Merge "Add ACL check using <tenant_id>:<user> format."

2 files changed, 10 insertions, 4 deletions

diff --git a/keystone/middleware/swift_auth.py b/keystone/middleware/swift_auth.py
index d4be9f1f..798094cd 100644
--- a/keystone/middleware/swift_auth.py
+++ b/keystone/middleware/swift_auth.py
@@ -207,9 +207,11 @@ class SwiftAuth(object):
             return self.denied_response(req)
 
         # Allow ACL at individual user level (tenant:user format)
-        if '%s:%s' % (tenant_name, user) in roles:
-            log_msg = 'user %s:%s allowed in ACL authorizing'
-            self.logger.debug(log_msg % (tenant_name, user))
+        # For backward compatibility, check for ACL in tenant_id:user format
+        if ('%s:%s' % (tenant_name, user) in roles
+             or '%s:%s' % (tenant_id, user) in roles):
+            log_msg = 'user %s:%s or %s:%s allowed in ACL authorizing'
+            self.logger.debug(log_msg % (tenant_name, user, tenant_id, user))
             return
 
         # Check if we have the role in the userroles and allow it
diff --git a/tests/test_swift_auth_middleware.py b/tests/test_swift_auth_middleware.py
index afad9744..a5a0d674 100644
--- a/tests/test_swift_auth_middleware.py
+++ b/tests/test_swift_auth_middleware.py
@@ -235,11 +235,15 @@ class TestAuthorize(unittest.TestCase):
         identity = self._get_identity(roles=[acl])
         self._check_authenticate(identity=identity, acl=acl)
 
-    def test_authorize_succeeds_for_tenant_user_in_roles(self):
+    def test_authorize_succeeds_for_tenant_name_user_in_roles(self):
         identity = self._get_identity()
         acl = '%s:%s' % (identity['tenant'][1], identity['user'])
         self._check_authenticate(identity=identity, acl=acl)
 
+    def test_authorize_succeeds_for_tenant_id_user_in_roles(self):
+        identity = self._get_identity()
+        acl = '%s:%s' % (identity['tenant'][0], identity['user'])
+        self._check_authenticate(identity=identity, acl=acl)
 
 if __name__ == '__main__':
     unittest.main()