rbac: resource based verification doesnt work

[Senthilnathan Murugappan]

A port created under 'admin' tenant can be deleted with creds of 'test-project1' tenant. This shouldnt have worked unless 'test-project1' is under shared list.

root@a2s41:~/master_181215/contrail-test# curl -uadmin:contrail123 http://127.0.0.1:8095/virtual-machine-interface/d1f45946-9f8e-4e62-8e3e-b1f1541592ae | python -m json.tool | grep -4 perms2
        "name": "d1f45946-9f8e-4e62-8e3e-b1f1541592ae",
        "parent_href": "http://127.0.0.1:8095/project/b105460e-bf4f-4878-af46-f09a9291dd8d",
        "parent_type": "project",
        "parent_uuid": "b105460e-bf4f-4878-af46-f09a9291dd8d",
        "perms2": {
            "global_access": 0,
            "owner": "b105460ebf4f4878af46f09a9291dd8d",
            "owner_access": 7,
            "share": []

root@a2s41:~/master_181215/contrail-test# keystone tenant-get b105460ebf4f4878af46f09a9291dd8d
+-------------+----------------------------------+
| Property | Value |
+-------------+----------------------------------+
| description | |
| enabled | True |
| id | b105460ebf4f4878af46f09a9291dd8d |
| name | admin |
+-------------+----------------------------------+
root@a2s41:~/master_181215/contrail-test# source ~/openstackrc
root@a2s41:~/master_181215/contrail-test# env | grep TENANT
OS_TENANT_NAME=test-project1
root@a2s41:~/master_181215/contrail-test# neutron port-delete d1f45946-9f8e-4e62-8e3e-b1f1541592ae
Deleted port: d1f45946-9f8e-4e62-8e3e-b1f1541592ae

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/16246
Submitter: Deepinder Setia (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/18155
Submitter: Deepinder Setia (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/18155
Committed: http://github.org/Juniper/contrail-provisioning/commit/5754da651d28d69e21f18335ef013d373c913cac
Submitter: Zuul
Branch: master

commit 5754da651d28d69e21f18335ef013d373c913cac
Author: Deepinder Setia <email address hidden>
Date: Thu Mar 3 16:39:16 2016 -0800

Create cloud admin role and add it to admin user in admin tenant
while provisioning keystone. This is needed for enabling RBAC
wherein 'admin' role will cease to have special privileges.

Change-Id: I9c3cf8ae7ae2f55f16f7d4c8b9fe57e95572a0cd
Partial-Bug: #1530218

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/16246
Submitter: Deepinder Setia (<email address hidden>)

[OpenContrail Admin (ci-admin-f)]

Reviewed: https://review.opencontrail.org/16246
Committed: http://github.org/Juniper/contrail-controller/commit/a8556468737f0570d42b4d6d5a22f056a0081a66
Submitter: Zuul
Branch: master

commit a8556468737f0570d42b4d6d5a22f056a0081a66
Author: Deepinder Setia <email address hidden>
Date: Tue Jan 12 13:53:56 2016 -0800

Introduce cloud admin role with super user previledges. It is configurable
and set to 'admin' by default for backward compatability. If set to another
value, 'admin' role will no longer be treated in a special way when multi
tenancy with RBAC is turned on.

Change-Id: Id8e19027ccb93d7320da2c54f279a684422305ba
Partial-Bug: #1530218

[OpenContrail Admin (ci-admin-f)]

Review in progress for https://review.opencontrail.org/22582
Submitter: Deepinder Setia (<email address hidden>)