openstack
/
keystone
Code Issues Proposed changes

Add support for functional RBAC tests 

Add support to the keystone devstack plugin for setting enforce_scope in
the keystone config and setting up tempest to test it.

It may be better to move this to tempest proper at some point.

See also: https://review.opendev.org/686073 https://review.opendev.org/698397

Change-Id: I1b71135547b7ce03afb5b44fbbab3f52d213a2ae
This commit is contained in:
Colleen Murphy 2019-12-13 15:48:43 -08:00
parent 07d187eb46
commit 5d7c92e204
2 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
devstack/lib/scope.sh Normal file
View File

@ -0,0 +1,26 @@
# Copyright 2019 SUSE LLC
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
function configure_enforce_scope {
iniset $KEYSTONE_CONF oslo_policy enforce_scope true
iniset $KEYSTONE_CONF oslo_policy policy_file policy.yaml
sudo systemctl restart devstack@keystone
oslopolicy-policy-generator --namespace keystone > /etc/keystone/policy.yaml
}
function configure_protection_tests {
iniset $TEMPEST_CONFIG identity-feature-enabled enforce_scope true
iniset $TEMPEST_CONFIG auth admin_system true
iniset $TEMPEST_CONFIG auth admin_project_name ''
}

7
devstack/plugin.sh
View File

@ -15,6 +15,7 @@
KEYSTONE_PLUGIN=$DEST/keystone/devstack
source $KEYSTONE_PLUGIN/lib/federation.sh
source $KEYSTONE_PLUGIN/lib/scope.sh
# For more information on Devstack plugins, including a more detailed
# explanation on when the different steps are executed please see:
@ -47,6 +48,12 @@ elif [[ "$1" == "stack" && "$2" == "test-config" ]]; then
if is_service_enabled keystone-saml2-federation; then
configure_tests_settings
fi
if [[ "$(trueorfalse False KEYSTONE_ENFORCE_SCOPE)" == "True" ]] ; then
# devstack and tempest assume enforce_scope is false, so need to wait
# until the final phase to turn it on
configure_enforce_scope
configure_protection_tests
fi
fi
if [[ "$1" == "unstack" ]]; then