Story #8074: As an admin I can still have rbac enabled with token_auth disabled - Container Support - Pulp

Actions

Send by e-mail Copy link

Story #8074

closed

As an admin I can still have rbac enabled with token_auth disabled

Added by ipanova@redhat.com over 3 years ago. Updated about 3 years ago.

Status:

CLOSED - CURRENTRELEASE

Priority:

Normal

Assignee:

mdellweg

Sprint/Milestone:

2.4.0

Start date:

Due date:

% Done:

100%

Estimated time:

Platform Release:

Groomed:

Sprint Candidate:

Tags:

GalaxyNG

Sprint:

Sprint 90

Quarter:

Description

Extend logic of rbac to work with the token_auth disabled.

In this case, only admin will have the right to perform push operations. Pull operations will be opened to (1) any user, including anonymous or (2) to any valid user (TBD)

Actions

Copy link

Updated by ipanova@redhat.com over 3 years ago

Sprint/Milestone set to 2.3.0

Actions

Copy link

Updated by ipanova@redhat.com about 3 years ago

Sprint/Milestone changed from 2.3.0 to 2.4.0

Actions

Copy link

Updated by ipanova@redhat.com about 3 years ago

(pulp) [vagrant@pulp3-source-fedora32 docs]$ pjournal 
-- Logs begin at Fri 2020-11-20 12:00:41 UTC. --
Feb 08 12:12:42 pulp3-source-fedora32.fluffy.example.com gunicorn[703259]:   File "/usr/local/lib/pulp/lib64/python3.8/site-packages/django_lifecycle/decorators.py", line 69, in func
Feb 08 12:12:42 pulp3-source-fedora32.fluffy.example.com gunicorn[703259]:     hooked_method(*args, **kwargs)
Feb 08 12:12:42 pulp3-source-fedora32.fluffy.example.com gunicorn[703259]:   File "/home/vagrant/devel/pulpcore/pulpcore/app/models/access_policy.py", line 72, in add_perms
Feb 08 12:12:42 pulp3-source-fedora32.fluffy.example.com gunicorn[703259]:     self._handle_permissions_assignments(access_policy)
Feb 08 12:12:42 pulp3-source-fedora32.fluffy.example.com gunicorn[703259]:   File "/home/vagrant/devel/pulpcore/pulpcore/app/models/access_policy.py", line 77, in _handle_permissions_assignments
Feb 08 12:12:42 pulp3-source-fedora32.fluffy.example.com gunicorn[703259]:     callable(permission_assignment["permissions"], permission_assignment["parameters"])
Feb 08 12:12:42 pulp3-source-fedora32.fluffy.example.com gunicorn[703259]:   File "/home/vagrant/devel/pulp_container/pulp_container/app/models.py", line 233, in create_namespace_group
Feb 08 12:12:42 pulp3-source-fedora32.fluffy.example.com gunicorn[703259]:     current_user.groups.add(group)
Feb 08 12:12:42 pulp3-source-fedora32.fluffy.example.com gunicorn[703259]: AttributeError: 'NoneType' object has no attribute 'groups'
Feb 08 12:12:42 pulp3-source-fedora32.fluffy.example.com gunicorn[703259]: 127.0.0.1 - - [08/Feb/2021:12:12:42 +0000] "POST /v2/lukas1/that/blobs/uploads/ HTTP/1.1" 500 27 "-" "libpod/2.2.1"

Currently it's impossible to push with admin credentials with token_auth disabled and rbac enabled.

Actions

Copy link