v3/credentials API is admin-only

[Steven Hardy]

The default policy makes v3/credentials admin-only:

http://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.json#n59

But in the docs, we say "generic credential storage per user" which implies it's a user accessible interface.

Also, for the ec2 credential storage to work as a replacement for the ec2tokens API, it needs to be user-accessible.

Seems like a more appropriate restriction would be to enforce that the user_id in the request matches the token, or the user is admin, e.g use "admin_or_owner" instead of "admin_required"

[Dolph Mathews (dolph)]

I think when that policy was written, admin_or_owner wasn't yet implemented.

[Lance Bragstad (lbragstad)]

Is this one still being worked?

[Ajaya Agrawal (ajayaa)]

lbragstad:
https://review.openstack.org/#/c/113232/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/113232
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=00597be4cca64b9aa691d6a135698f09af455cd7
Submitter: Jenkins
Branch: master

commit 00597be4cca64b9aa691d6a135698f09af455cd7
Author: Alexey Miroshkin <email address hidden>
Date: Mon Aug 11 15:39:17 2014 +0400

    Enable filtering of credentials by user ID

    A credentials entity has a user_id attribute. Currently the lack of a
    filter of user_id means that we cannot use the keystone policy file to
    enable users to have access to (only) their credentials. This fix solves
    it by adding such a filter:

    List credentials: `GET /credentials`
    Optional query parameters:
    - `user_id` (string)

    Implements: blueprint filter-credentials-by-user

    Closes-Bug: #1267096

    Change-Id: Iff016fac37b50d55d77ec7511aae4e57af34f08f