Attempting a RoleCheck when the credentials do not contain a roles list causes an exception

[Timothy Symanczyk]

How to reproduce this bug using keystone :

1) Retrieve an unscoped token for any valid account.

2) Using curl - invoke list_user_projects for the SAME user from step 1 using the token from step 1, and observe that this works as expected.

3) Alter the in-use policy file by inserting "role:service or " at the beginning of the rule for list_user_projects ...
< "identity:list_user_projects": "role:service or rule:admin_or_owner",
---
> "identity:list_user_projects": "rule:admin_or_owner",
.... Note that the addition of this 'or' clause should not be able to logically cause any additional denials.

4) Try the identical curl command from step 2 again, and observe that it now fails with 403 Forbidden.

[Timothy Symanczyk (timothy-symanczyk)]

My proposed fix https://review.openstack.org/#/c/262329/2

Includes a new unit test that will crash without the fix.

[Davanum Srinivas (DIMS) (dims-v)]

This issue was fixed in the openstack/oslo.policy 1.3.0 release.