<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Something has been struggling to the surface of my brain since our
last talk.<br>
<br>
It should not be inherited 'roles' but rather:<br>
<br>
"users in this group should get role X in all projects in a domain."<br>
<br>
It is the group to role mapping that we need to fix. Right now, we
can add a group to a role in a specific project. What we need to be
able to do is add a group to a role in all projects in a domain.<br>
<br>
It is a slight change in emphasis. It is not "inherited roles" but
rather "patterns of role assignments" with "all projects in this
domain the first implemented pattern.<br>
<br>
We don't want to list all role assignments globally. list Role
assigments should come from the objects involved. So I think the
top level listing and the filtering of effective etc is the wrong
approach. <br>
<br>
<br>
Right now, the APIs to assign a group to a role in a specific
project and to assign a group to a role in a domain are specified.
What we want is the rule to assign a group to a role in all projects
in a domain:<br>
<code><br>
So instead of PUT
/domains/{domain_id}/groups/{group_id}/roles/{role_id}</code><br>
<br>
It would be something like <br>
<br>
<code>PUT</code><code>
/domain-all-projects/{domain_id}/users/{user_id}/roles/{role_id}</code><br>
<br>
There should be no "effective" role assignments.<br>
</body>
</html>