RBAC Authority Module

RBAC Authority Module

Overview

This module implements an abstract class that is implemented by the classes below. Each implementation is used by the RBAC Rule Validation Module framework to determine each expected test result.

Policy Authority Module

The default RbacAuthority implementation class which is used for policy validation. Uses oslo.policy to determine the expected test result.

All Patrole Zuul gates use this RbacAuthority class by default.

Requirements Authority Module

Optional RbacAuthority implementation class which is used for policy validation. It uses a high-level requirements-driven approach to validating RBAC in Patrole.

Implementation

class patrole_tempest_plugin.rbac_authority.RbacAuthority[source]

Class for validating whether a given role can perform a policy action.

Any class that extends RbacAuthority provides the logic for determining whether a role has permissions to execute a policy action.

allowed(rule, role)[source]

Determine whether the role should be able to perform the API.

Parameters:
  • rule – The name of the policy enforced by the API.
  • role – The role used to determine whether rule can be executed.
Returns:

True if the role has permissions to execute rule, else False.

Creative Commons Attribution 3.0 License

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.