I deeply desire that we continue to require unique names across keystone. I do not like the idea of tenant specific or domain specific names. It may cost us down the road if we ever decide we want to provide NSS capacity based off of keystone.<br>
<br>-Matt<br><br><div class="gmail_quote">On Tue, Aug 14, 2012 at 5:06 PM, Joseph Heck <span dir="ltr"><<a href="mailto:heckj@me.com" target="_blank">heckj@me.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">Hey Naveen - <div><br></div><div>Although the spec is currently for keeping the usernames unique globally, domains (part of the V3 API setup) will allow us to have a boundary/barrier for uniqueness if that's desired.</div>
<div><br></div><div>The quirk that is keeping it in place is generally *not* mandating that the end user - when authenticating - know the "project/tenant" name to which they're authenticating. If we allowed tenant-uniqueness for usernames, then in order to log in and guarantee uniqueness so we could authZ someone, we would need to know the tenant up front as well. Current systems (like logging in to the horizon dashboard) *do not* require that.</div>
<div><br></div><div>-joe</div><div><br><div><div><div class="h5"><div>On Aug 14, 2012, at 4:55 PM, Naveen Joy (najoy) <<a href="mailto:najoy@cisco.com" target="_blank">najoy@cisco.com</a>> wrote:</div></div></div><blockquote type="cite">
<div link="blue" vlink="purple" style="font-family:Helvetica;font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px" lang="EN-US">
<div><div class="h5"><div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">It’s valid for the same username to exist across multiple tenants and should be only unique for a tenant. Keystone today is enforcing uniqueness for a name and prevents creation of the same user across tenants. Is there a plan to use (tenantID, name) as a composite key instead of just the name?. <u></u><u></u></div>
<div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">Conflict occurred attempting to store user. (IntegrityError) (1062, "Duplicate entry 'admin' for key 'name'") 'INSERT INTO user (id, name, extra) VALUES (%s, %s, %s)' ('697addf1c62a4eaea33d6c99076269d6', 'admin', '{"password": "$6$rounds=40000$SGj4.DyRasD5jy7l$uZNGjWvUkgJkqrGb4B/4uXga.FjFy7VMCkHKcWHJkXVkHUgtF.D1SDz9RwO3aazvGhyGUQK/isK3jwNprSpVD.", "enabled": true, "email": null, "tenantId": "0f8423b5c8a74ffc91c0ccf1c7015aa3"}') (HTTP 409)<u></u><u></u></div>
<div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">desc user;<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">
+-------+-------------+------+-----+---------+-------+<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">| Field | Type | Null | Key | Default | Extra |<u></u><u></u></div>
<div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">+-------+-------------+------+-----+---------+-------+<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">
| id | varchar(64) | NO | PRI | NULL | |<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">| name | varchar(64) | NO | UNI | NULL | |<u></u><u></u></div>
<div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">| extra | text | YES | | NULL | |<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">
+-------+-------------+------+-----+---------+-------+<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">3 rows in set (0.00 sec)<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">
<u></u> <u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">Cheers,<u></u><u></u></div>
<div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif">Naveen<u></u><u></u></div><div style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></div></div></div>
</div>_______________________________________________<br>OpenStack-dev mailing list<br><a href="mailto:OpenStack-dev@lists.openstack.org" style="color:purple;text-decoration:underline" target="_blank">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" style="color:purple;text-decoration:underline" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br></div></blockquote>
</div><br></div></div><br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br>