Bug 1042158

Summary:	[RFE][heat]: Improve request scoping based on policy/context
Product:	Red Hat OpenStack	Reporter:	RHOS Integration <rhos-integ>
Component:	openstack-heat	Assignee:	RHOS Maint <rhos-maint>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Amit Ugol <augol>
Severity:	high	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	ajeain, breeler, markmc, sbaker, sdake, shardy, yeylon
Target Milestone:	ga	Keywords:	FutureFeature
Target Release:	5.0 (RHEL 7)
Hardware:	Unspecified
OS:	Unspecified
URL:	https://blueprints.launchpad.net/heat/+spec/request-scoping-policy
Whiteboard:	upstream_milestone_icehouse-3 upstream_status_implemented upstream_definition_approved
Fixed In Version:		Doc Type:	Enhancement
Doc Text:	This enhancement supports better security policy control. It is required because providing a secure environment for the Orchestration runtime is essential. Now, users can customize the security policies used by Orchestration.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-07-22 19:09:00 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:

Description RHOS Integration 2013-12-12 21:13:57 UTC

Cloned from launchpad blueprint https://blueprints.launchpad.net/heat/+spec/request-scoping-policy.

Description:

Currently there are several issues related to request scoping and policy in Heat:
- The ReST API can't be controlled via policy.json
- The default request scope (DB filter) is always per tenant, but in theory we support the owner_is_tenant option, where if set to False the scope should be per-user not per tenant
- We don't respect policy based admin-ness, is_admin in the context is always ignored, so there's no way to potentially provide project admins access to management-api functionality (on a per-project basis)

We should overhaul our handling of policy so it's more consistent and comprehensive, then deployers will have much more control when specifying site-specific RBAC policies.

Specification URL (additional information):

None