Reviewed: https://review.openstack.org/482142
Committed:
https://git.openstack.org/cgit/openstack/keystone/commit/?id=b7119637a04d0a07fa6419a407f433c01bbd1db2
Submitter: Jenkins
Branch: master
commit b7119637a04d0a07fa6419a407f433c01bbd1db2
Author: Matthew Edmonds <edmon...@us.ibm.com>
Date: Mon Jul 10 09:20:18 2017 -0400
fix identity:get_identity_providers typo
Changes identity:get_identity_providers policy rule to
identity:get_identity_provider to match what is checked by the code.
Change-Id: I0841abd30fd15c034b5836e42a18938634b509b1
Closes-Bug: #1703369
** Changed in: keystone
Status: In Progress => Fix Released
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Identity (keystone).
https://bugs.launchpad.net/bugs/1703369
Title:
get_identity_providers policy should be singular
Status in OpenStack Identity (keystone):
Fix Released
Status in OpenStack Identity (keystone) newton series:
New
Status in OpenStack Identity (keystone) ocata series:
New
Status in OpenStack Security Advisory:
Incomplete
Status in OpenStack Security Notes:
New
Bug description:
identity:get_identity_providers should be
identity:get_identity_provider (singular) since a GET is targeted on a
single provider and the code is setup to check for
identity:get_identity_provider (singular). See
https://github.com/openstack/keystone/blob/c7e29560b7bf7a44e44722eea0645bf18ad56af3/keystone/federation/controllers.py#L112
found in master (pike)
The ocata default policy.json also has this problem. Unless someone
manually overrode policy to specify identity:get_identity_provider
(singular), the result would be that the default rule was actually
used for that check instead of identity:get_identity_providers. We
could go back and fix the default policy.json for past releases, but
the default actually has the same value as
identity:get_identity_providers, and if nobody has complained it's
probably safer to just leave it. It is, after all, just defaults there
and anyone can override by specifying the correct value.
But we must fix in pike to go along with the shift of policy into
code. Policy defaults in code definitely need to match up with what
the code actually checks. There should no longer be any reliance on
the default rule.
To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1703369/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : yahoo-eng-team@lists.launchpad.net
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
