Merge "Update system grant policies for system reader"

2019-03-22 04:58:03 +00:00 · 2019-03-22 04:58:03 +00:00 · 5f966b28a5
parent 52453880ef 465a8bb59b
commit 5f966b28a5
2 changed files with 151 additions and 4 deletions
--- a/keystone/common/policies/grant.py
+++ b/keystone/common/policies/grant.py
@ -10,10 +10,27 @@
 # License for the specific language governing permissions and limitations
 # under the License.

+from oslo_log import versionutils
 from oslo_policy import policy

 from keystone.common.policies import base

+deprecated_check_system_grant_for_user = policy.DeprecatedRule(
+    name=base.IDENTITY % 'check_system_grant_for_user',
+    check_str=base.RULE_ADMIN_REQUIRED
+)
+deprecated_list_system_grants_for_user = policy.DeprecatedRule(
+    name=base.IDENTITY % 'list_system_grants_for_user',
+    check_str=base.RULE_ADMIN_REQUIRED
+)
+
+DEPRECATED_REASON = """
+As of the Stein release, the system assignment API now understands default
+roles and system-scoped tokens, making the API more granular by default without
+compromising security. The new policy defaults account for these changes
+automatically. Be sure to take these new defaults into consideration if you are
+relying on overrides in your deployment for the system assignment API.
+"""

 resource_paths = [
    '/projects/{project_id}/users/{user_id}/roles/{role_id}',
@ -116,7 +133,7 @@ grant_policies = [
        operations=list_operations(resource_paths, ['DELETE'])),
    policy.DocumentedRuleDefault(
        name=base.IDENTITY % 'list_system_grants_for_user',
-        check_str=base.RULE_ADMIN_REQUIRED,
+        check_str=base.SYSTEM_READER,
        scope_types=['system'],
        description='List all grants a specific user has on the system.',
        operations=[
@ -124,11 +141,14 @@ grant_policies = [
                'path': '/v3/system/users/{user_id}/roles',
                'method': ['HEAD', 'GET']
            }
-        ]
+        ],
+        deprecated_rule=deprecated_list_system_grants_for_user,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
    ),
    policy.DocumentedRuleDefault(
        name=base.IDENTITY % 'check_system_grant_for_user',
-        check_str=base.RULE_ADMIN_REQUIRED,
+        check_str=base.SYSTEM_READER,
        scope_types=['system'],
        description='Check if a user has a role on the system.',
        operations=[
@ -136,7 +156,10 @@ grant_policies = [
                'path': '/v3/system/users/{user_id}/roles/{role_id}',
                'method': ['HEAD', 'GET']
            }
-        ]
+        ],
+        deprecated_rule=deprecated_check_system_grant_for_user,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
    ),
    policy.DocumentedRuleDefault(
        name=base.IDENTITY % 'create_system_grant_for_user',
--- a/keystone/tests/unit/protection/v3/test_system_assignments.py
+++ b/keystone/tests/unit/protection/v3/test_system_assignments.py
@ -0,0 +1,124 @@
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from six.moves import http_client
+
+from keystone.common import provider_api
+import keystone.conf
+from keystone.tests.common import auth as common_auth
+from keystone.tests import unit
+from keystone.tests.unit import base_classes
+from keystone.tests.unit import ksfixtures
+
+CONF = keystone.conf.CONF
+PROVIDERS = provider_api.ProviderAPIs
+
+
+class _SystemUserSystemAssignmentTests(object):
+
+    def test_user_can_list_user_system_role_assignments(self):
+        user = PROVIDERS.identity_api.create_user(
+            unit.new_user_ref(CONF.identity.default_domain_id)
+        )
+
+        PROVIDERS.assignment_api.create_system_grant_for_user(
+            user['id'], self.bootstrapper.member_role_id
+        )
+
+        with self.test_client() as c:
+            r = c.get(
+                '/v3/system/users/%s/roles' % user['id'], headers=self.headers
+            )
+            self.assertEqual(1, len(r.json['roles']))
+            self.assertEqual(
+                self.bootstrapper.member_role_id, r.json['roles'][0]['id']
+            )
+
+    def test_user_can_check_user_system_role_assignment(self):
+        user = PROVIDERS.identity_api.create_user(
+            unit.new_user_ref(CONF.identity.default_domain_id)
+        )
+
+        PROVIDERS.assignment_api.create_system_grant_for_user(
+            user['id'], self.bootstrapper.member_role_id
+        )
+
+        with self.test_client() as c:
+            c.get(
+                '/v3/system/users/%s/roles/%s' % (
+                    user['id'], self.bootstrapper.member_role_id
+                ), headers=self.headers,
+                expected_status_code=http_client.NO_CONTENT
+            )
+
+
+class SystemReaderTests(base_classes.TestCaseWithBootstrap,
+                        common_auth.AuthTestMixin,
+                        _SystemUserSystemAssignmentTests):
+
+    def setUp(self):
+        super(SystemReaderTests, self).setUp()
+        self.loadapp()
+        self.useFixture(ksfixtures.Policy(self.config_fixture))
+        self.config_fixture.config(group='oslo_policy', enforce_scope=True)
+
+        system_reader = unit.new_user_ref(
+            domain_id=CONF.identity.default_domain_id
+        )
+        self.user_id = PROVIDERS.identity_api.create_user(
+            system_reader
+        )['id']
+        PROVIDERS.assignment_api.create_system_grant_for_user(
+            self.user_id, self.bootstrapper.reader_role_id
+        )
+
+        auth = self.build_authentication_request(
+            user_id=self.user_id, password=system_reader['password'],
+            system=True
+        )
+
+        # Grab a token using the persona we're testing and prepare headers
+        # for requests we'll be making in the tests.
+        with self.test_client() as c:
+            r = c.post('/v3/auth/tokens', json=auth)
+            self.token_id = r.headers['X-Subject-Token']
+            self.headers = {'X-Auth-Token': self.token_id}
+
+    def test_user_cannot_grant_system_assignments(self):
+        user = PROVIDERS.identity_api.create_user(
+            unit.new_user_ref(CONF.identity.default_domain_id)
+        )
+
+        with self.test_client() as c:
+            c.put(
+                '/v3/system/users/%s/roles/%s' % (
+                    user['id'], self.bootstrapper.member_role_id
+                ), headers=self.headers,
+                expected_status_code=http_client.FORBIDDEN
+            )
+
+    def test_user_cannot_revoke_system_assignments(self):
+        user = PROVIDERS.identity_api.create_user(
+            unit.new_user_ref(CONF.identity.default_domain_id)
+        )
+
+        PROVIDERS.assignment_api.create_system_grant_for_user(
+            user['id'], self.bootstrapper.member_role_id
+        )
+
+        with self.test_client() as c:
+            c.delete(
+                '/v3/system/users/%s/roles/%s' % (
+                    user['id'], self.bootstrapper.member_role_id
+                ), headers=self.headers,
+                expected_status_code=http_client.FORBIDDEN
+            )