Cannot list project role assignments as domain admin

[Boris Bobrov]

As domain admin, i would like to list role assignments on projects of my domain. The default v3 policies are:

"admin_on_domain_filter": "rule:admin_required and domain_id:%(scope.domain.id)s",
"admin_on_project_filter": "rule:admin_required and project_id:%(scope.project.id)s",
"identity:list_role_assignments": "rule:cloud_admin or rule:admin_on_domain_filter or rule:admin_on_project_filter",

I expected that adding a new rule like

"admin_on_project_domain_filter": "rule:admin_required and project_id:%(scope.project.domain.id)s",

would work, but it did not.

I ran into this bug on Newton, but according to the code it seems to be present in Rocky. I am not sure about current master.

The attached patch is how i fixed it for Newton.

[Lance Bragstad (lbragstad)]

Hey Boris!

Thanks for the bug report. I think this might actually be a duplicate of bug 1750673. Looks like there is a fix in flight that isn't specific to domain users, too.