Add "member" role to admin project member users
In some tests where we'd like to test role based
access control, and specifically the impact of user
roles (admin vs member vs reader), we create a user
on the fly and assign the necessary roles to this
user.
Recently devstack stopped setting a tempest conf
option that gave us a default role to assign to
regular non-privileged "member" users. [1].
This made the tests that used such users fail
with "401 Unauthenticated" errors.
So we'll need to explicitly request this regular
user role (aka "member") even when not configured
in tempest.conf.
[1] https://review.opendev.org/774524
Change-Id: I103ccda367123bc2429d1d840c0201b01ac61b4d
Signed-off-by: Goutham Pacha Ravi <gouthampravi@gmail.com>
diff --git a/manila_tempest_tests/tests/api/base.py b/manila_tempest_tests/tests/api/base.py
index 2310591..fd8f533 100755
--- a/manila_tempest_tests/tests/api/base.py
+++ b/manila_tempest_tests/tests/api/base.py
@@ -1262,7 +1262,8 @@
cls.os_admin.domains_client = (
cls.os_admin.identity_v3.DomainsClient() if
CONF.identity.auth_version == 'v3' else None)
- cls.admin_project_member_client = cls.create_user_and_get_client()
+ cls.admin_project_member_client = cls.create_user_and_get_client(
+ project=cls.admin_project, add_member_role=True)
if CONF.share.multitenancy_enabled:
admin_share_network_id = cls.provide_share_network(
@@ -1277,7 +1278,7 @@
cls.alt_shares_v2_client.share_network_id = alt_share_network_id
@classmethod
- def create_user_and_get_client(cls, project=None):
+ def create_user_and_get_client(cls, project=None, add_member_role=True):
"""Create a user in specified project & set share clients for user
The user will have all roles specified in tempest.conf
@@ -1302,9 +1303,12 @@
username, password, project, email)
cls.class_project_users_created.append(user)
- for conf_role in CONF.auth.tempest_roles:
- cls.os_admin.creds_client.assign_user_role(
- user, project, conf_role)
+ tempest_roles_to_assign = CONF.auth.tempest_roles or []
+ if "member" not in tempest_roles_to_assign and add_member_role:
+ tempest_roles_to_assign.append("member")
+
+ for role in tempest_roles_to_assign:
+ cls.os_admin.creds_client.assign_user_role(user, project, role)
user_creds = cls.os_admin.creds_client.get_credentials(
user, project, password)