<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div apple-content-edited="true" class=""><div class=""><br class=""></div></div><div><blockquote type="cite" class=""><div class="">On 19 Feb 2015, at 18:32, Alexander Makarov <<a href="mailto:amakarov@mirantis.com" class="">amakarov@mirantis.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">@Renat, They are conceptually different:<div class="">- regular tokens are created for the owner of addressed resource</div><div class="">- trust scoped tokens are for trustees and have some security restrictions.</div><div class="">The case is about disallowing a trustee to aquire a regular token allowing him anything the trustor is allowed. It'd be an exploit.</div></div></div></blockquote></div><div class=""><br class=""></div>Alexander,<div class=""><br class=""></div><div class="">Thanks for explanations. I kind of get the general idea, yes. What is best source where we could go and read in details about that? The only page I was able to find is <a href="https://wiki.openstack.org/wiki/Keystone/Trusts" class="">https://wiki.openstack.org/wiki/Keystone/Trusts</a> but it would be nice if something more tutorial-like existed.<br class=""><div class=""><br class=""></div><div class=""><div class="">Renat Akhmerov</div><div class="">@ Mirantis Inc.</div></div><div class=""><br class=""></div></div></body></html>