Remove obsolete service provider policies from policy.v3cloudsample.json

[Lance Bragstad]

Once support for scope types landed in the service provider API policies, the policies in policy.v3cloudsample.json became obsolete [0][1].

We should add formal protection for the policies with enforce_scope = True in keystone.tests.unit.protection.v3 and remove the old policies from the v3 sample policy file.

This will reduce confusion by having a true default policy for identity providers.

[0] https://review.openstack.org/#/c/526173/
[1] https://git.openstack.org/cgit/openstack/keystone/tree/etc/policy.v3cloudsample.json?id=fb73912d87b61c419a86c0a9415ebdcf1e186927#n216

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/620156

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/620157

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/620158

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/620159

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/620160

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/620161

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/620156
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=acd5d027ecc3d5b8819b0f5772ce114cdbd7a680
Submitter: Zuul
Branch: master

commit acd5d027ecc3d5b8819b0f5772ce114cdbd7a680
Author: Lance Bragstad <email address hidden>
Date: Mon Nov 26 19:46:30 2018 +0000

    Update service provider policies for system reader

    The service provider policies were not taking the default roles work
    we did last release into account. This commit changes the default
    policies to rely on the ``reader`` role for get and list service
    providers. Subsequent patches will incorporate:

     - system member test coverage
     - system admin functionality
     - domain users test coverage
     - project users test coverage

     Related-Bug: 1804520
     Related-Bug: 1804522

    Change-Id: I54fde6f6395b55a0798157346af3188bc756ba50

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/620157
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=e22bafa25bced833115530401ef878f5e1d1c7eb
Submitter: Zuul
Branch: master

commit e22bafa25bced833115530401ef878f5e1d1c7eb
Author: Lance Bragstad <email address hidden>
Date: Mon Nov 26 20:29:00 2018 +0000

    Add service provider tests for system member role

    From keystone's perspective, the ``member`` and ``reader`` roles are
    effectively the same, isolating writable service provider operations
    to the ``admin`` role.

    This commit adds explicit testing to make sure the ``member`` role is
    allowed to perform readable and not writable service provider
    operations. Subsequent patches will incorporate.

     - system admin functionality
     - domain users test coverage
     - project users test coverage

     Related-Bug: 1804520
     Related-Bug: 1804522

    Change-Id: Iecc39d5e4f1a4dc9293e67ee86f23f9a119793a8

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/620158
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=7ce5e3e24e8291c0af387a72ce7b47c3b28a9f74
Submitter: Zuul
Branch: master

commit 7ce5e3e24e8291c0af387a72ce7b47c3b28a9f74
Author: Lance Bragstad <email address hidden>
Date: Mon Nov 26 20:43:09 2018 +0000

    Update service provider policies for system admin

    This change makes the policy definitions for admin service
    provider operations consistent with the other service provider
    policies. Subsequent patches will incorporate:

     - domain users test coverage
     - project users test coverage

    Change-Id: I621192f089d1b29e2585d0030716348274e50bf1
    Related-Bug: 1804520
    Closes-Bug: 1804522

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/620159
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=fba96a26ac80fab86671d47ff7eaf11427ed4af0
Submitter: Zuul
Branch: master

commit fba96a26ac80fab86671d47ff7eaf11427ed4af0
Author: Lance Bragstad <email address hidden>
Date: Mon Nov 26 20:50:40 2018 +0000

    Add tests for domain users interacting with sps

    This commit introduces some tests that show how domain users are
    expected to behave with the federated service provider API. A
    subsequent patch will do the same for project users.

    Change-Id: I27f7550d4f05494d19cbbf67e2e1a7fdfc19b21a
    Related-Bug: 1804520

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/620160
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=92ac35fe6bca328f3b92153ff560490947291d9e
Submitter: Zuul
Branch: master

commit 92ac35fe6bca328f3b92153ff560490947291d9e
Author: Lance Bragstad <email address hidden>
Date: Mon Nov 26 20:52:53 2018 +0000

    Add tests for project users interacting with sps

    This commit introduces some tests that show how project users
    are expected to behave with the federated service provider API.
    A subsequent patch will clean up the now obsolete policies in the
    policy.v3cloudsample.json file.

    Change-Id: I799fedbb250614fef7ce0a55bd4ac266475ad3a1
    Related-Bug: 1804520

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/620161
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=6bac9930ebd0f5882247879c3d9b04b732ba6fb4
Submitter: Zuul
Branch: master

commit 6bac9930ebd0f5882247879c3d9b04b732ba6fb4
Author: Lance Bragstad <email address hidden>
Date: Mon Nov 26 20:57:53 2018 +0000

    Remove service provider policies from v3cloudsample.json

    By incorporating system-scope and default roles, we've effectively
    made these policies obsolete. We can simplify what we maintain and
    provide a more consistent, unified view of default service provider
    behavior by removing them.

    Change-Id: I01b0e7152ae282c49644b3bad1bcb2c8119aed58
    Closes-Bug: 1804520

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/keystone 15.0.0.0rc1 release candidate.