Skip to content

Commit c9d3add

Browse files
Jenkinsopenstack-gerrit
Jenkins
authored and
openstack-gerrit
committed
Merge "Role operations should not require list object permission"
2 parents fd8b284 + 4c107e6 commit c9d3add

3 files changed

Lines changed: 108 additions & 49 deletions

File tree

‎openstackclient/identity/common.py‎

Lines changed: 58 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@
1717

1818
from keystoneclient import exceptions as identity_exc
1919
from keystoneclient.v3 import domains
20+
from keystoneclient.v3 import groups
21+
from keystoneclient.v3 import projects
22+
from keystoneclient.v3 import users
2023
from openstackclient.common import exceptions
2124
from openstackclient.common import utils
2225

@@ -56,4 +59,58 @@ def find_domain(identity_client, name_or_id):
5659
return dom
5760
except identity_exc.Forbidden:
5861
pass
59-
return domains.Domain(None, {'id': name_or_id})
62+
return domains.Domain(None, {'id': name_or_id, 'name': name_or_id})
63+
64+
65+
def find_group(identity_client, name_or_id):
66+
"""Find a group.
67+
68+
If the user does not have permissions to to perform a list groups call,
69+
e.g., if the user is a project admin, assume that the group given is the
70+
id rather than the name. This method is used by the role add command to
71+
allow a role to be assigned to a group by a project admin who does not
72+
have permission to list groups.
73+
"""
74+
try:
75+
group = utils.find_resource(identity_client.groups, name_or_id)
76+
if group is not None:
77+
return group
78+
except identity_exc.Forbidden:
79+
pass
80+
return groups.Group(None, {'id': name_or_id, 'name': name_or_id})
81+
82+
83+
def find_project(identity_client, name_or_id):
84+
"""Find a project.
85+
86+
If the user does not have permissions to to perform a list projects
87+
call, e.g., if the user is a project admin, assume that the project
88+
given is the id rather than the name. This method is used by the role
89+
add command to allow a role to be assigned to a user by a project admin
90+
who does not have permission to list projects.
91+
"""
92+
try:
93+
project = utils.find_resource(identity_client.projects, name_or_id)
94+
if project is not None:
95+
return project
96+
except identity_exc.Forbidden:
97+
pass
98+
return projects.Project(None, {'id': name_or_id, 'name': name_or_id})
99+
100+
101+
def find_user(identity_client, name_or_id):
102+
"""Find a user.
103+
104+
If the user does not have permissions to to perform a list users call,
105+
e.g., if the user is a project admin, assume that the user given is the
106+
id rather than the name. This method is used by the role add command to
107+
allow a role to be assigned to a user by a project admin who does not
108+
have permission to list users.
109+
"""
110+
try:
111+
user = utils.find_resource(identity_client.users, name_or_id)
112+
if user is not None:
113+
return user
114+
except identity_exc.Forbidden:
115+
pass
116+
return users.User(None, {'id': name_or_id, 'name': name_or_id})

‎openstackclient/identity/v3/role.py‎

Lines changed: 41 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626

2727
from openstackclient.common import utils
2828
from openstackclient.i18n import _ # noqa
29+
from openstackclient.identity import common
2930

3031

3132
class AddRole(command.Command):
@@ -78,12 +79,12 @@ def take_action(self, parsed_args):
7879
)
7980

8081
if parsed_args.user and parsed_args.domain:
81-
user = utils.find_resource(
82-
identity_client.users,
82+
user = common.find_user(
83+
identity_client,
8384
parsed_args.user,
8485
)
85-
domain = utils.find_resource(
86-
identity_client.domains,
86+
domain = common.find_domain(
87+
identity_client,
8788
parsed_args.domain,
8889
)
8990
identity_client.roles.grant(
@@ -92,12 +93,12 @@ def take_action(self, parsed_args):
9293
domain=domain.id,
9394
)
9495
elif parsed_args.user and parsed_args.project:
95-
user = utils.find_resource(
96-
identity_client.users,
96+
user = common.find_user(
97+
identity_client,
9798
parsed_args.user,
9899
)
99-
project = utils.find_resource(
100-
identity_client.projects,
100+
project = common.find_project(
101+
identity_client,
101102
parsed_args.project,
102103
)
103104
identity_client.roles.grant(
@@ -106,12 +107,12 @@ def take_action(self, parsed_args):
106107
project=project.id,
107108
)
108109
elif parsed_args.group and parsed_args.domain:
109-
group = utils.find_resource(
110-
identity_client.groups,
110+
group = common.find_group(
111+
identity_client,
111112
parsed_args.group,
112113
)
113-
domain = utils.find_resource(
114-
identity_client.domains,
114+
domain = common.find_domain(
115+
identity_client,
115116
parsed_args.domain,
116117
)
117118
identity_client.roles.grant(
@@ -120,12 +121,12 @@ def take_action(self, parsed_args):
120121
domain=domain.id,
121122
)
122123
elif parsed_args.group and parsed_args.project:
123-
group = utils.find_resource(
124-
identity_client.groups,
124+
group = common.find_group(
125+
identity_client,
125126
parsed_args.group,
126127
)
127-
project = utils.find_resource(
128-
identity_client.projects,
128+
project = common.find_project(
129+
identity_client,
129130
parsed_args.project,
130131
)
131132
identity_client.roles.grant(
@@ -240,24 +241,24 @@ def take_action(self, parsed_args):
240241
identity_client = self.app.client_manager.identity
241242

242243
if parsed_args.user:
243-
user = utils.find_resource(
244-
identity_client.users,
244+
user = common.find_user(
245+
identity_client,
245246
parsed_args.user,
246247
)
247248
elif parsed_args.group:
248-
group = utils.find_resource(
249-
identity_client.groups,
249+
group = common.find_group(
250+
identity_client,
250251
parsed_args.group,
251252
)
252253

253254
if parsed_args.domain:
254-
domain = utils.find_resource(
255-
identity_client.domains,
255+
domain = common.find_domain(
256+
identity_client,
256257
parsed_args.domain,
257258
)
258259
elif parsed_args.project:
259-
project = utils.find_resource(
260-
identity_client.projects,
260+
project = common.find_project(
261+
identity_client,
261262
parsed_args.project,
262263
)
263264

@@ -370,12 +371,12 @@ def take_action(self, parsed_args):
370371
)
371372

372373
if parsed_args.user and parsed_args.domain:
373-
user = utils.find_resource(
374-
identity_client.users,
374+
user = common.find_user(
375+
identity_client,
375376
parsed_args.user,
376377
)
377-
domain = utils.find_resource(
378-
identity_client.domains,
378+
domain = common.find_domain(
379+
identity_client,
379380
parsed_args.domain,
380381
)
381382
identity_client.roles.revoke(
@@ -384,12 +385,12 @@ def take_action(self, parsed_args):
384385
domain=domain.id,
385386
)
386387
elif parsed_args.user and parsed_args.project:
387-
user = utils.find_resource(
388-
identity_client.users,
388+
user = common.find_user(
389+
identity_client,
389390
parsed_args.user,
390391
)
391-
project = utils.find_resource(
392-
identity_client.projects,
392+
project = common.find_project(
393+
identity_client,
393394
parsed_args.project,
394395
)
395396
identity_client.roles.revoke(
@@ -398,12 +399,12 @@ def take_action(self, parsed_args):
398399
project=project.id,
399400
)
400401
elif parsed_args.group and parsed_args.domain:
401-
group = utils.find_resource(
402-
identity_client.groups,
402+
group = common.find_group(
403+
identity_client,
403404
parsed_args.group,
404405
)
405-
domain = utils.find_resource(
406-
identity_client.domains,
406+
domain = common.find_domain(
407+
identity_client,
407408
parsed_args.domain,
408409
)
409410
identity_client.roles.revoke(
@@ -412,12 +413,12 @@ def take_action(self, parsed_args):
412413
domain=domain.id,
413414
)
414415
elif parsed_args.group and parsed_args.project:
415-
group = utils.find_resource(
416-
identity_client.groups,
416+
group = common.find_group(
417+
identity_client,
417418
parsed_args.group,
418419
)
419-
project = utils.find_resource(
420-
identity_client.projects,
420+
project = common.find_project(
421+
identity_client,
421422
parsed_args.project,
422423
)
423424
identity_client.roles.revoke(

‎openstackclient/identity/v3/role_assignment.py‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
from cliff import lister
1919

2020
from openstackclient.common import utils
21+
from openstackclient.identity import common
2122

2223

2324
class ListRoleAssignment(lister.Lister):
@@ -80,29 +81,29 @@ def take_action(self, parsed_args):
8081

8182
user = None
8283
if parsed_args.user:
83-
user = utils.find_resource(
84-
identity_client.users,
84+
user = common.find_user(
85+
identity_client,
8586
parsed_args.user,
8687
)
8788

8889
domain = None
8990
if parsed_args.domain:
90-
domain = utils.find_resource(
91-
identity_client.domains,
91+
domain = common.find_domain(
92+
identity_client,
9293
parsed_args.domain,
9394
)
9495

9596
project = None
9697
if parsed_args.project:
97-
project = utils.find_resource(
98-
identity_client.projects,
98+
project = common.find_project(
99+
identity_client,
99100
parsed_args.project,
100101
)
101102

102103
group = None
103104
if parsed_args.group:
104-
group = utils.find_resource(
105-
identity_client.groups,
105+
group = common.find_group(
106+
identity_client,
106107
parsed_args.group,
107108
)
108109

0 commit comments

Comments
 (0)