up | True |
| contrail:fq_name | default-domain |
| | new-rbac-tenant |
| | net-2 |
| contrail:
| id | 4627a227-
| name | net-2 |
| router:external | False |
| shared | False |
| status | ACTIVE |
| subnets | |
| tenant_id | a1c652329baf451
+------
root@a5d02e33:~#
Please provide following access
ref-update *:CRUD
useragent-kv *:CRUD
* *:R
api-access-lists admin:CRUD
api-access-list admin:CRUD
information type: | Proprietary → Public |
summary: |
- RBAC - default-domain:default-api-access list needs to be updated with - minimal R cred for all users + RBAC - default-domain:default-api-access list needs to be updated creds + to certain objects |
description: | updated |
summary: |
- RBAC - default-domain:default-api-access list needs to be updated creds - to certain objects + RBAC - default-domain:default-api-access list needs to be updated with + creds to certain objects |
tags: | added: config |
Changed in juniperopenstack: | |
importance: | Undecided → High |
description: | updated |
description: | updated |
Changed in juniperopenstack: | |
status: | New → Won't Fix |
Not relevant as it is superseded by 1604197