<div dir="ltr">Hi Liam,<div><br></div><div>As you said, this is a known issue of the "policy.v3cloudsample.json" policy file. The cloud_admin rule is supposed to be something like: or I have a project scoped token for the "is_admin" project with the admin role, or I have a domain scoped token for the specified domain with the admin role.</div><div><br></div><div>Currently, we are studying the possibility to merge both files. We also have weekly meetings focused only on policy [1].</div><div><br></div><div>[1] <a href="http://eavesdrop.openstack.org/#Keystone_Policy_Meeting">http://eavesdrop.openstack.org/#Keystone_Policy_Meeting</a></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jan 24, 2017 at 9:16 AM, Liam Young <span dir="ltr"><<a href="mailto:liam.young@canonical.com" target="_blank">liam.young@canonical.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Hi,<br></div><div><br></div><div>Firstly, apologies for the cross post from openstack@l.o.o but I think this is a more appropriate mailing list and I'd like to add some more information.</div><div><br></div><div>I have been running tempest full against a Keystone v3 enabled cloud using the stable newton policy.v3cloudsample.json *1 and it is failing for me. I then checked what was happening at Keystone gate *2 and saw that the v3 gate jobs appear to be using the old policy.json *3 which I assume is deprecated for v3 as granting the admin role on anything in-effect gives a user cloud-admin.</div><div><br></div><div>My questions are:</div><div>1) Should gate be using policy.v3cloudsample.json to run v3 tests?</div><div>2) Should I expect a tempest full run to pass against a Newton deployment using policy.v3cloudsample.json ?</div><div><br></div><div>What I'm seeing is that some tests (like tempest.api.compute.admin.<wbr>test_quotas) fail when they try and list_domains. This seems to be because the test creates:</div><div><br></div><div>1) A new project in the admin domain</div><div>2) A new user in the admin domain</div><div>3) Grants the admin role on the new project to the new user.</div><div><br></div><div>The test then authenticates with the new users credentials and attempts to list_domains. The policy.json, however, has:</div><div><br></div><div><br></div><div> "cloud_admin": "role:admin and (token.is_admin_project:True or domain_id:<wbr>363ab68785c24c81a784edca1bceb9<wbr>35)",</div><div>...</div><div> "identity:list_domains": "rule:cloud_admin",</div><div><br></div><div>From tempest I see:</div><div><br></div><div>==============================<wbr>==============================<wbr>==========</div><div>FAIL: tempest.api.compute.admin.<wbr>test_quotas.<wbr>QuotasAdminTestJSON.test_<wbr>delete_quota[id-389d04f0-3a41-<wbr>405f-9317-e5f86e3c44f0]</div><div>tags: worker-0</div><div>------------------------------<wbr>------------------------------<wbr>----------</div><div>Empty attachments:</div><div> stderr</div><div> stdout</div><div><br></div><div>pythonlogging:'': {{{2017-01-23 15:57:09,806 2014 INFO [tempest.lib.common.rest_<wbr>client] Request (QuotasAdminTestJSON:test_<wbr>delete_quota): 403 GET <a href="http://10.5.36.109:35357/v3/domains?name=admin_domain" target="_blank">http://10.5.36.109:35357/v3/<wbr>domains?name=admin_domain</a> 0.066s}}}</div><div><br></div><div>Traceback (most recent call last):</div><div> File "tempest/api/compute/admin/<wbr>test_quotas.py", line 128, in test_delete_quota</div><div> project = self.identity_utils.create_<wbr>project(name=project_name,</div><div> File "tempest/test.py", line 470, in identity_utils</div><div> project_domain_name=domain)</div><div> File "tempest/lib/common/cred_<wbr>client.py", line 210, in get_creds_client</div><div> roles_client, domains_client, project_domain_name)</div><div> File "tempest/lib/common/cred_<wbr>client.py", line 142, in __init__</div><div> name=domain_name)['domains'][<wbr>0]</div><div> File "tempest/lib/services/<wbr>identity/v3/domains_client.py"<wbr>, line 57, in list_domains</div><div> resp, body = self.get(url)</div><div> File "tempest/lib/common/rest_<wbr>client.py", line 290, in get</div><div> return self.request('GET', url, extra_headers, headers)</div><div> File "tempest/lib/common/rest_<wbr>client.py", line 663, in request</div><div> self._error_checker(resp, resp_body)</div><div> File "tempest/lib/common/rest_<wbr>client.py", line 755, in _error_checker</div><div> raise exceptions.Forbidden(resp_<wbr>body, resp=resp)</div><div>tempest.lib.exceptions.<wbr>Forbidden: Forbidden</div><div>Details: {u'message': u'You are not authorized to perform the requested action: identity:list_domains', u'code': 403, u'title': u'Forbidden'}</div><div><br></div><div>In the keystone log I see:</div><div><br></div><div>(keystone.policy.backends.<wbr>rules): 2017-01-23 15:35:57,198 DEBUG enforce identity:list_domains: {'is_delegated_auth': False, </div><div>'access_token_id': None, </div><div>'user_id': u'<wbr>3fd9e70825d648d996080d855cf9c1<wbr>81', </div><div>'roles': [u'Admin'], </div><div>'user_domain_id': u'<wbr>363ab68785c24c81a784edca1bceb9<wbr>35', </div><div>'consumer_id': None, </div><div>'trustee_id': None, </div><div>'is_domain': False, </div><div>'trustor_id': None, </div><div>'token': <KeystoneToken (audit_id=<wbr>4cQHEfwhSvuvibK4TAjKUw, audit_chain_id=<wbr>4cQHEfwhSvuvibK4TAjKUw) at 0x7fbcceaa33c8>, </div><div>'project_id': u'<wbr>b48ba24e96d84de4a48077b9310faa<wbr>c7', </div><div>'trust_id': None, </div><div>'project_domain_id': u'<wbr>363ab68785c24c81a784edca1bceb9<wbr>35'}</div><div>(keystone.common.wsgi): 2017-01-23 15:35:57,199 WARNING You are not authorized to perform the requested action: identity:list_domains</div><div><br></div><div>This appears to be project scoped. If I update the policy.json to grant cloud_admin if the project is the admin domain then that seems to fix things. The change I'm trying is:</div><div><br></div><div> 3c3,4</div><div>< "cloud_admin": "role:admin and (token.is_admin_project:True or domain_id:admin_domain_id)",</div><div>---</div><div>> "bob": "project_domain_id:<wbr>363ab68785c24c81a784edca1bceb9<wbr>35 or domain_id:<wbr>363ab68785c24c81a784edca1bceb9<wbr>35",</div><div>> "cloud_admin": "role:admin and (token.is_admin_project:True or rule:bob)",</div><div><br></div><div>I did notice this comment on Bug #1451987 *4:</div><div><br></div><div>If you see following errors for all identity api v3 tests, then please be known that its not a a bug in tempest, rather you need to change keystone v3 policy.json and make it more relaxed so tempest can authorize with users created for each test with separate projects(tenants) because we set tenant_isolation to True in tempest.conf ...</div><div><br></div><div>This suggests to me that it is expected for policy.json to need tweaking.</div><div><br></div><div>Regards</div><div>Liam</div><div><br></div><div>*1 <a href="https://github.com/openstack/keystone/blob/stable/newton/etc/policy.v3cloudsample.json" target="_blank">https://github.com/openstack/<wbr>keystone/blob/stable/newton/<wbr>etc/policy.v3cloudsample.json</a></div><div>*2 <a href="http://logs.openstack.org/66/418166/10/check/gate-keystone-dsvm-functional-v3-only-ubuntu-xenial-nv/fc0af39/logs/etc/keystone/policy.json.txt.gz" target="_blank">http://logs.openstack.org/<wbr>66/418166/10/check/gate-<wbr>keystone-dsvm-functional-v3-<wbr>only-ubuntu-xenial-nv/fc0af39/<wbr>logs/etc/keystone/policy.json.<wbr>txt.gz</a></div><div>*3 <a href="https://github.com/openstack/keystone/blob/master/etc/policy.json" target="_blank">https://github.com/openstack/<wbr>keystone/blob/master/etc/<wbr>policy.json</a></div><div>*4 <a href="https://bugs.launchpad.net/tempest/+bug/1451987/comments/2" target="_blank">https://bugs.launchpad.net/<wbr>tempest/+bug/1451987/comments/<wbr>2</a></div></div>
<br>______________________________<wbr>______________________________<wbr>______________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.<wbr>openstack.org?subject:<wbr>unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/<wbr>cgi-bin/mailman/listinfo/<wbr>openstack-dev</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><font color="#666666">Rodrigo Duarte Sousa<br></font></div><div><font color="#666666">Senior Quality Engineer @ Red Hat<br></font></div><div dir="ltr"><div><div><span style="color:rgb(102,102,102)">MSc</span><span style="color:rgb(102,102,102)"></span><span style="color:rgb(102,102,102)"> in Computer Science</span><br><font color="#3333ff"><a href="http://rodrigods.com" target="_blank">http://<font color="#3333ff">rodrigods.com</font></a></font></div></div></div></div></div></div></div></div></div></div></div></div>
</div>