This commit removes user policies from policy.v3cloudsample.json. By
incorporating system-scope, domain-scope, project-scope, and default
roles, we've effectively made these policies obsolete. We can simplify
what we maintain and provide a more consistent, unified view of
default user behavior by removing them.
This commit also adds an important filter to the GET /v3/users API by
making sure the users in the response are filtered properly if the API
was called with a domain-scoped token. This is needed in case domain
configuration isn't setup and short-circuits normalization of the
domain ID, which sometimes comes from the token if it is
domain-scoped. Regardless of domain configuration being used, we
should protect against cases where data leaks across domains in the
name of security.
Finally, this commit moves a couple of tests from test_v3_protection
to test_users protection tests that ensures we do reasonable filtering
while normalizing domain IDs. The remaining tests from
test_v3_protection have been removed because they are no longer
applicable. These tests were testing an HTTP 403 was returned when a
domain users attempted to filter users for domains they didn't have
authorization on. We don't use this approach consistently in keystone.
Most other places where filtering is implemented, we ignore invalid
filters and instead return an empty list. For domain users attempting
to fish information out of another domain, they will receive an empty
list to be consistent with other parts of the API.
Reviewed: https:/ /review. openstack. org/623323 /git.openstack. org/cgit/ openstack/ keystone/ commit/ ?id=d2cc4c83c00 256440eed0ed5b8 d7131cc02d72d4
Committed: https:/
Submitter: Zuul
Branch: master
commit d2cc4c83c002564 40eed0ed5b8d713 1cc02d72d4
Author: Lance Bragstad <email address hidden>
Date: Thu Dec 6 21:14:44 2018 +0000
Consolidate user protection tests
This commit removes user policies from policy. v3cloudsample. json. By
incorporating system-scope, domain-scope, project-scope, and default
roles, we've effectively made these policies obsolete. We can simplify
what we maintain and provide a more consistent, unified view of
default user behavior by removing them.
This commit also adds an important filter to the GET /v3/users API by
making sure the users in the response are filtered properly if the API
was called with a domain-scoped token. This is needed in case domain
configuration isn't setup and short-circuits normalization of the
domain ID, which sometimes comes from the token if it is
domain-scoped. Regardless of domain configuration being used, we
should protect against cases where data leaks across domains in the
name of security.
Finally, this commit moves a couple of tests from test_v3_protection v3_protection have been removed because they are no longer
to test_users protection tests that ensures we do reasonable filtering
while normalizing domain IDs. The remaining tests from
test_
applicable. These tests were testing an HTTP 403 was returned when a
domain users attempted to filter users for domains they didn't have
authorization on. We don't use this approach consistently in keystone.
Most other places where filtering is implemented, we ignore invalid
filters and instead return an empty list. For domain users attempting
to fish information out of another domain, they will receive an empty
list to be consistent with other parts of the API.
Change-Id: I60b2e2b8af172c 369eab0eb2c29f0 56f5c98ad16
Parial-Bug: 1806762