<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hello,<br>
<br>
As far as I can tell, Horizon uses python-openstack-auth to
authenticate users. In the same time,
openstack_auth.KeystoneBackend.authenticate method generates only
project scoped tokens.<br>
<br>
After enabling policy checks in Keystone, I tried to view a list of
all projects on Admin panel and got "<strong style="font-weight:
bold; color: rgb(185, 74, 72); font-family: 'Helvetica Neue',
Helvetica, Arial, sans-serif; font-size: 13px; font-style: normal;
font-variant: normal; letter-spacing: normal; line-height: 18px;
orphans: auto; text-align: start; text-indent: 0px;
text-transform: none; white-space: normal; widows: auto;
word-spacing: 0px; -webkit-text-stroke-width: 0px;
background-color: rgb(242, 222, 222);">Error:<span
class="Apple-converted-space"> </span></strong><span
style="color: rgb(185, 74, 72); font-family: 'Helvetica Neue',
Helvetica, Arial, sans-serif; font-size: 13px; font-style: normal;
font-variant: normal; font-weight: normal; letter-spacing: normal;
line-height: 18px; orphans: auto; text-align: start; text-indent:
0px; text-transform: none; white-space: normal; widows: auto;
word-spacing: 0px; -webkit-text-stroke-width: 0px;
background-color: rgb(242, 222, 222); display: inline !important;
float: none;">Unauthorized: Unable to retrieve project list.</span>"
on dashboard and the next in Keystone log:<br>
<br>
<tt>enforce identity:list_projects: {'project_id':
u'80d91944f5af4c53ad5df4e386376e08', 'group_ids': [], 'user_id':
u'ed14fd91122b47d2a6f575499ed0c4bb', 'roles': [u'admin']}</tt><tt><br>
</tt><tt>...</tt><tt><br>
</tt><tt>WARNING keystone.common.wsgi [-] You are not authorized to
perform the requested action, identity:list_projects.</tt><tt> </tt><br>
<br>
This is expected, since user's token is scoped to project, and no
access to domain-wide resources should be allowed.<br>
<br>
How to work-around this? Is it possible to use policy checks on
Keystone side while working with Horizon?<br>
<br>
I am using stable/icehouse and Keystone API v3.<br>
<br>
Thanks,<br>
Roman<br>
</body>
</html>