Non admin users can modify config in Contrail UI

[Abhishek Chanda]

1) log into Contrail UI as any tenant that does not have admin privilages
2) User can edit/change BGP peers and other settings

[Abhishek Chanda (abhishek-i)]

Any thoughts on this?

[Pedro Marques (5-roque)]

We need to flip the defaults such that multi tenancy is always on unless explicitly disabled.
If request authentication is off then neither the contrail api server or contrail web-ui can be exposed to anyone other than an admin user.

Assuming multi-tenancy is enabled we need to verify that system objects are owned by an admin user and not modifiable.

[Pedro Marques (5-roque)]

The following commit should address this concern:
https://review.opencontrail.org/#/c/3468/