[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Openstack-security] [Bug 1842930] Re: Deleted user still can delete volumes in Horizon

Added Keystonemiddleware and documentation tags. Marked as "medium"
importance as it requires documentation changes but is not
critical/RC/otherwise impacting. Clear communication of expected
behavior is important and should be found in Horizon and
Keystonemiddleware's documentation.

I am marking invalid for Keystone itself as keystone will invalidate
it's internal cache (barring cases such as in-memory [not production
quality] dict-base cache).

** Tags added: documentation

** Also affects: keystonemiddleware
   Importance: Undecided
       Status: New

** Changed in: keystone
       Status: New => Confirmed

** Changed in: keystonemiddleware
       Status: New => Triaged

** Changed in: keystone
       Status: Confirmed => Triaged

** Changed in: keystone
   Importance: Undecided => Medium

** Changed in: keystonemiddleware
   Importance: Undecided => Medium

** Changed in: keystone
       Status: Triaged => Invalid

You received this bug notification because you are a member of OpenStack
Security SIG, which is subscribed to OpenStack.

  Deleted user still can delete volumes in Horizon

Status in OpenStack Dashboard (Horizon):
Status in OpenStack Identity (keystone):
Status in keystonemiddleware:
Status in OpenStack Security Advisory:
  Won't Fix

Bug description:
  User session in a second browser is not terminated after deleting this user by admin from another browser. User is still able to manage some objects (delete volumes, for example) in a project after being deleted by admin.

  ==Steps to reproduce==
  Install OpenStack following official docs for Stein.
  Login as admin to (Horizon) in one browser.
  Create a user with role 'member' and assign it to a project.
  Open another browser and login as created user.
  As admin user delete created user from "first" browser.
  Switch to the "second" browser and try to browse through different sections in the dashboard as deleted user -> instances are not shown, but deleted user can list images, volumes, networks. Also this deleted user can delete a volume.

  ==Expected result==
  User session in current browser is closed after user is deleted in another browser.
  I tried this in Newton release and it works as expected (for a short time before session is ended, this deleted user can't list object in instances,volumes).

  OpenStack Stein
  rpm -qa | grep -i stein

  cat /etc/redhat-release
  CentOS Linux release 7.6.1810 (Core)

   rpm -qa | grep -i horizon

  rpm -qa | grep -i dashboard

To manage notifications about this bug go to: