Domain admin has access to service Admin API with policy.v3cloudsample.json
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
OpenStack Identity (keystone) |
New
|
Undecided
|
Unassigned | ||
OpenStack Security Advisory |
Won't Fix
|
Undecided
|
Unassigned |
Bug Description
Keystone has a sample policy file to create a concept of domains per customer, with a domain admin that manages users and tenants inside that domain.
https:/
In this policy, the domain admin role (a user who manages that domain) would get the "admin" role assigned to them. However, with the "admin" role assigned to them, they can make requests to the admin_api (in this case, the Nova example).
https:/
I have done a fair bit of checking but I believe that a domain admin can get full access to the admin_api (or be able to create a user with an "admin" role and get access to the entire cloud). I believe this affects all other projects and users of this policy would not be aware at the level of access given to a domain admin.
Perhaps the file can be revised to use a role like "domain_admin" and Keystone would have a setting of "reserved role names" which cannot be used (e.g. block the role "admin" from being created in a domain).
Please forgive me in advance if this is not a security issue and a lack of understanding (I hope it is), but I have done a fair amount of research on this so far and it seems like getting access to that `admin` role is an issue.
Since this report concerns a possible security risk, an incomplete security advisory task has been added while the core security reviewers for the affected project or projects confirm the bug and discuss the scope of any vulnerability along with potential solutions.