opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-19 10:46:58 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(keystone): allow joint projects across domains by default

Browse Source
This commit is contained in:
Qiu Jian
2021-03-18 23:56:36 +08:00
parent 40644f73b8
commit bf1aed7a14
2 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/keystone/models/assignments.go
+8 -7
View File
@@ -29,7 +29,6 @@ import (
"yunion.io/x/onecloud/pkg/appsrv"
"yunion.io/x/onecloud/pkg/cloudcommon/db"
"yunion.io/x/onecloud/pkg/httperrors"
"yunion.io/x/onecloud/pkg/keystone/options"
"yunion.io/x/onecloud/pkg/mcclient"
"yunion.io/x/onecloud/pkg/mcclient/auth"
"yunion.io/x/onecloud/pkg/util/rbacutils"
@@ -249,9 +248,10 @@ func (manager *SAssignmentManager) ProjectAddUser(ctx context.Context, userCred
return err
}
if project.DomainId != user.DomainId {
if project.DomainId != api.DEFAULT_DOMAIN_ID && !options.Options.AllowJoinProjectsAcrossDomains {
return httperrors.NewInputParameterError("join user into project of default domain or identical domain")
} else if !db.IsAllowPerform(rbacutils.ScopeSystem, userCred, user, "join-project") {
// if project.DomainId != api.DEFAULT_DOMAIN_ID && !options.Options.AllowJoinProjectsAcrossDomains {
// return httperrors.NewInputParameterError("join user into project of default domain or identical domain")
// } else
if !db.IsAllowPerform(rbacutils.ScopeSystem, userCred, user, "join-project") {
return httperrors.NewForbiddenError("not enough privilege")
}
} else {
@@ -349,9 +349,10 @@ func (manager *SAssignmentManager) projectAddGroup(ctx context.Context, userCred
return err
}
if project.DomainId != group.DomainId {
if project.DomainId != api.DEFAULT_DOMAIN_ID && !options.Options.AllowJoinProjectsAcrossDomains {
return httperrors.NewInputParameterError("join group into project of default domain or identical domain")
} else if !db.IsAllowPerform(rbacutils.ScopeSystem, userCred, group, "join-project") {
// if project.DomainId != api.DEFAULT_DOMAIN_ID && !options.Options.AllowJoinProjectsAcrossDomains {
// return httperrors.NewInputParameterError("join group into project of default domain or identical domain")
// } else
if !db.IsAllowPerform(rbacutils.ScopeSystem, userCred, group, "join-project") {
return httperrors.NewForbiddenError("not enough privilege")
}
} else {
pkg/keystone/options/options.go
+1 -1
View File
@@ -53,7 +53,7 @@ type SKeystoneOptions struct {
SessionEndpointType string `help:"Client session end point type"`
AllowJoinProjectsAcrossDomains bool `help:"allow users/groups to join projects across domains" default:"false"`
// AllowJoinProjectsAcrossDomains bool `help:"allow users/groups to join projects across domains" default:"false"`
DefaultUserLanguage string `help:"default user language, default to zh-CN" default:"zh-CN"`