<font size=2 face="sans-serif">Hey Angus,</font>
<br>
<br><font size=2 face="sans-serif">If I understand the scenario correctly,
I think you might run into the same problem with OAuth Access Tokens.</font>
<br>
<br><tt><font size=2>>> We currently use a trust token and that fails
because both mistral and<br>
>> heat want to create trust tokens as well :-O (trust tokens can't
be<br>
>> rescoped).</font></tt>
<br>
<br><font size=2 face="sans-serif">i.e.: Use OAuth Access Token (oa) to
get a Keystone token (kt), then use that Keystone token (kt) to get another
Keystone token? (scoped or not, the request will be denied to prevent chaining)</font>
<br>
<br><tt><font size=2>>> I believe there might be some limitations
to oauth (are roles supported?).</font></tt><font size=2 face="sans-serif"><br>
</font>
<br><font size=2 face="sans-serif">You may specify any number of roles
to be delegated in an OAuth Access Token, the only limitation I can think
of, is that only projects are supported, not domains.</font>
<br><font size=2 face="sans-serif"><br>
</font>
<br><font size=1 face="Arial">Regards,</font>
<br>
<br><font size=3 color=#8f8f8f face="Arial"><b>Steve Martinelli</b></font><font size=1 face="Arial"><br>
Software Developer - Openstack<br>
Keystone Core Member</font>
<table width=680 style="border-collapse:collapse;">
<tr height=8>
<td width=680 colspan=2 style="border-style:solid;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;">
<hr>
<tr valign=top height=8>
<td width=420 style="border-style:solid;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;"><font size=1 color=#4181c0 face="Arial"><b>Phone:</b></font><font size=1 color=#5f5f5f face="Arial">
1-905-413-2851</font><font size=1 color=#4181c0 face="Arial"><b><br>
E-mail:</b></font><font size=1 color=#5f5f5f face="Arial"> </font><a href=mailto:stevemar@ca.ibm.com target=_blank><font size=1 color=#5f5f5f face="Arial"><u>stevemar@ca.ibm.com</u></font></a>
<td width=259 style="border-style:solid;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;">
<div align=right><font size=1 color=#5f5f5f face="Arial">8200 Warden Ave<br>
Markham, ON L6G 1C7<br>
Canada</font></div></table>
<br>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">Angus Salkeld <angus.salkeld@RACKSPACE.COM></font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">"OpenStack Development
Mailing List (not for usage questions)" <openstack-dev@lists.openstack.org>,
</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">05/27/2014 08:58 PM</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">[openstack-dev]
[solum] [mistral] [heat] keystone chained trusts /
oauth</font>
<br>
<hr noshade>
<br>
<br>
<br><tt><font size=2>-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
Hi all<br>
<br>
During our Solum meeting it was felt we should make sure that all three<br>
team are on the same page wrt $subject.<br>
<br>
I'll describe the use case we are trying to solve and hopefully get some<br>
guidance from the keystone team about the best way forward.<br>
<br>
Solum implements a ci/cd pipeline that we want to trigger based on a git<br>
receive hook. What we do is generate a magic webhook (should be<br>
ec2signed url - on the todo list) and when it is hit we want<br>
to call mistral-execution-create (which runs a workflow that calls<br>
to other openstack services (heat is one of them).<br>
<br>
We currently use a trust token and that fails because both mistral and<br>
heat want to create trust tokens as well :-O (trust tokens can't be<br>
rescoped).<br>
<br>
So what is the best mechanism for this? I spoke to Steven Hardy at<br>
summit and he suggested (after talking to some keystone folks) we all<br>
move to using the new oauth functionality in keystone.<br>
<br>
I believe there might be some limitations to oauth (are roles supported?).<br>
<br>
Basically I want to make sure we are doing the right (and compatible)<br>
thing so autonomous actions can be carried out across services.<br>
<br>
Regards<br>
Angus<br>
<br>
refs:<br>
</font></tt><a href="https://blueprints.launchpad.net/mistral/+spec/mistral-oauth"><tt><font size=2>https://blueprints.launchpad.net/mistral/+spec/mistral-oauth</font></tt></a><tt><font size=2><br>
</font></tt><a href="https://blueprints.launchpad.net/solum/+spec/solum-oauth"><tt><font size=2>https://blueprints.launchpad.net/solum/+spec/solum-oauth</font></tt></a><tt><font size=2><br>
</font></tt><a href="https://blueprints.launchpad.net/heat/+spec/heat-oauth"><tt><font size=2>https://blueprints.launchpad.net/heat/+spec/heat-oauth</font></tt></a><tt><font size=2><br>
<br>
other interesting stuff:<br>
</font></tt><a href="http://adam.younglogic.com/2013/03/trusts-and-oauth/"><tt><font size=2>http://adam.younglogic.com/2013/03/trusts-and-oauth/</font></tt></a><tt><font size=2><br>
</font></tt><a href="http://homakov.blogspot.com.au/2013/03/oauth1-oauth2-oauth.html"><tt><font size=2>http://homakov.blogspot.com.au/2013/03/oauth1-oauth2-oauth.html</font></tt></a><tt><font size=2><br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1<br>
Comment: Using GnuPG with Thunderbird - </font></tt><a href=http://www.enigmail.net/><tt><font size=2>http://www.enigmail.net/</font></tt></a><tt><font size=2><br>
<br>
iQEcBAEBAgAGBQJThTRTAAoJEFrDYBLxZjWoQgYH/2/TyJH2INIFojxu6lwntbHh<br>
6IhVmcXIybY+F/RN++YTBLduqA7qVxsGY2ZrGkztK3wISquI9Hw97Lw6jHelfK3J<br>
3FnuS68xdxfhFwRNB8Slp5FT8ssHYazqpKn6kB5Rz7icZe6kWBTDGD8LTyiPwmJs<br>
fWotAu/uzQJD0qcvg1XOE6Yddxm7owf85wY4BSSURzjBakK9ANwT1rW+pBoVFWF3<br>
sxxIOCnDXmCJsiN18x3hHAXXxIxiLwlBp/YIuIUSznDK3a8JiIoaQ3jjM/FvcvX4<br>
P7zQZL2qEoV4PXnvW5NmMaguOc/teTcw7ga3txry0RDHAYfDWmetKCuUjJtAKYQ=<br>
=XaIS<br>
-----END PGP SIGNATURE-----<br>
<br>
_______________________________________________<br>
OpenStack-dev mailing list<br>
OpenStack-dev@lists.openstack.org<br>
</font></tt><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev"><tt><font size=2>http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</font></tt></a><tt><font size=2><br>
<br>
</font></tt>
<br>