<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Hi Vinod!<div><br></div><div>I think you can simplify the roles in the hierarchical model by only passing the roles for the authenticated project and above. All roles are then inherited down. This means it isn’t necessary to pass a scope along with each role. The scope is just passed once with the token and the project-admin role (for example) would be checking to see that the user has the project-admin role and that the project_id prefix matches.</div><div><br></div><div>There is only one case that this doesn’t handle, and that is when the user has one role (say member) in ProjA and project-admin in ProjA2. If the user is authenticated to ProjA, he can’t do project-adminy stuff for ProjA2 without reauthenticating. I think this is a reasonable sacrifice considering how much easier it would be to just pass the parent roles instead of going through all of the children.</div><div><br></div><div>Vish</div><div><br><div><div>On Feb 13, 2014, at 2:31 AM, Vinod Kumar Boppanna <<a href="mailto:vinod.kumar.boppanna@cern.ch">vinod.kumar.boppanna@cern.ch</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div ocsi="0" fpstyle="1" style="font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="direction: ltr; font-family: Tahoma; font-size: 10pt;">Dear All,<br><br>At the meeting last week we (myself and Ulrich) have been assigned the task of doing POC for Quota Management in the Hierarchical Multitenancy setup.<span class="Apple-converted-space"> </span><br><br>So, here it is:<br><br>Wiki Page -><span class="Apple-converted-space"> </span><a href="https://wiki.openstack.org/wiki/POC_for_QuotaManagement" target="_blank">https://wiki.openstack.org/wiki/POC_for_QuotaManagement</a> (explained here an example setup and my thoughts)<br><br>Code -><span class="Apple-converted-space"> </span><a rel="nofollow" class="external free" href="https://github.com/vinodkumarboppanna/POC-For-Quotas/commit/391e9108fa579d292880c8836cadfd7253586f37">https://github.com/vinodkumarboppanna/POC-For-Quotas/commit/391e9108fa579d292880c8836cadfd7253586f37</a><br><br>Please post your comments or any inputs and i hope this POC will be discussed in this weeks meeting on Friday at 1600 UTC.<br><br><br>In addition to this, we have completed the implementation the Domain Quota Management in Nova with V2 APIs, and if anybody interested, please have a look<br><br>BluePrint -><span class="Apple-converted-space"> </span><a href="https://blueprints.launchpad.net/nova/+spec/domain-quota-driver-api" target="_blank">https://blueprints.launchpad.net/nova/+spec/domain-quota-driver-api</a><br>Wiki Page -><span class="Apple-converted-space"> </span><a href="https://wiki.openstack.org/wiki/APIs_for_Domain_Quota_Driver" target="_blank">https://wiki.openstack.org/wiki/APIs_for_Domain_Quota_Driver</a><br>GitHub Code -><span class="Apple-converted-space"> </span><a href="https://github.com/vinodkumarboppanna/DomainQuotaAPIs" target="_blank">https://github.com/vinodkumarboppanna/DomainQuotaAPIs</a><br><br><br>Thanks & Regards,<br>Vinod Kumar Boppanna<br><br></div>_______________________________________________<br>OpenStack-dev mailing list<br><a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a></div></blockquote></div><br></div></body></html>