** Changed in: keystone
Status: Fix Committed => Fix Released
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to Keystone.
https://bugs.launchpad.net/bugs/1417522
Title:
a normal user can delete other user's ec2 credentials
Status in OpenStack Identity (Keystone):
Fix Released
Bug description:
When use default policy.v3cloudsample.json, a normal user can delete
other user's ec2 credential. This is because current policy of
identity:ec2_delete_credential is (rule:admin_or_cloud_admin or
rule:owner) or (rule:owner and user_id:%(target.credential.user_id)s).
Note that rule:owner is "user_id:%(user_id)s or
user_id:%(target.token.user_id)s" which only checks if the user from
token matchs the user from url. We also should check if the user owns
the deleting credential.
To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1417522/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
