RBAC Rule Validation Module

RBAC Rule Validation Module

Overview

Module that implements the decorator which serves as the entry point for RBAC validation testing. The decorator should be applied to every RBAC test with the appropriate service (OpenStack service) and rule (OpenStack policy name defined by the service).

Implementation

patrole_tempest_plugin.rbac_rule_validation._format_extra_target_data(test_obj, extra_target_data)[source]

Formats the “extra_target_data” dictionary with correct test data.

Before being formatted, “extra_target_data” is a dictionary that maps a policy string like “trust.trustor_user_id” to a nested list of tempest.test.BaseTestCase attributes. For example, the attribute list in:

"trust.trustor_user_id": "os.auth_provider.credentials.user_id"

is parsed by iteratively calling getattr until the value of “user_id” is resolved. The resulting dictionary returns:

"trust.trustor_user_id": "the user_id of the `os_primary` credential"
Parameters:
  • test_obj – An instance or subclass of tempest.test.BaseTestCase.
  • extra_target_data – Dictionary, keyed with oslo.policy generic check names, whose values are string literals that reference nested tempest.test.BaseTestCase attributes. Used by oslo.policy for performing matching against attributes that are sent along with the API calls.
Returns:

Dictionary containing additional object data needed by oslo.policy to validate generic checks.

patrole_tempest_plugin.rbac_rule_validation._get_exception_type(expected_error_code=403)[source]

Dynamically calculate the expected exception to be caught.

Dynamically calculate the expected exception to be caught by the test case. Only Forbidden and NotFound exceptions are permitted. NotFound is supported because Neutron, for security reasons, masks Forbidden exceptions as NotFound exceptions.

Parameters:expected_error_code – the integer representation of the expected exception to be caught. Must be contained in _SUPPORTED_ERROR_CODES.
Returns:tuple of the exception type corresponding to expected_error_code and a message explaining that a non-Forbidden exception was expected, if applicable.
patrole_tempest_plugin.rbac_rule_validation._is_authorized(test_obj, service, rule, extra_target_data, admin_only)[source]

Validates whether current RBAC role has permission to do policy action.

Parameters:
  • test_obj – An instance or subclass of tempest.test.BaseTestCase.
  • service – The OpenStack service that enforces rule.
  • rule – The name of the policy action. Examples include “identity:create_user” or “os_compute_api:os-agents”.
  • extra_target_data – Dictionary, keyed with oslo.policy generic check names, whose values are string literals that reference nested tempest.test.BaseTestCase attributes. Used by oslo.policy for performing matching against attributes that are sent along with the API calls.
  • admin_only – Skips over oslo.policy check because the policy action defined by rule is not enforced by the service’s policy enforcement engine. For example, Keystone v2 performs an admin check for most of its endpoints. If True, rule is effectively ignored.
Returns:

True if the current RBAC role can perform the policy action, else False.

Raises:
  • RbacResourceSetupFailed – If project_id or user_id are missing from the auth_provider attribute in test_obj.
  • RbacParsingException – if [patrole] strict_policy_check is True and the rule does not exist in the system.
  • skipException – If [patrole] strict_policy_check is False and the rule does not exist in the system.
patrole_tempest_plugin.rbac_rule_validation.action(service, rule='', admin_only=False, expected_error_code=403, extra_target_data=None)[source]

A decorator for verifying OpenStack policy enforcement.

A decorator which allows for positive and negative RBAC testing. Given:

  • an OpenStack service,
  • a policy action (rule) enforced by that service, and
  • the test role defined by [patrole] rbac_test_role

determines whether the test role has sufficient permissions to perform an API call that enforces the rule.

This decorator should only be applied to an instance or subclass of tempest.test.BaseTestCase.

The result from _is_authorized is used to determine the expected test result. The actual test result is determined by running the Tempest test this decorator applies to.

Below are the following possibilities from comparing the expected and actual results:

  1. If expected is True and the test passes (actual), this is a success.
  2. If expected is True and the test fails (actual), this results in a Forbidden exception failure.
  3. If expected is False and the test passes (actual), this results in an OverPermission exception failure.
  4. If expected is False and the test fails (actual), this is a success.

As such, negative and positive testing can be applied using this decorator.

Parameters:
  • service – An OpenStack service. Examples: “nova” or “neutron”.
  • rule

    A policy action defined in a policy.json file (or in code).

    Note

    Patrole currently only supports custom JSON policy files.

  • admin_only – Skips over oslo.policy check because the policy action defined by rule is not enforced by the service’s policy enforcement engine. For example, Keystone v2 performs an admin check for most of its endpoints. If True, rule is effectively ignored.
  • expected_error_code

    Overrides default value of 403 (Forbidden) with endpoint-specific error code. Currently only supports 403 and 404. Support for 404 is needed because some services, like Neutron, intentionally throw a 404 for security reasons.

    Warning

    A 404 should not be provided unless the endpoint masks a Forbidden exception as a NotFound exception.

  • extra_target_data

    Dictionary, keyed with oslo.policy generic check names, whose values are string literals that reference nested tempest.test.BaseTestCase attributes. Used by oslo.policy for performing matching against attributes that are sent along with the API calls. Example:

    extra_target_data={
        "target.token.user_id":
        "os_alt.auth_provider.credentials.user_id"
    })
    
Raises:
  • NotFound – If service is invalid.
  • Forbidden – For item (2) above.
  • RbacOverPermission – For item (3) above.

Examples:

@rbac_rule_validation.action(
    service="nova", rule="os_compute_api:os-agents")
def test_list_agents_rbac(self):
    # The call to `switch_role` is mandatory.
    self.rbac_utils.switch_role(self, toggle_rbac_role=True)
    self.agents_client.list_agents()
Creative Commons Attribution 3.0 License

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.