tree d757fcb089c63b21c7fffd8db1f8fc94c6f6e942
parent 556094d276d79b7f320e5557aee93d7f029a1363
author Felipe Monteiro <felipe.monteiro@att.com> 1530228779 -0400
committer Felipe Monteiro <felipe.monteiro@att.com> 1530247893 +0000

Update overpermission/underpermission rbac exceptions

This patchset updates rbac_exceptions by bringing the concept
of under-permission and over-permission together. An over-permission
occurs when an unauthorized role is allowed to perform an action
and an under-permission occurs when an authorized role is not
allowed to perform an action. Both of these are important failure
scenarios.

Current Patrole has an RbacOverPermission Exception but uses
a "Forbidden" as a pseudonym for the under-permission version
but this is not ideal for the following reasons:

* Patrole can expect a 404 Not Found due to Neutron policy enforcement [0]
* The naming is inconsistent with RbacOverPermission
* It should have a Patrole wrapper exception (NotFound is used directly
  from Tempest)

So, this patchset:

* renames RbacOverPermission to RbacOverPermissionException
* replaces Forbidden exception with RbacUnderPermissionException
* updates documentation, docstrings and unit tests

In addition, this patchset introduces a new exception called
RbacExpectedWrongException which is raised when the expected
exception does not match the actual exception and both are instances
of 403 and 404, which means that the RBAC test uses the wrong
expected_error_codes.

Change-Id: I681610448cbe0269f02c34ea6afaaaf29c306121