RBAC - default-domain:default-api-access list needs to be updated with minimal R cred for all users
Currently the default-api-access does not have 'project' read access for any role including admin, because of which the admin is not able to create a network in his tennant. This fails at the o=project, op=R step:
root@a5d02e33:~# neutron net-create test-rbac
An unknown exception occurred.
root@a5d02e33:~#
RBAC - default- domain: default- api-access list needs to be updated with minimal R cred for all users
Currently the default-api-access does not have 'project' read access for any role including admin, because of which the admin is not able to create a network in his tennant. This fails at the o=project, op=R step:
root@a5d02e33:~# neutron net-create test-rbac
An unknown exception occurred.
root@a5d02e33:~#
DEBUG:contrail- api:__default_ _ [SYS_DEBUG]: VncApiError: u=new-rbac-admin, r=[u'admin', u'_member_'], o=project, op=R, rules=5, proj:a1c652329b af451b8ba1e1b9f 1282b1c( new-rbac- tenant) , dom:None api:__default_ _ [SYS_DEBUG]: VncApiError: Rule 1) fqname-to-id *:CRUD, (-1,False) api:__default_ _ [SYS_DEBUG]: VncApiError: Rule 2) id-to-fqname *:CRUD, (-1,False) api:__default_ _ [SYS_DEBUG]: VncApiError: Rule 3) documentation *:R, (-1,False) api:__default_ _ [SYS_DEBUG]: VncApiError: Rule 4) virtual-network.* admin:CRUD, Member: CRU,test: R, (-1,False) api:__default_ _ [SYS_DEBUG]: VncApiError: Rule 5) virtual-networks.* admin:CRUD, Member: CRU,test: R, (-1,False) api:__default_ _ [SYS_DEBUG]: VncApiError:
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
--- admin=no, u=new-rbac-admin, r='admin,_member_'
root@a5d02e33:~# keystone token-get -----+- ------- ------- ------- ------- -----+ -----+- ------- ------- ------- ------- -----+ 19T18:31: 29Z | ebe984757c0bc0c 5a | b8ba1e1b9f1282b 1c | 7b93e9ddf19ae08 82 | -----+- ------- ------- ------- ------- -----+ ebe984757c0bc0c 5a' http:// 127.0.0. 1:8082/ project/ a1c652329baf451 b8ba1e1b9f1282b 1c ------- ------- ------- ------- +------ ------- ------- +------ ---+ ------- ------- ------- ------- +------ ------- ------- +------ ---+ 8bb7afc6b4f7882 91 | admin | True | 4b2f9d73e62122d 5b | demo | True | c98f686fb6688b1 0b | invisible_to_admin | True | b8ba1e1b9f1282b 1c | new-rbac-tenant | True | e97108f4696712b 32 | rbac-test | True | ca15b8d3a8b7e3d be | service | True | ------- ------- ------- ------- +------ ------- ------- +------ ---+ b8ba1e1b9f1282b 1c ------- ------- ------- ------- +------ ----+-- ------- ------- ------- ------- ----+-- ------- ------- ------- ------- ----+ ------- ------- ------- ------- +------ ----+-- ------- ------- ------- ------- ----+-- ------- ------- ------- ------- ----+ 894a90878d3e92b ab | _member_ | 2d999d17d736480 7b93e9ddf19ae08 82 | a1c652329baf451 b8ba1e1b9f1282b 1c | 690a96ce9e6962e 93 | admin | 2d999d17d736480 7b93e9ddf19ae08 82 | a1c652329baf451 b8ba1e1b9f1282b 1c | ------- ------- ------- ------- +------ ----+-- ------- ------- ------- ------- ----+-- ------- ------- ------- ------- ----+
+------
| Property | Value |
+------
| expires | 2016-05-
| id | 53ba33256b6f4ff
| tenant_id | a1c652329baf451
| user_id | 2d999d17d736480
+------
root@a5d02e33:~#
root@a5d02e33:~# curl -H 'X-AUTH-TOKEN: 53ba33256b6f4ff
Permission Denied
root@a5d02e33:~# keystone tenant-list
+------
| id | name | enabled |
+------
| 10357a4826cb406
| 2fa850a59eec4c9
| 38f63c3f64f44f6
| a1c652329baf451
| 254090e351f54ab
| 44091587af0946c
+------
root@a5d02e33:~# keystone user-role-list --user new-rbac-admin --tenant a1c652329baf451
+------
| id | name | user_id | tenant_id |
+------
| 9fe2ff9ee4384b1
| 08843657439f4db
+------
root@a5d02e33:~#
root@a5d02e33:~# env | grep OS 10.87.129. 224:5000/ v2.0/ new-rbac- admin NAME=new- rbac-tenant /usr/bin/ lesspipe %s %s
OS_PASSWORD=rbac123
OS_AUTH_URL=http://
OS_USERNAME=
OS_TENANT_
OS_NO_CACHE=1
LESSCLOSE=
root@a5d02e33:~#
After adding "project *:R" admin is able to create network:
10.87.143.116 - - [2016-05-19 11:06:53] "GET /project/ a1c65232- 9baf-451b- 8ba1-e1b9f1282b 1c HTTP/1.1" 401 196 0.017696 api:__default_ _ [SYS_DEBUG]: VncApiError: u=new-rbac-admin, r=[u'admin', u'_member_'], o=project, op=R, rules=6, proj:a1c652329b af451b8ba1e1b9f 1282b1c( new-rbac- tenant) , dom:None api:__default_ _ [SYS_DEBUG]: VncApiError: Rule 1) fqname-to-id *:CRUD, (-1,False) api:__default_ _ [SYS_DEBUG]: VncApiError: Rule 2) id-to-fqname *:CRUD, (-1,False) api:__default_ _ [SYS_DEBUG]: VncApiError: Rule 3) documentation *:R, (-1,False) api:__default_ _ [SYS_DEBUG]: VncApiError: Rule 4) project.* *:R, (1,True) api:__default_ _ [SYS_DEBUG]: VncApiError: Rule 5) virtual-network.* admin:CRUD, Member: CRU,test: R, (-1,False) api:__default_ _ [SYS_DEBUG]: VncApiError: Rule 6) virtual-networks.* admin:CRUD, Member: CRU,test: R, (-1,False) api:__default_ _ [SYS_DEBUG]: VncApiError: +++ admin=no, u=new-rbac-admin, r='admin,_member_'
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
DEBUG:contrail-
root@a5d02e33:~# neutron net-create net-2 ------- ------- -----+- ------- ------- ------- ------- ------- --+ ------- ------- -----+- ------- ------- ------- ------- ------- --+ instance_ count | 0 | 5b67-4195- 9f84-e6993f5ad4 e0 | b8ba1e1b9f1282b 1c | ------- ------- -----+- ------- ------- ------- ------- ------- --+
Created a new network:
+------
| Field | Value |
+------
| admin_state_up | True |
| contrail:fq_name | default-domain |
| | new-rbac-tenant |
| | net-2 |
| contrail:
| id | 4627a227-
| name | net-2 |
| router:external | False |
| shared | False |
| status | ACTIVE |
| subnets | |
| tenant_id | a1c652329baf451
+------
root@a5d02e33:~#