tree 0f85a812de79f1092ece6d3ab9a30e5ac4572829
parent 1f2ba24f4df09ba3711aa520bdf1bedb63e7797a
author Felipe Monteiro <felipe.monteiro@att.com> 1521600179 +0000
committer Felipe Monteiro <felipe.monteiro@att.com> 1526941596 +0000

Update rbac_rule_validation for multi-policy support

Introduces foundational logic needed for multi-policy support
to rbac_rule_validation module. Patrole now offers support for
multiple policies. The ``rules`` argument has been added to the
``rbac_rule_validation.action`` decorator, which takes a list of
policy names which Patrole will use to determine the expected test
result. This allows Patrole to more accurately determine
whether RBAC is configured correctly, since some API endpoints
enforce multiple policies.

The new ``rules`` argument is implemented for
test_unlock_server_override test which corresponds to [0]
which enforces:

    rules=["os_compute_api:os-lock-server:unlock:unlock",
           "os_compute_api:os-lock-server:unlock:unlock_override"]

which is set for this test.

The ``rule`` argument in the ``rbac_rule_validation.action``
decorator has been deprecated in favor of ``rules``.

The following will be carried out in additional follow up patches:

  * Renaming rule to rules
  * Adding multi-policy support carefully for selected APIs
    to be tracked via an etherpad
  * Updating Patrole documentation with multi-policy support
    details

[0] https://github.com/openstack/nova/blob/0ab78890c155f0b6ffc7c4148b26642f47aa7070/nova/api/openstack/compute/lock_server.py#L42

Partially Implements: bp rbac-testing-multiple-policies
Change-Id: Iec651aff1c1ef6acda19bcad2f57720f1dd3f8a0