Identity: Add support for inherited_to for role_assignments
Change-Id: I977fba4a49d8bd779fc14851ab4145cebb66d46c
This commit is contained in:
ArtofBugs
ArtofBugs
parent
6dbc7e9e94
commit
3e4dde7559
|
|
@ -10,10 +10,13 @@
|
|||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
import warnings
|
||||
|
||||
from openstack.cloud import _utils
|
||||
from openstack import exceptions
|
||||
from openstack.identity.v3._proxy import Proxy
|
||||
from openstack import utils
|
||||
from openstack import warnings as os_warnings
|
||||
|
||||
|
||||
class IdentityCloudMixin:
|
||||
|
|
@ -1119,7 +1122,14 @@ class IdentityCloudMixin:
|
|||
# proxy
|
||||
filters['scope.' + k + '.id'] = filters[k]
|
||||
del filters[k]
|
||||
if 'os_inherit_extension_inherited_to' in filters:
|
||||
if 'inherited_to' in filters:
|
||||
filters['scope.OS-INHERIT:inherited_to'] = filters['inherited_to']
|
||||
del filters['inherited_to']
|
||||
elif 'os_inherit_extension_inherited_to' in filters:
|
||||
warnings.warn(
|
||||
"os_inherit_extension_inherited_to is deprecated. Use inherited_to instead.",
|
||||
os_warnings.OpenStackDeprecationWarning,
|
||||
)
|
||||
filters['scope.OS-INHERIT:inherited_to'] = filters[
|
||||
'os_inherit_extension_inherited_to'
|
||||
]
|
||||
|
|
@ -1138,15 +1148,16 @@ class IdentityCloudMixin:
|
|||
* 'domain' (string) - Domain ID to be used as query filter.
|
||||
* 'system' (string) - System name to be used as query filter.
|
||||
* 'role' (string) - Role ID to be used as query filter.
|
||||
* 'os_inherit_extension_inherited_to' (string) - Return inherited
|
||||
role assignments for either 'projects' or 'domains'
|
||||
* 'inherited_to' (string) - Return inherited
|
||||
role assignments for either 'projects' or 'domains'.
|
||||
* 'os_inherit_extension_inherited_to' (string) - Deprecated; use 'inherited_to' instead.
|
||||
* 'effective' (boolean) - Return effective role assignments.
|
||||
* 'include_subtree' (boolean) - Include subtree
|
||||
|
||||
'user' and 'group' are mutually exclusive, as are 'domain' and
|
||||
'project'.
|
||||
|
||||
:returns: A list of indentity
|
||||
:returns: A list of identity
|
||||
:class:`openstack.identity.v3.role_assignment.RoleAssignment`
|
||||
objects
|
||||
:raises: :class:`~openstack.exceptions.SDKException` if something goes
|
||||
|
|
@ -1182,6 +1193,15 @@ class IdentityCloudMixin:
|
|||
system_scope = filters.pop('system')
|
||||
filters['scope.system'] = system_scope
|
||||
|
||||
if 'os_inherit_extension_inherited_to' in filters:
|
||||
warnings.warn(
|
||||
"os_inherit_extension_inherited_to is deprecated. Use inherited_to instead.",
|
||||
os_warnings.OpenStackDeprecationWarning,
|
||||
)
|
||||
filters['inherited_to'] = filters.pop(
|
||||
'os_inherit_extension_inherited_to'
|
||||
)
|
||||
|
||||
return list(self.identity.role_assignments(**filters))
|
||||
|
||||
@_utils.valid_kwargs('domain_id')
|
||||
|
|
|
|||
|
|
@ -1225,7 +1225,7 @@ class Proxy(proxy.Proxy):
|
|||
:param kwargs query: Optional query parameters to be sent to limit
|
||||
the resources being returned. The options
|
||||
are: group_id, role_id, scope_domain_id,
|
||||
scope_project_id, user_id, include_names,
|
||||
scope_project_id, inherited_to, user_id, include_names,
|
||||
include_subtree.
|
||||
:return:
|
||||
:class:`~openstack.identity.v3.role_assignment.RoleAssignment`
|
||||
|
|
|
|||
|
|
@ -28,6 +28,7 @@ class RoleAssignment(resource.Resource):
|
|||
'scope_project_id',
|
||||
'user_id',
|
||||
'effective',
|
||||
'inherited_to',
|
||||
'include_names',
|
||||
'include_subtree',
|
||||
role_id='role.id',
|
||||
|
|
@ -36,6 +37,7 @@ class RoleAssignment(resource.Resource):
|
|||
scope_project_id='scope.project.id',
|
||||
scope_domain_id='scope.domain.id',
|
||||
scope_system='scope.system',
|
||||
inherited_to='scope.OS-INHERIT:inherited_to',
|
||||
)
|
||||
|
||||
# Properties
|
||||
|
|
@ -43,7 +45,7 @@ class RoleAssignment(resource.Resource):
|
|||
links = resource.Body('links')
|
||||
#: The role (dictionary contains only id) *Type: dict*
|
||||
role = resource.Body('role', type=dict)
|
||||
#: The scope (either domain or group dictionary contains id) *Type: dict*
|
||||
#: The scope (either domain or project; dictionary contains only id) *Type: dict*
|
||||
scope = resource.Body('scope', type=dict)
|
||||
#: The user (dictionary contains only id) *Type: dict*
|
||||
user = resource.Body('user', type=dict)
|
||||
|
|
|
|||
|
|
@ -32,6 +32,24 @@ class TestRoleAssignment(base.TestCase):
|
|||
self.assertEqual('/role_assignments', sot.base_path)
|
||||
self.assertTrue(sot.allow_list)
|
||||
|
||||
self.assertDictEqual(
|
||||
{
|
||||
'group_id': 'group.id',
|
||||
'role_id': 'role.id',
|
||||
'scope_domain_id': 'scope.domain.id',
|
||||
'scope_project_id': 'scope.project.id',
|
||||
'scope_system': 'scope.system',
|
||||
'user_id': 'user.id',
|
||||
'effective': 'effective',
|
||||
'inherited_to': 'scope.OS-INHERIT:inherited_to',
|
||||
'include_names': 'include_names',
|
||||
'include_subtree': 'include_subtree',
|
||||
'limit': 'limit',
|
||||
'marker': 'marker',
|
||||
},
|
||||
sot._query_mapping._mapping,
|
||||
)
|
||||
|
||||
def test_make_it(self):
|
||||
sot = role_assignment.RoleAssignment(**EXAMPLE)
|
||||
self.assertEqual(EXAMPLE['id'], sot.id)
|
||||
|
|
|
|||
|
|
@ -0,0 +1,11 @@
|
|||
---
|
||||
features:
|
||||
- |
|
||||
Add support for ``inherited_to`` filter for listing identity role
|
||||
assignments in the cloud layer. This allows filtering by whether role
|
||||
grants are inheritable to sub-projects.
|
||||
deprecations:
|
||||
- |
|
||||
Deprecate ``os-inherit-extension-inherited-to`` in favor of
|
||||
``inherited_to`` filter for listing identity role_assignments in the cloud
|
||||
layer.
|
||||
Loading…
Reference in New Issue