Neutron custom policy.json no longer working after Icehouse upgrade

[Robert van Leeuwen]

We have some custom policy rules implemented to have a shared network that only people member of a specific group could see.

Basically a few rules like this:

"shared": "field:networks:shared=True and not field:networks:name=mil",
"mil": "field:networks:name=mil and role:network_mil",
"subnets:mil:read": "rule:regular_user",
"subnets:mil:write": "rule:admin_only",
"get_subnet": "rule:admin_or_owner or rule:shared or rule:mil or rule:pub",
"get_network": "rule:admin_or_owner or rule:shared or rule:external or rule:mil or rule:pub",
"create_network:mil": "rule:admin_only",

This no longer seem to work after a havana -> icehouse upgrade.
Everyone sees these networks now.

[Salvatore Orlando (salvatore-orlando)]

I'm going to triage this bug.
To be more precise, what's the issue observed here?

When you say everyone sees this networks, do you mean "mil" networks or the networks which should be shown as because of "rule:pub"?
Please note that in your snippet you did not put what rule:pub is.

[Robert van Leeuwen (rovanleeuwen)]

The "mil" is a shared network but we only want people to see them when the are member of the role network_mil:
By default everyone sees ALL shared networks.

To prevent everyone to see all networks changed this:
"shared": "field:networks:shared=True",
To this:
"shared": "field:networks:shared=True and not field:networks:name=mil",

This used to work but no longer in Icehouse.

(The other lines in the example are just there to make it visible for users who are member of the group "network_mil")

[Robert van Leeuwen (rovanleeuwen)]

Never mind
This issue was caused by a improper setting of the auth_strategy in the neutron.conf.