<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Yeah, clarification from keystone folks would be really helpful.<div class=""><br class=""></div><div class="">If Nikolay’s info is correct (I believe it is) then I actually don’t understand why trusts are needed at all, they seem to be useless. My assumption is that they can be used only if we send requests directly to OpenStack services (w/o using clients) with trust scoped token included in headers, that might work although I didn’t checked that yet myself.</div><div class=""><br class=""></div><div class="">So please help us understand which one of my following assumptions is correct?</div><div class=""><br class=""></div><div class=""><ol class="MailOutline"><li class="">We don’t understand what trusts are.</li><li class="">We use them in a wrong way. (If yes, then what’s the correct usage?)</li><li class="">Trust mechanism itself is in development and can’t be used at this point.</li><li class="">OpenStack clients need to be changed in some way to somehow bypass this keystone limitation?</li></ol></div><div class=""><br class=""><div class="">Thanks</div><div class=""><br class=""><div class="">
<div class="">Renat Akhmerov</div><div class="">@ Mirantis Inc.</div><div class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">On 16 Feb 2015, at 19:10, Nikolay Makhotkin <<a href="mailto:nmakhotkin@mirantis.com" class="">nmakhotkin@mirantis.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">Hello, <br class=""><br class="">Decided to start a new thread due to too much technical details in old thread. <div class="">(You can see thread <b class="">[openstack-dev] [keystone] [nova]</b> )<br class=""><div class=""><br clear="all" class=""><div class=""><b class="">The problem:</b> Trusts can not be used to retrieve a token for further work with python-<project>client.</div><div class=""><br class=""></div><div class="">I made some research for trust's use cases. The main goal of trusts is clear to me: delegation of privileges of one user to another on specific time (or limitless). But if I get a trust and then get a token from it, it can not be used in any python-client. The reason why it happens so - is 'authenticate' method in almost all python-clients. This method request a keystone for authentication and get a new auth token. But in case of trust-scoped token it can't be true - this method always return '403 Forbidden' [1]</div><div class=""><br class=""></div><div class=""><b class="">The question:</b> Is there a way to create a trust and use it for requests to any other service? E.g., We can get a token from trust and use it (but actually, we are not).</div><div class=""><br class=""></div><div class="">Or am I misunderstanding trust's purpose? How are trusts should worked?</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">[1] <a href="https://github.com/openstack/keystone/blob/master/keystone/token/controllers.py#L154-L156" class="">https://github.com/openstack/keystone/blob/master/keystone/token/controllers.py#L154-L156</a></div><div class=""><br class=""></div><div class=""> </div><div class="gmail_signature"><div dir="ltr" class=""><div class=""><font class="">Best Regards,</font></div><div class=""><font class="">Nikolay Makhotkin</font></div><div class=""><font class="">@Mirantis</font></div></div></div>
</div></div></div>
__________________________________________________________________________<br class="">OpenStack Development Mailing List (not for usage questions)<br class="">Unsubscribe: <a href="mailto:OpenStack-dev-request@lists.openstack.org" class="">OpenStack-dev-request@lists.openstack.org</a>?subject:unsubscribe<br class=""><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" class="">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br class=""></div></blockquote></div><br class=""></div></div></body></html>