hi Jakub,
thx for reply.
I know set multitenancy=false can read __no_rule__ security,because the
code in vnc_cfg_api_server.py :
def is_admin_request(self):
if not self.is_multi_tenancy_set():
return True
env = bottle.request.headers.environ
for field in ('HTTP_X_API_ROLE', 'HTTP_X_ROLE'):
if field in env:
roles = env[field].split(',')
return 'admin' in [x.lower() for x in roles]
return False
but I want is_admin_request func works find while enable multitenancy
[email protected]
From: Jakub Pavlik
Date: 2016-08-29 14:44
To: liky
CC: dev
Subject: Re: [opencontrail-dev] permission about __no_rule__ security
(contrail3.0 + openstack M)
Hello,
try workaround to set multitenancy=false into contrail-api.conf
Jakub
Odesláno z BlueMail
29. 8. 2016, 8:27, "[email protected]" <[email protected]> napsal/a:
hi,all
My env is contrail3.0 + openstack M
I encounter an issue which is similar to
https://bugs.launchpad.net/opencontrail/+bug/1590790
when I remove all the security groups of a VM.
If this is not the first time, in another hand, when I remove security
groups if the __no_rule__ security is already exist,the operation would be
failed and raise RefsExistError
this is because,the request without admin role there is no permission to
read __no_rule__ security, and then attempt to create it which already exist.
In fact, the tenant has the admin role.
the contrail2.20 there is no the issue,so I check the code I found this is
because we disable auth=keystone in contrail-api.conf and 'HTTP_X_ROLE'
Deprecated in Mitaka of openstack.
disable auth=keystone,in contrail2.20 would add 'admin' role into the
header for all requests to see all resources (those code is delete in
contrail3.0)
enable auth=keystone,while auth_middleware.get_admin_token() raise
AttributeError: 'AuthProtocol' object has no attribute 'get_admin_token'
So,
1. how can I fix the issue while diable auth in contrail-api.conf ?
2. if enable auth=keystone, how to integrate with Mitaka ?
any help would be appreciated
Keyang Li
[email protected]
Dev mailing list
[email protected]
http://lists.opencontrail.org/mailman/listinfo/dev_lists.opencontrail.org
_______________________________________________
Dev mailing list
[email protected]
http://lists.opencontrail.org/mailman/listinfo/dev_lists.opencontrail.org
