openstack
/
openstack
Code Issues Proposed changes

Update git submodules 

* Update charm-neutron-api from branch 'master'
  - Ensure that only cloud admins are neutron admins
    
    When determining if a user is an admin the default neutron policy
    file only checks if a user has the 'admin'  role. It does not check
    what that role is applied to.
    
    The problem is illustrated by the following scenario: A cloud
    admin creates a new domain, then creates a new project within that
    domain. The cloud admin wants to delegate the maintenance of the
    new project to userA so she grants them admin on the new project.
    UserA is now a cloud admin from Neutrons pov.
    
    To fix this issue a policy override file is added which checks that
    the user is admin either against the admin project (as defined by
    keystone) or the service project.
    
    Change-Id: If4c5b0c1ab7bf2c75e911e77531d442d417a1231
    Closes-Bug: 1830536
This commit is contained in:
Liam Young 2019-07-19 13:00:59 +00:00 committed by Gerrit Code Review
parent 0bf497be73
commit a65036a25d
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
charm-neutron-api

@ -1 +1 @@
Subproject commit 00682670954dda49f1e3d8d2305d2126a88c43a4
Subproject commit e03501dee1a43fd264780966e7831c96c0279232