Skip to content

Commit 18f39bf

Browse files
author
Jamie Lennox
committed
Remove the default project from all users
The default project means that a user gains token scoping information for a project if they don't specify another. This is something we want to discourage for user creation. User's should specify there own authentication scope when they authenticate. Change-Id: I42c3060d59edfcd44d04cd166bad500419dd99bc
1 parent c2999d1 commit 18f39bf

15 files changed

Lines changed: 26 additions & 43 deletions

File tree

‎extras.d/70-tuskar.sh‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -180,8 +180,7 @@ function create_tuskar_accounts {
180180
local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
181181
local admin_role=$(openstack role list | awk "/ admin / { print \$2 }")
182182

183-
local tuskar_user=$(get_or_create_user "tuskar" \
184-
"$SERVICE_PASSWORD" $service_tenant)
183+
local tuskar_user=$(get_or_create_user "tuskar" "$SERVICE_PASSWORD")
185184
get_or_add_user_role $admin_role $tuskar_user $service_tenant
186185

187186
if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then

‎functions-common‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -860,17 +860,17 @@ function get_or_create_group {
860860
}
861861

862862
# Gets or creates user
863-
# Usage: get_or_create_user <username> <password> <project> [<email> [<domain>]]
863+
# Usage: get_or_create_user <username> <password> [<email> [<domain>]]
864864
function get_or_create_user {
865-
if [[ ! -z "$4" ]]; then
866-
local email="--email=$4"
865+
if [[ ! -z "$3" ]]; then
866+
local email="--email=$3"
867867
else
868868
local email=""
869869
fi
870870
local os_cmd="openstack"
871871
local domain=""
872-
if [[ ! -z "$5" ]]; then
873-
domain="--domain=$5"
872+
if [[ ! -z "$4" ]]; then
873+
domain="--domain=$4"
874874
os_cmd="$os_cmd --os-url=$KEYSTONE_SERVICE_URI_V3 --os-identity-api-version=3"
875875
fi
876876
# Gets user id
@@ -879,7 +879,6 @@ function get_or_create_user {
879879
$os_cmd user create \
880880
$1 \
881881
--password "$2" \
882-
--project $3 \
883882
$email \
884883
$domain \
885884
--or-show \

‎lib/ceilometer‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,8 +110,7 @@ function create_ceilometer_accounts {
110110

111111
# Ceilometer
112112
if [[ "$ENABLED_SERVICES" =~ "ceilometer-api" ]]; then
113-
local ceilometer_user=$(get_or_create_user "ceilometer" \
114-
"$SERVICE_PASSWORD" $service_tenant)
113+
local ceilometer_user=$(get_or_create_user "ceilometer" "$SERVICE_PASSWORD")
115114
get_or_add_user_role $admin_role $ceilometer_user $service_tenant
116115

117116
if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then

‎lib/cinder‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -348,8 +348,7 @@ function create_cinder_accounts {
348348
# Cinder
349349
if [[ "$ENABLED_SERVICES" =~ "c-api" ]]; then
350350

351-
local cinder_user=$(get_or_create_user "cinder" \
352-
"$SERVICE_PASSWORD" $service_tenant)
351+
local cinder_user=$(get_or_create_user "cinder" "$SERVICE_PASSWORD")
353352
get_or_add_user_role $admin_role $cinder_user $service_tenant
354353

355354
if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then

‎lib/glance‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -232,15 +232,14 @@ function configure_glance {
232232
function create_glance_accounts {
233233
if is_service_enabled g-api; then
234234

235-
local glance_user=$(get_or_create_user "glance" \
236-
"$SERVICE_PASSWORD" $SERVICE_TENANT_NAME)
235+
local glance_user=$(get_or_create_user "glance" "$SERVICE_PASSWORD")
237236
get_or_add_user_role service $glance_user $SERVICE_TENANT_NAME
238237

239238
# required for swift access
240239
if is_service_enabled s-proxy; then
241240

242241
local glance_swift_user=$(get_or_create_user "glance-swift" \
243-
"$SERVICE_PASSWORD" $SERVICE_TENANT_NAME "[email protected]")
242+
"$SERVICE_PASSWORD" "[email protected]")
244243
get_or_add_user_role "ResellerAdmin" $glance_swift_user $SERVICE_TENANT_NAME
245244
fi
246245

‎lib/heat‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -243,8 +243,7 @@ function create_heat_accounts {
243243
local service_tenant=$(openstack project list | awk "/ $SERVICE_TENANT_NAME / { print \$2 }")
244244
local admin_role=$(openstack role list | awk "/ admin / { print \$2 }")
245245

246-
local heat_user=$(get_or_create_user "heat" \
247-
"$SERVICE_PASSWORD" $service_tenant)
246+
local heat_user=$(get_or_create_user "heat" "$SERVICE_PASSWORD")
248247
get_or_add_user_role $admin_role $heat_user $service_tenant
249248

250249
if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then

‎lib/ironic‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -365,8 +365,7 @@ function create_ironic_accounts {
365365
if [[ "$ENABLED_SERVICES" =~ "ir-api" ]]; then
366366
# Get ironic user if exists
367367

368-
local ironic_user=$(get_or_create_user "ironic" \
369-
"$SERVICE_PASSWORD" $service_tenant)
368+
local ironic_user=$(get_or_create_user "ironic" "$SERVICE_PASSWORD")
370369
get_or_add_user_role $admin_role $ironic_user $service_tenant
371370

372371
if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then

‎lib/keystone‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -362,8 +362,7 @@ function create_keystone_accounts {
362362

363363
# admin
364364
local admin_tenant=$(get_or_create_project "admin")
365-
local admin_user=$(get_or_create_user "admin" \
366-
"$ADMIN_PASSWORD" "$admin_tenant")
365+
local admin_user=$(get_or_create_user "admin" "$ADMIN_PASSWORD")
367366
local admin_role=$(get_or_create_role "admin")
368367
get_or_add_user_role $admin_role $admin_user $admin_tenant
369368

@@ -392,7 +391,7 @@ function create_keystone_accounts {
392391
# demo
393392
local demo_tenant=$(get_or_create_project "demo")
394393
local demo_user=$(get_or_create_user "demo" \
395-
"$ADMIN_PASSWORD" "$demo_tenant" "[email protected]")
394+
"$ADMIN_PASSWORD" "[email protected]")
396395

397396
get_or_add_user_role $member_role $demo_user $demo_tenant
398397
get_or_add_user_role $admin_role $admin_user $demo_tenant

‎lib/neutron‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -513,8 +513,7 @@ function create_neutron_accounts {
513513

514514
if [[ "$ENABLED_SERVICES" =~ "q-svc" ]]; then
515515

516-
local neutron_user=$(get_or_create_user "neutron" \
517-
"$SERVICE_PASSWORD" $service_tenant)
516+
local neutron_user=$(get_or_create_user "neutron" "$SERVICE_PASSWORD")
518517
get_or_add_user_role $service_role $neutron_user $service_tenant
519518

520519
if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then

‎lib/nova‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -359,8 +359,7 @@ function create_nova_accounts {
359359
# Nova
360360
if [[ "$ENABLED_SERVICES" =~ "n-api" ]]; then
361361

362-
local nova_user=$(get_or_create_user "nova" \
363-
"$SERVICE_PASSWORD" $service_tenant)
362+
local nova_user=$(get_or_create_user "nova" "$SERVICE_PASSWORD")
364363
get_or_add_user_role $admin_role $nova_user $service_tenant
365364

366365
if [[ "$KEYSTONE_CATALOG_BACKEND" = 'sql' ]]; then

0 commit comments

Comments
 (0)