Merge "Update Keystone core to Mitaka."

1 files changed, 47 insertions, 19 deletions

diff --git a/keystone-moon/etc/policy.v3cloudsample.json b/keystone-moon/etc/policy.v3cloudsample.json
index a96996c6..4ec1aa95 100644
--- a/keystone-moon/etc/policy.v3cloudsample.json
+++ b/keystone-moon/etc/policy.v3cloudsample.json
@@ -1,11 +1,10 @@
 {
     "admin_required": "role:admin",
-    "cloud_admin": "rule:admin_required and domain_id:admin_domain_id",
+    "cloud_admin": "role:admin and (token.is_admin_project:True or domain_id:admin_domain_id)",
     "service_role": "role:service",
     "service_or_admin": "rule:admin_required or rule:service_role",
     "owner" : "user_id:%(user_id)s or user_id:%(target.token.user_id)s",
     "admin_or_owner": "(rule:admin_required and domain_id:%(target.token.user.domain.id)s) or rule:owner",
-    "admin_or_cloud_admin": "rule:admin_required or rule:cloud_admin",
     "admin_and_matching_domain_id": "rule:admin_required and domain_id:%(domain_id)s",
     "service_admin_or_owner": "rule:service_or_admin or rule:owner",
 
@@ -17,14 +16,14 @@
     "identity:update_region": "rule:cloud_admin",
     "identity:delete_region": "rule:cloud_admin",
 
-    "identity:get_service": "rule:admin_or_cloud_admin",
-    "identity:list_services": "rule:admin_or_cloud_admin",
+    "identity:get_service": "rule:admin_required",
+    "identity:list_services": "rule:admin_required",
     "identity:create_service": "rule:cloud_admin",
     "identity:update_service": "rule:cloud_admin",
     "identity:delete_service": "rule:cloud_admin",
 
-    "identity:get_endpoint": "rule:admin_or_cloud_admin",
-    "identity:list_endpoints": "rule:admin_or_cloud_admin",
+    "identity:get_endpoint": "rule:admin_required",
+    "identity:list_endpoints": "rule:admin_required",
     "identity:create_endpoint": "rule:cloud_admin",
     "identity:update_endpoint": "rule:cloud_admin",
     "identity:delete_endpoint": "rule:cloud_admin",
@@ -37,7 +36,7 @@
 
     "admin_and_matching_target_project_domain_id": "rule:admin_required and domain_id:%(target.project.domain_id)s",
     "admin_and_matching_project_domain_id": "rule:admin_required and domain_id:%(project.domain_id)s",
-    "identity:get_project": "rule:cloud_admin or rule:admin_and_matching_target_project_domain_id",
+    "identity:get_project": "rule:cloud_admin or rule:admin_and_matching_target_project_domain_id or project_id:%(target.project.id)s",
     "identity:list_projects": "rule:cloud_admin or rule:admin_and_matching_domain_id",
     "identity:list_user_projects": "rule:owner or rule:admin_and_matching_domain_id",
     "identity:create_project": "rule:cloud_admin or rule:admin_and_matching_project_domain_id",
@@ -71,28 +70,56 @@
     "identity:update_credential": "rule:admin_required",
     "identity:delete_credential": "rule:admin_required",
 
-    "identity:ec2_get_credential": "rule:admin_or_cloud_admin or (rule:owner and user_id:%(target.credential.user_id)s)",
-    "identity:ec2_list_credentials": "rule:admin_or_cloud_admin or rule:owner",
-    "identity:ec2_create_credential": "rule:admin_or_cloud_admin or rule:owner",
-    "identity:ec2_delete_credential": "rule:admin_or_cloud_admin or (rule:owner and user_id:%(target.credential.user_id)s)",
+    "identity:ec2_get_credential": "rule:admin_required or (rule:owner and user_id:%(target.credential.user_id)s)",
+    "identity:ec2_list_credentials": "rule:admin_required or rule:owner",
+    "identity:ec2_create_credential": "rule:admin_required or rule:owner",
+    "identity:ec2_delete_credential": "rule:admin_required or (rule:owner and user_id:%(target.credential.user_id)s)",
 
-    "identity:get_role": "rule:admin_or_cloud_admin",
-    "identity:list_roles": "rule:admin_or_cloud_admin",
+    "identity:get_role": "rule:admin_required",
+    "identity:list_roles": "rule:admin_required",
     "identity:create_role": "rule:cloud_admin",
     "identity:update_role": "rule:cloud_admin",
     "identity:delete_role": "rule:cloud_admin",
 
-    "domain_admin_for_grants": "rule:admin_required and (domain_id:%(domain_id)s or domain_id:%(target.project.domain_id)s)",
-    "project_admin_for_grants": "rule:admin_required and project_id:%(project_id)s",
+    "identity:get_domain_role": "rule:cloud_admin or rule:get_domain_roles",
+    "identity:list_domain_roles": "rule:cloud_admin or rule:list_domain_roles",
+    "identity:create_domain_role": "rule:cloud_admin or rule:domain_admin_matches_domain_role",
+    "identity:update_domain_role": "rule:cloud_admin or rule:domain_admin_matches_target_domain_role",
+    "identity:delete_domain_role": "rule:cloud_admin or rule:domain_admin_matches_target_domain_role",
+    "domain_admin_matches_domain_role": "rule:admin_required and domain_id:%(role.domain_id)s",
+    "get_domain_roles": "rule:domain_admin_matches_target_domain_role or rule:project_admin_matches_target_domain_role",
+    "domain_admin_matches_target_domain_role": "rule:admin_required and domain_id:%(target.role.domain_id)s",
+    "project_admin_matches_target_domain_role": "rule:admin_required and project_domain_id:%(target.role.domain_id)s",
+    "list_domain_roles": "rule:domain_admin_matches_filter_on_list_domain_roles or rule:project_admin_matches_filter_on_list_domain_roles",
+    "domain_admin_matches_filter_on_list_domain_roles": "rule:admin_required and domain_id:%(domain_id)s",
+    "project_admin_matches_filter_on_list_domain_roles": "rule:admin_required and project_domain_id:%(domain_id)s",
+
+    "identity:get_implied_role": "rule:cloud_admin",
+    "identity:list_implied_roles": "rule:cloud_admin",
+    "identity:create_implied_role": "rule:cloud_admin",
+    "identity:delete_implied_role": "rule:cloud_admin",
+    "identity:list_role_inference_rules": "rule:cloud_admin",
+    "identity:check_implied_role": "rule:cloud_admin",
+
     "identity:check_grant": "rule:cloud_admin or rule:domain_admin_for_grants or rule:project_admin_for_grants",
-    "identity:list_grants": "rule:cloud_admin or rule:domain_admin_for_grants or rule:project_admin_for_grants",
+    "identity:list_grants": "rule:cloud_admin or rule:domain_admin_for_list_grants or rule:project_admin_for_list_grants",
     "identity:create_grant": "rule:cloud_admin or rule:domain_admin_for_grants or rule:project_admin_for_grants",
     "identity:revoke_grant": "rule:cloud_admin or rule:domain_admin_for_grants or rule:project_admin_for_grants",
-
+    "domain_admin_for_grants": "rule:domain_admin_for_global_role_grants or rule:domain_admin_for_domain_role_grants",
+    "domain_admin_for_global_role_grants": "rule:admin_required and None:%(target.role.domain_id)s and rule:domain_admin_grant_match",
+    "domain_admin_for_domain_role_grants": "rule:admin_required and domain_id:%(target.role.domain_id)s and rule:domain_admin_grant_match",
+    "domain_admin_grant_match": "domain_id:%(domain_id)s or domain_id:%(target.project.domain_id)s",
+    "project_admin_for_grants": "rule:project_admin_for_global_role_grants or rule:project_admin_for_domain_role_grants",
+    "project_admin_for_global_role_grants": "rule:admin_required and None:%(target.role.domain_id)s and project_id:%(project_id)s",
+    "project_admin_for_domain_role_grants": "rule:admin_required and project_domain_id:%(target.role.domain_id)s and project_id:%(project_id)s",
+    "domain_admin_for_list_grants": "rule:admin_required and rule:domain_admin_grant_match",
+    "project_admin_for_list_grants": "rule:admin_required and project_id:%(project_id)s",
+ 
     "admin_on_domain_filter" : "rule:admin_required and domain_id:%(scope.domain.id)s",
     "admin_on_project_filter" : "rule:admin_required and project_id:%(scope.project.id)s",
+    "admin_on_domain_of_project_filter" : "rule:admin_required and domain_id:%(target.project.domain_id)s",
     "identity:list_role_assignments": "rule:cloud_admin or rule:admin_on_domain_filter or rule:admin_on_project_filter",
-
+    "identity:list_role_assignments_for_tree": "rule:cloud_admin or rule:admin_on_domain_of_project_filter",
     "identity:get_policy": "rule:cloud_admin",
     "identity:list_policies": "rule:cloud_admin",
     "identity:create_policy": "rule:cloud_admin",
@@ -191,5 +218,6 @@
     "identity:create_domain_config": "rule:cloud_admin",
     "identity:get_domain_config": "rule:cloud_admin",
     "identity:update_domain_config": "rule:cloud_admin",
-    "identity:delete_domain_config": "rule:cloud_admin"
+    "identity:delete_domain_config": "rule:cloud_admin",
+    "identity:get_domain_config_default": "rule:cloud_admin"
 }