[Bug 1651989] Re: domain admin token will be treated as cloud admin
frode.nordahl at gmail.com
Fri Feb 3 15:23:51 UTC 2017
I have not analyzed the root cause of the discrepancy between upstream
master and Zesty / UCA xenial-ocata packages, but I guess a refresh of
keystone and/or oslo.policy packages is in order.
Bug is reproduced by running the functional tests for charm-keystone
against xenial-ocata, control test is to run functional tests for charm-
keystone against upstream git.
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to Ubuntu Cloud Archive.
domain admin token will be treated as cloud admin
Status in Ubuntu Cloud Archive:
Status in OpenStack Identity (keystone):
Status in keystone package in Juju Charms Collection:
The new capability of is_admin_project is currently only supported for
projects. However, the existing code for token models will return
is_admin_project as True if the attribute has not been set. Hence
admin domain tokens might get interpreted as cloud admin tokens. This
is currently masked by a bug in our policy samples that do not
correctly check for is_admin_project.
To manage notifications about this bug go to:
More information about the Ubuntu-openstack-bugs