Update service setup code to throw if rbac.enable config option is set
to True, but rbac.backend is not set to enterprise.
This indicates an operator error (misconfiguration) which would have
user believe RBAC is enabled when it's actually not if we didn't throw.
@@ -189,8 +189,14 @@ def setup(service, config, setup_db=True, register_mq_exchanges=True,
# RBAC backend check
if cfg.CONF.rbac.enable and cfg.CONF.rbac.backend != 'enterprise':
msg = ('You have enabled RBAC, but RBAC backend is not set to "enterprise". '
- 'For RBAC to work, you need to install "bwc-enterprise" package and set '
- '"rbac.backend" config option to "enterprise".')
+ 'For RBAC to work, you need to install "bwc-enterprise" package, set '
+ '"rbac.backend" config option to "enterprise" and restart st2api service.')
+
+ if service == 'api':
+ # Fatal error for st2api service - it could indicate amisconfiguration and user would
+ # end up without rbac thinking it's indeed enabled
+ raise ValueError(msg)
+ else:
LOG.warn(msg)
