<div dir="ltr">Thanks all for the information.<div>I have now v3 policies in place, the issue is that as a domain admin I could not create a project in the domain. I get 403 unauthorized status.</div><div><br></div><div>I see that when as a 'domain admin' request a token, the response did not have any roles. In the token request, I couldnt specify the project - as we are about to create the project in next step.</div>
<div><br></div><div>Here is the complete request/response of all the steps done.</div><div><a href="https://gist.github.com/kumarcv/8015275">https://gist.github.com/kumarcv/8015275</a><br></div><div><br></div><div>I am assuming its a bug. Please let me know your opinions.</div>
<div><br></div><div>Thanks,</div><div>-Ravi.</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Dec 12, 2013 at 3:00 PM, Henry Nash <span dir="ltr"><<a href="mailto:henryn@linux.vnet.ibm.com" target="_blank">henryn@linux.vnet.ibm.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi<br>
<br>
So the idea wasn't the you create a domain with the id of 'domain_admin_id', rather that you create the domain that you plan to use for your admin domain, and then paste its (auto-generated) domain_id into the policy file.<br>
<span class="HOEnZb"><font color="#888888"><br>
Henry<br>
</font></span><div class="HOEnZb"><div class="h5">On 12 Dec 2013, at 03:11, Paul Belanger <<a href="mailto:paul.belanger@polybeacon.com">paul.belanger@polybeacon.com</a>> wrote:<br>
<br>
> On 13-12-11 11:18 AM, Lyle, David wrote:<br>
>> +1 on moving the domain admin role rules to the default policy.json<br>
>><br>
>> -David Lyle<br>
>><br>
>> From: Dolph Mathews [mailto:<a href="mailto:dolph.mathews@gmail.com">dolph.mathews@gmail.com</a>]<br>
>> Sent: Wednesday, December 11, 2013 9:04 AM<br>
>> To: OpenStack Development Mailing List (not for usage questions)<br>
>> Subject: Re: [openstack-dev] [keystone] domain admin role query<br>
>><br>
>><br>
>> On Tue, Dec 10, 2013 at 10:49 PM, Jamie Lennox <<a href="mailto:jamielennox@redhat.com">jamielennox@redhat.com</a>> wrote:<br>
>> Using the default policies it will simply check for the admin role and not care about the domain that admin is limited to. This is partially a left over from the V2 api when there wasn't domains to worry > about.<br>
>><br>
>> A better example of policies are in the file etc/policy.v3cloudsample.json. In there you will see the rule for create_project is:<br>
>><br>
>> "identity:create_project": "rule:admin_required and domain_id:%(project.domain_id)s",<br>
>><br>
>> as opposed to (in policy.json):<br>
>><br>
>> "identity:create_project": "rule:admin_required",<br>
>><br>
>> This is what you are looking for to scope the admin role to a domain.<br>
>><br>
>> We need to start moving the rules from policy.v3cloudsample.json to the default policy.json =)<br>
>><br>
>><br>
>> Jamie<br>
>><br>
>> ----- Original Message -----<br>
>>> From: "Ravi Chunduru" <<a href="mailto:ravivsn@gmail.com">ravivsn@gmail.com</a>><br>
>>> To: "OpenStack Development Mailing List" <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>><br>
>>> Sent: Wednesday, 11 December, 2013 11:23:15 AM<br>
>>> Subject: [openstack-dev] [keystone] domain admin role query<br>
>>><br>
>>> Hi,<br>
>>> I am trying out Keystone V3 APIs and domains.<br>
>>> I created an domain, created a project in that domain, created an user in<br>
>>> that domain and project.<br>
>>> Next, gave an admin role for that user in that domain.<br>
>>><br>
>>> I am assuming that user is now admin to that domain.<br>
>>> Now, I got a scoped token with that user, domain and project. With that<br>
>>> token, I tried to create a new project in that domain. It worked.<br>
>>><br>
>>> But, using the same token, I could also create a new project in a 'default'<br>
>>> domain too. I expected it should throw authentication error. Is it a bug?<br>
>>><br>
>>> Thanks,<br>
>>> --<br>
>>> Ravi<br>
>>><br>
><br>
> One of the issues I had this week while using the policy.v3cloudsample.json was I had no easy way of creating a domain with the id of 'admin_domain_id'. I basically had to modify the SQL directly to do it.<br>
><br>
> Any chance we can create a 2nd domain using 'admin_domain_id' via keystone-manage sync_db?<br>
><br>
> --<br>
> Paul Belanger | PolyBeacon, Inc.<br>
> Jabber: <a href="mailto:paul.belanger@polybeacon.com">paul.belanger@polybeacon.com</a> | IRC: pabelanger (Freenode)<br>
> Github: <a href="https://github.com/pabelanger" target="_blank">https://github.com/pabelanger</a> | Twitter: <a href="https://twitter.com/pabelanger" target="_blank">https://twitter.com/pabelanger</a><br>
><br>
> _______________________________________________<br>
> OpenStack-dev mailing list<br>
> <a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
><br>
<br>
</div></div><br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br>Ravi<br>
</div>