add ability to obscure internal and admin endpoints from standard users

Bug #854104 reported by Antony Messerli
16
This bug affects 2 people
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
Fix Released
High
Yogeshwar

Bug Description

Add the ability to obscure the internal and admin urls from being shown to regular users. Currently both are visible in the Service Catalog.

Joe Savak (jsavak)
Changed in keystone:
importance: Undecided → High
Changed in keystone:
assignee: nobody → Yogeshwar (yogesh-srikrishnan)
Changed in keystone:
status: New → In Progress
Revision history for this message
Yogeshwar (yogesh-srikrishnan) wrote :

Code Submitted.Waiting for someone to review.

Changed in keystone:
milestone: none → essex-2
Revision history for this message
Ziad Sawalha (ziad-sawalha) wrote :

internal endpoints are not meant to be private. They are basically supposed to be endpoints that you can use between services that go over a high-bandwidth, low latency, unmetered (free) network. Think saving images from Nova to Swift through Glance. You don't want that going over a public, paid link... you want to use 'internal' links.

So this bug will address hiding admin links only.

Revision history for this message
Openstack Gerrit (openstack-gerrit) wrote : Fix merged to keystone (master)

Reviewed: https://review.openstack.org/1542
Committed: http://github.com/openstack/keystone/commit/eaf3b929f53572bfceb9271cc5496493708aa0cb
Submitter: Jenkins
Branch: master

 status fixcommitted
 done

commit eaf3b929f53572bfceb9271cc5496493708aa0cb
Author: Yogeshwar Srikrishnan <email address hidden>
Date: Fri Nov 11 02:35:32 2011 -0600

    Bug #854104
      - Changes to allow admin url to be shown only for admin users.
      - Additional test asserts to verify.

    This was implemented by adding a parameter to the AuthData __init__
    (the class that renders auth call responses). The url_types parameter
    filters which types of URLs to return; admin, intenrnal, public.
    And in logic/service.py, there is authorization logic which checks
    the caller's rights and based on that determines if they can see
    the 'admin' URL. If not, it takes it out of the array passed to
    the url_types paramater passed to the AuthData initializer.

    Added method documentation and renamed a couple in service.py in
    the process to improve code understandability. More needs to be
    done, but moving the ball forward.

    Change-Id: I3fb90c31617da7647a211901d647cfb53f182be2

Changed in keystone:
status: In Progress → Fix Committed
Thierry Carrez (ttx)
Changed in keystone:
status: Fix Committed → Fix Released
Thierry Carrez (ttx)
Changed in keystone:
milestone: essex-2 → 2012.1
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.