Skip to content

Commit ed241ef

Browse files
Samuel de Medeiros QueirozRaildo Mascena
Samuel de Medeiros Queiroz
authored and
Raildo Mascena
committed
Add support to inherited project role grant calls
Once inherited project role grant calls are implemented on python-keystoneclient, python-openstackclient also should support such calls. This patch add such support as well as its related tests. Co-Authored-By: Raildo Mascena <raildo@lsd.ufcg.edu.br> Change-Id: Id72670be8640e5c6e2490a6ef849e9ec3493b1a9 Implements: blueprint hierarchical-multitenancy
1 parent 3120a0b commit ed241ef

4 files changed

Lines changed: 62 additions & 0 deletions

File tree

‎doc/source/command-objects/role_assignment.rst‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ List role assignments
1919
[--domain <domain>]
2020
[--project <project>]
2121
[--effective]
22+
[--inherited]
2223
2324
.. option:: --role <role>
2425

@@ -43,3 +44,7 @@ List role assignments
4344
.. option:: --effective
4445

4546
Returns only effective role assignments (defaults to False)
47+
48+
.. option:: --inherited
49+
50+
Specifies if the role grant is inheritable to the sub projects

‎openstackclient/identity/common.py‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,3 +139,12 @@ def add_project_domain_option_to_parser(parser):
139139
'This can be used in case collisions between project names '
140140
'exist.')
141141
)
142+
143+
144+
def add_inherited_option_to_parser(parser):
145+
parser.add_argument(
146+
'--inherited',
147+
action='store_true',
148+
default=False,
149+
help=('Specifies if the role grant is inheritable to the sub projects')
150+
)

‎openstackclient/identity/v3/role.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ def _add_identity_and_resource_options_to_parser(parser):
5555
common.add_group_domain_option_to_parser(parser)
5656
common.add_project_domain_option_to_parser(parser)
5757
common.add_user_domain_option_to_parser(parser)
58+
common.add_inherited_option_to_parser(parser)
5859

5960

6061
def _process_identity_and_resource_options(parsed_args,
@@ -102,6 +103,7 @@ def _process_identity_and_resource_options(parsed_args,
102103
parsed_args.project,
103104
parsed_args.group_domain,
104105
).id
106+
kwargs['inherited'] = parsed_args.inherited
105107
return kwargs
106108

107109

‎openstackclient/tests/identity/v3/test_role.py‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,15 @@ def setUp(self):
4545
self.roles_mock = self.app.client_manager.identity.roles
4646
self.roles_mock.reset_mock()
4747

48+
def _is_inheritance_testcase(self):
49+
return False
50+
51+
52+
class TestRoleInherited(TestRole):
53+
54+
def _is_inheritance_testcase(self):
55+
return True
56+
4857

4958
class TestRoleAdd(TestRole):
5059

@@ -95,12 +104,15 @@ def test_role_add_user_domain(self):
95104
'--domain', identity_fakes.domain_name,
96105
identity_fakes.role_name,
97106
]
107+
if self._is_inheritance_testcase():
108+
arglist.append('--inherited')
98109
verifylist = [
99110
('user', identity_fakes.user_name),
100111
('group', None),
101112
('domain', identity_fakes.domain_name),
102113
('project', None),
103114
('role', identity_fakes.role_name),
115+
('inherited', self._is_inheritance_testcase()),
104116
]
105117
parsed_args = self.check_parser(self.cmd, arglist, verifylist)
106118

@@ -111,6 +123,7 @@ def test_role_add_user_domain(self):
111123
kwargs = {
112124
'user': identity_fakes.user_id,
113125
'domain': identity_fakes.domain_id,
126+
'inherited': self._is_inheritance_testcase(),
114127
}
115128
# RoleManager.grant(role, user=, group=, domain=, project=)
116129
self.roles_mock.grant.assert_called_with(
@@ -124,12 +137,15 @@ def test_role_add_user_project(self):
124137
'--project', identity_fakes.project_name,
125138
identity_fakes.role_name,
126139
]
140+
if self._is_inheritance_testcase():
141+
arglist.append('--inherited')
127142
verifylist = [
128143
('user', identity_fakes.user_name),
129144
('group', None),
130145
('domain', None),
131146
('project', identity_fakes.project_name),
132147
('role', identity_fakes.role_name),
148+
('inherited', self._is_inheritance_testcase()),
133149
]
134150
parsed_args = self.check_parser(self.cmd, arglist, verifylist)
135151

@@ -140,6 +156,7 @@ def test_role_add_user_project(self):
140156
kwargs = {
141157
'user': identity_fakes.user_id,
142158
'project': identity_fakes.project_id,
159+
'inherited': self._is_inheritance_testcase(),
143160
}
144161
# RoleManager.grant(role, user=, group=, domain=, project=)
145162
self.roles_mock.grant.assert_called_with(
@@ -153,12 +170,15 @@ def test_role_add_group_domain(self):
153170
'--domain', identity_fakes.domain_name,
154171
identity_fakes.role_name,
155172
]
173+
if self._is_inheritance_testcase():
174+
arglist.append('--inherited')
156175
verifylist = [
157176
('user', None),
158177
('group', identity_fakes.group_name),
159178
('domain', identity_fakes.domain_name),
160179
('project', None),
161180
('role', identity_fakes.role_name),
181+
('inherited', self._is_inheritance_testcase()),
162182
]
163183
parsed_args = self.check_parser(self.cmd, arglist, verifylist)
164184

@@ -169,6 +189,7 @@ def test_role_add_group_domain(self):
169189
kwargs = {
170190
'group': identity_fakes.group_id,
171191
'domain': identity_fakes.domain_id,
192+
'inherited': self._is_inheritance_testcase(),
172193
}
173194
# RoleManager.grant(role, user=, group=, domain=, project=)
174195
self.roles_mock.grant.assert_called_with(
@@ -182,12 +203,15 @@ def test_role_add_group_project(self):
182203
'--project', identity_fakes.project_name,
183204
identity_fakes.role_name,
184205
]
206+
if self._is_inheritance_testcase():
207+
arglist.append('--inherited')
185208
verifylist = [
186209
('user', None),
187210
('group', identity_fakes.group_name),
188211
('domain', None),
189212
('project', identity_fakes.project_name),
190213
('role', identity_fakes.role_name),
214+
('inherited', self._is_inheritance_testcase()),
191215
]
192216
parsed_args = self.check_parser(self.cmd, arglist, verifylist)
193217

@@ -198,6 +222,7 @@ def test_role_add_group_project(self):
198222
kwargs = {
199223
'group': identity_fakes.group_id,
200224
'project': identity_fakes.project_id,
225+
'inherited': self._is_inheritance_testcase(),
201226
}
202227
# RoleManager.grant(role, user=, group=, domain=, project=)
203228
self.roles_mock.grant.assert_called_with(
@@ -206,6 +231,10 @@ def test_role_add_group_project(self):
206231
)
207232

208233

234+
class TestRoleAddInherited(TestRoleAdd, TestRoleInherited):
235+
pass
236+
237+
209238
class TestRoleCreate(TestRole):
210239

211240
def setUp(self):
@@ -550,12 +579,15 @@ def test_role_remove_user_domain(self):
550579
'--domain', identity_fakes.domain_name,
551580
identity_fakes.role_name,
552581
]
582+
if self._is_inheritance_testcase():
583+
arglist.append('--inherited')
553584
verifylist = [
554585
('user', identity_fakes.user_name),
555586
('group', None),
556587
('domain', identity_fakes.domain_name),
557588
('project', None),
558589
('role', identity_fakes.role_name),
590+
('inherited', self._is_inheritance_testcase()),
559591
]
560592
parsed_args = self.check_parser(self.cmd, arglist, verifylist)
561593

@@ -566,6 +598,7 @@ def test_role_remove_user_domain(self):
566598
kwargs = {
567599
'user': identity_fakes.user_id,
568600
'domain': identity_fakes.domain_id,
601+
'inherited': self._is_inheritance_testcase(),
569602
}
570603
# RoleManager.revoke(role, user=, group=, domain=, project=)
571604
self.roles_mock.revoke.assert_called_with(
@@ -579,12 +612,15 @@ def test_role_remove_user_project(self):
579612
'--project', identity_fakes.project_name,
580613
identity_fakes.role_name,
581614
]
615+
if self._is_inheritance_testcase():
616+
arglist.append('--inherited')
582617
verifylist = [
583618
('user', identity_fakes.user_name),
584619
('group', None),
585620
('domain', None),
586621
('project', identity_fakes.project_name),
587622
('role', identity_fakes.role_name),
623+
('inherited', self._is_inheritance_testcase()),
588624
]
589625
parsed_args = self.check_parser(self.cmd, arglist, verifylist)
590626

@@ -595,6 +631,7 @@ def test_role_remove_user_project(self):
595631
kwargs = {
596632
'user': identity_fakes.user_id,
597633
'project': identity_fakes.project_id,
634+
'inherited': self._is_inheritance_testcase(),
598635
}
599636
# RoleManager.revoke(role, user=, group=, domain=, project=)
600637
self.roles_mock.revoke.assert_called_with(
@@ -608,12 +645,16 @@ def test_role_remove_group_domain(self):
608645
'--domain', identity_fakes.domain_name,
609646
identity_fakes.role_name,
610647
]
648+
if self._is_inheritance_testcase():
649+
arglist.append('--inherited')
611650
verifylist = [
612651
('user', None),
613652
('group', identity_fakes.group_name),
614653
('domain', identity_fakes.domain_name),
615654
('project', None),
616655
('role', identity_fakes.role_name),
656+
('role', identity_fakes.role_name),
657+
('inherited', self._is_inheritance_testcase()),
617658
]
618659
parsed_args = self.check_parser(self.cmd, arglist, verifylist)
619660

@@ -624,6 +665,7 @@ def test_role_remove_group_domain(self):
624665
kwargs = {
625666
'group': identity_fakes.group_id,
626667
'domain': identity_fakes.domain_id,
668+
'inherited': self._is_inheritance_testcase(),
627669
}
628670
# RoleManager.revoke(role, user=, group=, domain=, project=)
629671
self.roles_mock.revoke.assert_called_with(
@@ -637,12 +679,15 @@ def test_role_remove_group_project(self):
637679
'--project', identity_fakes.project_name,
638680
identity_fakes.role_name,
639681
]
682+
if self._is_inheritance_testcase():
683+
arglist.append('--inherited')
640684
verifylist = [
641685
('user', None),
642686
('group', identity_fakes.group_name),
643687
('domain', None),
644688
('project', identity_fakes.project_name),
645689
('role', identity_fakes.role_name),
690+
('inherited', self._is_inheritance_testcase()),
646691
]
647692
parsed_args = self.check_parser(self.cmd, arglist, verifylist)
648693

@@ -653,6 +698,7 @@ def test_role_remove_group_project(self):
653698
kwargs = {
654699
'group': identity_fakes.group_id,
655700
'project': identity_fakes.project_id,
701+
'inherited': self._is_inheritance_testcase(),
656702
}
657703
# RoleManager.revoke(role, user=, group=, domain=, project=)
658704
self.roles_mock.revoke.assert_called_with(

0 commit comments

Comments
 (0)