1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
From 82dcde08f60c45002955875664a3cf82d1d211bc Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Mon, 21 Oct 2013 15:21:12 -0500
Subject: [PATCH] Fix remove role assignment adds role using LDAP assignment
When using the LDAP assignment backend, attempting to remove a
role assignment when the role hadn't been used before would
actually add the role assignment and would not return a
404 Not Found like the SQL backend.
This change makes it so that when attempt to remove a role that
wasn't assigned then 404 Not Found is returned.
Closes-Bug: #1242855
Change-Id: I28ccd26cc4bb1a241d0363d0ab52d2c11410e8b3
(cherry picked from commit c6800ca1ac984c879e75826df6694d6199444ea0)
(cherry picked from commit b17e7bec768bd53d3977352486378698a3db3cfa)
(cherry picked from commit 4221b6020e6b0b42325d8904d7b8a22577a6acc0)
---
keystone/identity/backends/ldap/core.py | 19 ++++---------------
tests/test_backend.py | 9 +++++++++
2 files changed, 13 insertions(+), 15 deletions(-)
diff --git a/keystone/identity/backends/ldap/core.py b/keystone/identity/backends/ldap/core.py
index 8ac7395..3d016c0 100644
--- a/keystone/identity/backends/ldap/core.py
+++ b/keystone/identity/backends/ldap/core.py
@@ -704,21 +704,10 @@ def delete_user(self, role_id, user_id, tenant_id):
try:
conn.modify_s(role_dn, [(ldap.MOD_DELETE,
self.member_attribute, user_dn)])
- except ldap.NO_SUCH_OBJECT:
- if tenant_id is None or self.get(role_id) is None:
- raise exception.RoleNotFound(role_id=role_id)
- attrs = [('objectClass', [self.object_class]),
- (self.member_attribute, [user_dn])]
-
- if self.use_dumb_member:
- attrs[1][1].append(self.dumb_member)
- try:
- conn.add_s(role_dn, attrs)
- except Exception as inst:
- raise inst
-
- except ldap.NO_SUCH_ATTRIBUTE:
- raise exception.UserNotFound(user_id=user_id)
+ except (ldap.NO_SUCH_OBJECT, ldap.NO_SUCH_ATTRIBUTE):
+ raise exception.RoleNotFound(message=_(
+ 'Cannot remove role that has not been granted, %s') %
+ role_id)
def get_role_assignments(self, tenant_id):
conn = self.get_connection()
diff --git a/tests/test_backend.py b/tests/test_backend.py
index d4c2e6c..1af3c16 100644
--- a/tests/test_backend.py
+++ b/tests/test_backend.py
@@ -57,6 +57,15 @@ def test_project_add_and_remove_user_role(self):
user_refs = self.identity_api.get_project_users(self.tenant_bar['id'])
self.assertNotIn(self.user_two['id'], [x['id'] for x in user_refs])
+ def test_remove_user_role_not_assigned(self):
+ # Expect failure if attempt to remove a role that was never assigned to
+ # the user.
+ self.assertRaises(exception.RoleNotFound,
+ self.identity_api.remove_role_from_user_and_project,
+ tenant_id=self.tenant_bar['id'],
+ user_id=self.user_two['id'],
+ role_id=self.role_other['id'])
+
def test_authenticate_bad_user(self):
self.assertRaises(AssertionError,
self.identity_api.authenticate,
--
1.8.4
|
GitWeb
