This patch fixes some issues with LDAP client configuration on
ONTAP SVMs. With ldap security service, users should be able to
configure a LDAP client that can be used for authentication and
name mapping. The name service switch order remains: ldap,files.
Issues fixed:
- The driver now identifies when user provide a Active Directory
domain or a Linux/Unix LDAP server IP and sets the correct schema.
- LDAP configuration parameter `servers` was replaced by `ldap-servers`
in ONTAP 9.2, and now accepts host names too.
- Fix DNS configuration for LDAP security service
- User can now specify base search DN for LDAP queries, which can be
mandatory for Unix/Linux servers, using the security service `ou`
parameter.
Closes-Bug: #1916534
Change-Id: Ieaa53abbe50e7b708e508c132dfc4bb36b71a4f5
Signed-off-by: Douglas Viroel <viroel@gmail.com>
This commit updates the policies for share group type specs to understand scope
checking and account for a read-only role. This is part of a broader series of
changes across OpenStack to provide a consistent RBAC experience and improve
security.
Change-Id: Ie1b72459ae060693badb6fe864454836a4ff1300
This commit updates the policies for share network subnets to understand scope
checking and account for a read-only role. This is part of a broader series of
changes across OpenStack to provide a consistent RBAC experience and improve
security.
Change-Id: I2c90a40a7950be0463c3bc1bcf0b2d41cb6aeaa7
This commit updates the policies for share networks to understand scope
checking and account for a read-only role. This is part of a broader series of
changes across OpenStack to provide a consistent RBAC experience and improve
security.
Change-Id: Ie5e87c73e97d4a464ec91db8fba1c5d3e9abfff5
This commit updates the policies for
share group types to understand scope
checking and account for a read-only role.
This is part of a broader series of
changes across OpenStack to provide a
consistent RBAC experience and improve
security.
Also fix the HTTP method in the policy
doc for this API.
Change-Id: I8b95e1e70f74052e5bd4af1ba29842420bafd0b2
Signed-off-by: Goutham Pacha Ravi <gouthampravi@gmail.com>
This commit updates the policies for share groups
to understand scope checking and account for a
read-only role. This is part of a broader series
of changes across OpenStack to provide a
consistent RBAC experience and improve security.
Change-Id: I71d63179131c5dbe75a2de7339fa4df70243e83f
Signed-off-by: Goutham Pacha Ravi <gouthampravi@gmail.com>
This commit updates the policies for share instances to understand scope
checking and account for a read-only role. This is part of a broader series of
changes across OpenStack to provide a consistent RBAC experience and improve
security.
Change-Id: I1978fd95f5a9f798dd2d5a2ca011952515319746
This commit updates the policies for group snapshots to understand scope
checking and account for a read-only role. This is part of a broader series of
changes across OpenStack to provide a consistent RBAC experience and improve
security.
Change-Id: Id02cb45ecca32378a0a8b65589f21c64893d2c8e
This commit updates the policies for share replica locations to understand
scope checking and account for a read-only role. This is part of a broader
series of changes across OpenStack to provide a consistent RBAC experience and
improve security.
Change-Id: I2964f82844df47006e79c90d32f43174203f2aa6
This commit updates the policies for share instance export locations to
understand scope checking and account for a read-only role. This is part of a
broader series of changes across OpenStack to provide a consistent RBAC
experience and improve security.
Change-Id: I0cf9beed3c60fd790045580afa0c993c21e71d49
Allows set min/max share size that can be created in
extra_specs for each share_type.the share size will
be checked at API level as part of share create,
extend, shrink, migration_start. when manage share,
check it after get true size of share at manager layer.
new extra_specs keys are supported for set min/max
size of share.
'provisioning:max_share_size'
'provisioning:min_share_size'
Implements: blueprint share-size-limited-by-share-type
Change-Id: I5ce0fabf59bfca5ebaf0be5ffe9986e2b0480295
This commit updates the policies for share locations to understand scope
checking and account for a read-only role. This is part of a broader series of
changes across OpenStack to provide a consistent RBAC experience and improve
security.
Change-Id: Iaebbadea3ed153f19e7abb13d7d28ae3b6bb1fd9
This commit updates the policies for share
access rule metadata to understand scope
checking and account for a read-only role.
This is part of a broader series of
changes across OpenStack to provide a
consistent RBAC experience and improve
security.
Change-Id: Ie9fafd00f1a1888979fbce2a66af53613f8052c7
Signed-off-by: Goutham Pacha Ravi <gouthampravi@gmail.com>
This commit updates the policies for share access rules to understand scope
checking and account for a read-only role. This is part of a broader series of
changes across OpenStack to provide a consistent RBAC experience and improve
security.
Change-Id: I12026c7874620abb076df979f0492f6d1b8563fd
This commit updates the policies for services to
understand scope checking and account for a
read-only role. This is part of a broader series
of changes across OpenStack to provide a
consistent RBAC experience and improve security.
Change-Id: I340f63874af5783099ed6b353be61a2909829343
This commit updates the policies for security services
to understand scope checking and account for a read-only
role. This is part of a broader series of changes across
OpenStack to provide a consistent RBAC experience and
improve security.
Change-Id: I399a61691dad3a80c289c9f3f99f3c48be07846f
Signed-off-by: Goutham Pacha Ravi <gouthampravi@gmail.com>
Non privileged users of unrelated projects
must not be able to retrieve details of an
access rule. We can add a further check to
/share-access-rules APIs to validate that
the caller has access to the share that these
rules pertain to.
Change-Id: I0009a3d682ee5d9a946821c3f82dfd90faa886aa
Closes-Bug: #1917417
Signed-off-by: Goutham Pacha Ravi <gouthampravi@gmail.com>
oslo policy handles the mapping of
credentials from a context object to values
that oslo policy cares about. This mapping
includes some deprecations and compatibility
handling code that we must take advantage of [1].
So, stop mapping context to policy values
on our end, and rely on oslo.policy handling
this for us.
enforce and authorize methods in policy.py
do the same thing, but with a subtle
difference. The "enforce" method doesn't
raise errors when unregistered policies are
invoked - this shouldn't ever be the case
for any policies written/maintained within
manila - however, we support API extensions
and don't dictate what must be done there. So
add docstrings to clarify that we shouldn't
invoke enforce, ever.
Also handle InvalidPolicyScope exceptions
and raise the oslo.policy library version
since some test enhancements have been
committed in the latest version.
[1] d3185debdb/oslo_policy/policy.py (L1077-L1096)
Change-Id: I069bf7143d6ff66b3dcdc34c9b52d48f5808481b
Signed-off-by: Goutham Pacha Ravi <gouthampravi@gmail.com>
Manila's RequestContext base class was
recently refactored to allow arbitrary
keyword arguments to be passed on to the
base Context class in oslo_context. This
was done so that we don't have to maintain
every new addition to Context within manila
code since that layer may change as the
middleware components (keystonemiddleware, for
example) evolve outside of manila.
During this refactor, "system_scope" was
inadvertently added as a separate keyword
argument, and it wasn't being passed to the
base class, causing system scoped users to
not be represented correctly in the API.
We can drop this parameter and allow it to
flow transparently through "kwargs".
Change-Id: I88b664c631eddced4ee1fcdf34cf05222cb73662
Signed-off-by: Goutham Pacha Ravi <gouthampravi@gmail.com>
The profiler integration with the shared file system service(Manila)
allows to trace commands issued using both manila-client and
openstack-client.
Note that osprofiler should be run from admin user name & tenant.
Closes-Bug: #1915116
Change-Id: Ic16bc3cb03b851003c189450b398f8dd5dde8160
