Fix target used in nova.policy.check_is_admin

The target passed to Enforcer.authorize should be a dict,
similar to the target dict to the RequestContext.can method.
However, we were passing an instance of _DeprecatedPolicyValues
because that is ultimately what comes out of
RequestContext.to_policy_values(). As of change
I4642c57990b145c0e691140970574412682e66a5 in oslo.policy, that
incorrect type for the target parameter results in an error in
the debug logs for the policy check:

  cannot format data, exception: Expected a dictionary, got
  <class 'oslo_context.context._DeprecatedPolicyValues'> instead.

This resolves the issue by using the same default target dict
that RequestContext.can uses if a target is not supplied.

Note that we get here from NovaKeystoneContext via API middleware
before any request handler is invoked in the wsgi stack, so there
is no context from the request as to what to pass for the target
besides the user_id/project_id.

Change-Id: I4442a7b95d15233f76f7795d45b18ac440ddb831
Closes-Bug: #1807747

1 files changed, 1 insertions, 1 deletions

diff --git a/nova/policy.py b/nova/policy.py
index cfdb1097a3..cad1f16f5c 100644
--- a/nova/policy.py
+++ b/nova/policy.py
@@ -176,7 +176,7 @@ def check_is_admin(context):
     init()
     # the target is user-self
     credentials = context.to_policy_values()
-    target = credentials
+    target = context.default_target()
     return _ENFORCER.authorize('context_is_admin', target, credentials)