Open Stack

On 7/25/19 1:18 AM, Bernd Bausch wrote:
> The Keystone policy.json file I created with oslo-policy-generator 
> contains lines I don't understand. For example /list_users/. The comment 
> says:
> 
> # DEPRECATED "identity:list_users":"rule:admin_required" has been
> # deprecated since S in favor of "identity:list_users":"(role:reader
> # and system_scope:all) or (role:reader and
> # domain_id:%(target.domain_id)s)".
> 
> I do understand the expression starting with (role:reader .... , but 
> contrarily to the comment, the policy is
> 
> "identity:list_users": "rule:identity:list_users"
> 
> This looks like a circular definition, and in any case, nowhere do I 
> seerule:identity:list_users defined.
> 
> Can someone in the know explain how this policy is processed?

You're right, this is a circular definition and a bug in the policy 
generator. This behavior was intended to address [0], but when the 
deprecated rule name matches the current rule name it creates this 
nonsense policy. Since the bug doesn't apply in this case, we can just 
drop the unnecessary alias. Lance pushed a fix in [1] that should make 
this work sanely again.

Thanks for bringing this to our attention.

0: https://bugs.launchpad.net/oslo.policy/+bug/1742569
1: https://review.opendev.org/#/c/672781/

> 
> Thanks much,
> 
> Bernd
>