<div dir="ltr"><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">I created project for the user admin(<span style="font-family:monospace,monospace;font-size:12.8000001907349px">6433222efd78459bb70ad9</span><span style="font-family:monospace,monospace;font-size:12.8000001907349px">adbcfac418). </span></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><span style="font-family:monospace,monospace;font-size:12.8000001907349px"><br></span></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif"><span style="font-family:monospace,monospace;font-size:12.8000001907349px">The token horizon is past is a project scope token. So it can not passed the cloud_admin rule.</span></div><div class="gmail_default" style="font-family:'trebuchet ms',sans-serif">I changed the rule to the admin_id is a little trick, and it works.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Mar 12, 2015 at 5:16 PM, Trelohan Christophe <span dir="ltr"><<a href="mailto:ctrelohan@voyages-sncf.com" target="_blank">ctrelohan@voyages-sncf.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello,<br>
<br>
Does user_id replaced in cloud_admin rule is id of cloud_admin user ?<br>
I don't think you can log in with cloud_admin user in horizon, it seems that without project created for an user, you can't log in<br>
in horizon.<br>
<br>
I'm also interested in this, I also followed the mentioned article, but when I try to login with "admin" user in "default" domain,<br>
I have the same error (not authorized to list_projects). Both with horizon and Rest API.<br>
<br>
<br>
<br>
<br>
De : Lei Zhang [mailto:<a href="mailto:zhang.lei.fly@gmail.com">zhang.lei.fly@gmail.com</a>]<br>
Envoyé : jeudi 12 mars 2015 03:33<br>
À : openstack; OpenStack Development Mailing List<br>
Objet : [Openstack] [Horizon][Keystone] Failed to set up keystone v3 api for horizon<br>
<div class="HOEnZb"><div class="h5"><br>
is there anyone tryed this and successfully?<br>
<br>
On Mon, Mar 9, 2015 at 4:25 PM, Lei Zhang <<a href="mailto:zhang.lei.fly@gmail.com">zhang.lei.fly@gmail.com</a>> wrote:<br>
Hi guys,<br>
<br>
I am setting up the keytone v3 api. Now I meet a issue about the `cloud_admin` policy.<br>
<br>
Base on the <a href="http://www.florentflament.com/blog/setting-keystone-v3-domains.html" target="_blank">http://www.florentflament.com/blog/setting-keystone-v3-domains.html</a> article, I modify the cloud_admin policy to <br>
<br>
```<br>
"cloud_admin": "rule:admin_required and domain_id:ef0d30167f744401a0cbfcc938ea7d63",<br>
```<br>
<br>
But the cloud_admin don't work as expected. I failed to open all the identity panel ( like http://<host>/horizon/identity/domains/)<br>
Horizon tell me" Error: Unable to retrieve project list."<br>
And keystone log warning: <br>
<br>
```<br>
2015-03-09 16:00:06.423 9415 DEBUG keystone.policy.backends.rules [-] enforce identity:list_user_projects: {'is_delegated_auth': False, 'access_token_id': None, 'user_id': u'6433222efd78459bb70ad9adbcfac418', 'roles': [u'_member_', u'admin'], 'trustee_id': None, 'trustor_id': None, 'consumer_id': None, 'token': <KeystoneToken (audit_id=DWsSa6yYSWi0ht9E7q4uhw, audit_chain_id=w_zLBBeFQ82KevtJrdKIJw) at 0x7f4503fab3c8>, 'project_id': u'4d170baaa89b4e46b239249eb5ec6b00', 'trust_id': None}, enforce /usr/lib/python2.7/dist-packages/keystone/policy/backends/rules.py:100<br>
2015-03-09 16:00:06.061 9410 WARNING keystone.common.wsgi [-] You are not authorized to perform the requested action: identity:list_projects (Disable debug mode to suppress these details.) <br>
```<br>
<br>
I make some debug and found that, the root cause is that the `context` variable in keystone has no `domain_id` field( like the above keystone log). So the `cloud_admin` rule failed. if i change the `cloud_admin` to following. It works as expected. <br>
<br>
```<br>
"cloud_admin": "rule:admin_required and user_id:6433222efd78459bb70ad9adbcfac418",<br>
```<br>
<br>
I found that in the keystone code[0], the domain_id only exist when it is a domain scope. But i believe that the horizon login token is a project one( I am not very sure this)<br>
<br>
```<br>
if token.project_scoped:<br>
auth_context['project_id'] = token.project_id<br>
elif token.domain_scoped:<br>
auth_context['domain_id'] = token.domain_id<br>
else:<br>
LOG.debug('RBAC: Proceeding without project or domain scope')<br>
<br>
```<br>
<br>
Is it a bug? or some wrong configuration? <br>
<br>
<br>
Following is my configuration.<br>
<br>
<br>
```<br>
# /etc/keystone/keystone.conf<br>
[DEFAULT]<br>
debug=true<br>
verbose=true<br>
log_dir=/var/log/keystone<br>
[assignment]<br>
driver = keystone.assignment.backends.sql.Assignment <br>
[database]<br>
connection=mysql://xxxx:xxxx@controller/keystone<br>
[identity]<br>
driver=keystone.identity.backends.sql.Identity<br>
[memcache]<br>
servers=controller1:11211,controller2:11211,controller3:1121<br>
[token]<br>
provider=keystone.token.providers.uuid.Provider<br>
```<br>
<br>
```<br>
# /etc/openstack-dashboard/local_settings.py ( partly )<br>
POLICY_FILES_PATH = "/etc/openstack-dashboard/"<br>
POLICY_FILES = {<br>
'identity': 'keystone_policy.json',<br>
}<br>
OPENSTACK_HOST = "127.0.0.1"<br>
OPENSTACK_KEYSTONE_URL = "http://%s:5000/v3" % OPENSTACK_HOST<br>
OPENSTACK_KEYSTONE_DEFAULT_ROLE = "_member_"<br>
OPENSTACK_API_VERSIONS = {<br>
"data_processing": 1.1,<br>
"identity": 3,<br>
"volume": 2<br>
}<br>
OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True<br>
OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = 'admin'<br>
``` <br>
<br>
[0] <a href="https://github.com/openstack/keystone/blob/master/keystone/common/authorization.py#L58" target="_blank">https://github.com/openstack/keystone/blob/master/keystone/common/authorization.py#L58</a><br>
<br>
--<br>
Lei Zhang<br>
Blog: <a href="http://xcodest.me" target="_blank">http://xcodest.me</a><br>
twitter/weibo: @jeffrey4l<br>
<br>
<br>
<br>
<br>
--<br>
Lei Zhang<br>
Blog: <a href="http://xcodest.me" target="_blank">http://xcodest.me</a><br>
twitter/weibo: @jeffrey4l<br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div><span style="font-size:13px;border-collapse:collapse"><font face="trebuchet ms, sans-serif">Lei Zhang</font></span></div><div><font face="trebuchet ms, sans-serif">Blog: <a href="http://xcodest.me" target="_blank">http://xcodest.me</a></font></div><div><font face="trebuchet ms, sans-serif">twitter/weibo: @jeffrey4l</font></div></div></div>
</div>