_add_tenant_access silently ignores 403

[Surya Seetharaman]

Running openstack flavor set from a project in which a user has an admin role (but the project is not an admin project) allows the provided project to be mapped to the flavor even if the permissions are insufficient for the user to verify the project provided i.e the generated 403 is ignored by nova silently at this point in code: https://github.com/openstack/nova/blob/d621914442855ce67ce0b99003f7e69e8ee515e6/nova/api/openstack/identity.py#L61. This can in turn allow random projects to be mapped to flavors.

[Matt Riedemann (mriedem)]

Doesn't this just mean the keystone service user auth configured in nova doesn't have enough permissions to know if the given project exists?

https://docs.openstack.org/nova/latest/configuration/config.html#keystone

So can't you do something about the configurable service user auth / permissions so nova *can* determine if he project exists?

[Matt Riedemann (mriedem)]

IRC discussion related to this bug:

http://eavesdrop.openstack.org/irclogs/%23openstack-nova/%23openstack-nova.2019-11-26.log.html#t2019-11-26T16:20:24

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/735068