| 2018-07-26 00:55:40 |
Eric Miller |
bug |
|
|
added bug |
| 2018-07-26 01:29:26 |
Jeremy Stanley |
bug task added |
|
ossa |
|
| 2018-07-26 01:29:35 |
Jeremy Stanley |
ossa: status |
New |
Incomplete |
|
| 2018-07-26 01:29:57 |
Jeremy Stanley |
bug |
|
|
added subscriber Keystone Core security contacts |
| 2018-07-26 01:30:28 |
Jeremy Stanley |
description |
Environment
Deployed using Kolla-ansible version 7.0.0.0b2 in VMs on ESXi 5.5 (same problem occurs on Queens release)
3 controllers and various other VMs for other roles (22 in total)
Parameters:
Default policy.json configuration - no override files, such as policy.v3cloudsample.json, however using this policy file on the Keystone nodes makes no difference, after changing the "admin_domain_id" to "default".
Commands run:
(export variables set for admin user)
domain create TestDomain
project create --domain TestDomain TestDomainProject
user create --domain TestDomain --password test TestDomainAdmin
role add --project-domain TestDomain --project TestDomainProject --user TestDomainAdmin admin
(export variables set to TestDomainAdmin user's domain and project - openstack client run again)
(openstack) domain list
+----------------------------------+------------------+---------+-------------------------------------------+
| ID | Name | Enabled | Description |
+----------------------------------+------------------+---------+-------------------------------------------+
| 7a44fa16d42443c1b531af2447d7cd3f | TestDomain | True | |
| c4ce448b93a949b78a8feea567f210b4 | heat_user_domain | True | |
| default | Default | True | The default domain |
| e082d7aefb314041b89bb3311836d721 | magnum | True | Owns users and projects created by magnum |
+----------------------------------+------------------+---------+-------------------------------------------+
(openstack) project list
+----------------------------------+-------------------+
| ID | Name |
+----------------------------------+-------------------+
| 371b28700a06462b8fd52fa95e733a0a | admin |
| 3a526ae9a3874ab4a645cc24ad7beff2 | TestDomainProject |
| 5abb3ac26dae4d25830b43afd62b74ff | service |
+----------------------------------+-------------------+
Issue:
Horizon interface properly shows only the TestDomainProject project and no Domains tab, which is correct. The API that the openstack client uses is returning root-level information as shown above, such as other domain's projects as well as every domain.
Am I missing something, or is this a bug?
Thanks!
Eric |
This issue is being treated as a potential security risk under embargo. Please do not make any public mention of embargoed (private) security vulnerabilities before their coordinated publication by the OpenStack Vulnerability Management Team in the form of an official OpenStack Security Advisory. This includes discussion of the bug or associated fixes in public forums such as mailing lists, code review systems and bug trackers. Please also avoid private disclosure to other individuals not already approved for access to this information, and provide this same reminder to those who are made aware of the issue prior to publication. All discussion should remain confined to this private bug report, and any proposed fixes should be added to the bug as attachments.
Environment
Deployed using Kolla-ansible version 7.0.0.0b2 in VMs on ESXi 5.5 (same problem occurs on Queens release)
3 controllers and various other VMs for other roles (22 in total)
Parameters:
Default policy.json configuration - no override files, such as policy.v3cloudsample.json, however using this policy file on the Keystone nodes makes no difference, after changing the "admin_domain_id" to "default".
Commands run:
(export variables set for admin user)
domain create TestDomain
project create --domain TestDomain TestDomainProject
user create --domain TestDomain --password test TestDomainAdmin
role add --project-domain TestDomain --project TestDomainProject --user TestDomainAdmin admin
(export variables set to TestDomainAdmin user's domain and project - openstack client run again)
(openstack) domain list
+----------------------------------+------------------+---------+-------------------------------------------+
| ID | Name | Enabled | Description |
+----------------------------------+------------------+---------+-------------------------------------------+
| 7a44fa16d42443c1b531af2447d7cd3f | TestDomain | True | |
| c4ce448b93a949b78a8feea567f210b4 | heat_user_domain | True | |
| default | Default | True | The default domain |
| e082d7aefb314041b89bb3311836d721 | magnum | True | Owns users and projects created by magnum |
+----------------------------------+------------------+---------+-------------------------------------------+
(openstack) project list
+----------------------------------+-------------------+
| ID | Name |
+----------------------------------+-------------------+
| 371b28700a06462b8fd52fa95e733a0a | admin |
| 3a526ae9a3874ab4a645cc24ad7beff2 | TestDomainProject |
| 5abb3ac26dae4d25830b43afd62b74ff | service |
+----------------------------------+-------------------+
Issue:
Horizon interface properly shows only the TestDomainProject project and no Domains tab, which is correct. The API that the openstack client uses is returning root-level information as shown above, such as other domain's projects as well as every domain.
Am I missing something, or is this a bug?
Thanks!
Eric |
|
| 2018-07-26 20:32:38 |
Jeremy Stanley |
ossa: status |
Incomplete |
Won't Fix |
|
| 2018-07-26 20:32:53 |
Jeremy Stanley |
description |
This issue is being treated as a potential security risk under embargo. Please do not make any public mention of embargoed (private) security vulnerabilities before their coordinated publication by the OpenStack Vulnerability Management Team in the form of an official OpenStack Security Advisory. This includes discussion of the bug or associated fixes in public forums such as mailing lists, code review systems and bug trackers. Please also avoid private disclosure to other individuals not already approved for access to this information, and provide this same reminder to those who are made aware of the issue prior to publication. All discussion should remain confined to this private bug report, and any proposed fixes should be added to the bug as attachments.
Environment
Deployed using Kolla-ansible version 7.0.0.0b2 in VMs on ESXi 5.5 (same problem occurs on Queens release)
3 controllers and various other VMs for other roles (22 in total)
Parameters:
Default policy.json configuration - no override files, such as policy.v3cloudsample.json, however using this policy file on the Keystone nodes makes no difference, after changing the "admin_domain_id" to "default".
Commands run:
(export variables set for admin user)
domain create TestDomain
project create --domain TestDomain TestDomainProject
user create --domain TestDomain --password test TestDomainAdmin
role add --project-domain TestDomain --project TestDomainProject --user TestDomainAdmin admin
(export variables set to TestDomainAdmin user's domain and project - openstack client run again)
(openstack) domain list
+----------------------------------+------------------+---------+-------------------------------------------+
| ID | Name | Enabled | Description |
+----------------------------------+------------------+---------+-------------------------------------------+
| 7a44fa16d42443c1b531af2447d7cd3f | TestDomain | True | |
| c4ce448b93a949b78a8feea567f210b4 | heat_user_domain | True | |
| default | Default | True | The default domain |
| e082d7aefb314041b89bb3311836d721 | magnum | True | Owns users and projects created by magnum |
+----------------------------------+------------------+---------+-------------------------------------------+
(openstack) project list
+----------------------------------+-------------------+
| ID | Name |
+----------------------------------+-------------------+
| 371b28700a06462b8fd52fa95e733a0a | admin |
| 3a526ae9a3874ab4a645cc24ad7beff2 | TestDomainProject |
| 5abb3ac26dae4d25830b43afd62b74ff | service |
+----------------------------------+-------------------+
Issue:
Horizon interface properly shows only the TestDomainProject project and no Domains tab, which is correct. The API that the openstack client uses is returning root-level information as shown above, such as other domain's projects as well as every domain.
Am I missing something, or is this a bug?
Thanks!
Eric |
Environment
Deployed using Kolla-ansible version 7.0.0.0b2 in VMs on ESXi 5.5 (same problem occurs on Queens release)
3 controllers and various other VMs for other roles (22 in total)
Parameters:
Default policy.json configuration - no override files, such as policy.v3cloudsample.json, however using this policy file on the Keystone nodes makes no difference, after changing the "admin_domain_id" to "default".
Commands run:
(export variables set for admin user)
domain create TestDomain
project create --domain TestDomain TestDomainProject
user create --domain TestDomain --password test TestDomainAdmin
role add --project-domain TestDomain --project TestDomainProject --user TestDomainAdmin admin
(export variables set to TestDomainAdmin user's domain and project - openstack client run again)
(openstack) domain list
+----------------------------------+------------------+---------+-------------------------------------------+
| ID | Name | Enabled | Description |
+----------------------------------+------------------+---------+-------------------------------------------+
| 7a44fa16d42443c1b531af2447d7cd3f | TestDomain | True | |
| c4ce448b93a949b78a8feea567f210b4 | heat_user_domain | True | |
| default | Default | True | The default domain |
| e082d7aefb314041b89bb3311836d721 | magnum | True | Owns users and projects created by magnum |
+----------------------------------+------------------+---------+-------------------------------------------+
(openstack) project list
+----------------------------------+-------------------+
| ID | Name |
+----------------------------------+-------------------+
| 371b28700a06462b8fd52fa95e733a0a | admin |
| 3a526ae9a3874ab4a645cc24ad7beff2 | TestDomainProject |
| 5abb3ac26dae4d25830b43afd62b74ff | service |
+----------------------------------+-------------------+
Issue:
Horizon interface properly shows only the TestDomainProject project and no Domains tab, which is correct. The API that the openstack client uses is returning root-level information as shown above, such as other domain's projects as well as every domain.
Am I missing something, or is this a bug?
Thanks!
Eric |
|
| 2018-07-26 20:35:04 |
Jeremy Stanley |
information type |
Private Security |
Public |
|
| 2018-07-26 20:35:32 |
Jeremy Stanley |
marked as duplicate |
|
968696 |
|
