<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>I'm sure additional feedback on those patches would be welcome and helpful toward getting them merged in Kilo</div><div><br>On Mar 12, 2015, at 9:14 AM, Lei Zhang <<a href="mailto:zhang.lei.fly@gmail.com">zhang.lei.fly@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr"><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Hi Lin,</div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">This two PS is what I wanted. Thx a lot.</div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif"><br></div><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">btw, is it possible that these PS finished in Kilo?</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Mar 12, 2015 at 5:41 PM, Lin Hua Cheng <span dir="ltr"><<a href="mailto:os.lcheng@gmail.com" target="_blank">os.lcheng@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi,<div><br></div><div>The 'cloud_admin' policy file requires domain-scoped to work to work.</div><div><br></div><div>Horizon does not currently support domain scope token yet. So yes, it is a gap in horizon at the moment.</div><div><br></div><div>There are on-going patches to address this in horizon: <br><div>- <a href="https://review.openstack.org/#/c/141153/" target="_blank">https://review.openstack.org/#/c/141153/</a><br></div></div><div>- <a href="https://review.openstack.org/#/c/148082/" target="_blank">https://review.openstack.org/#/c/148082/</a></div><div><br></div><div>Dan (esp) prepared a nicely written document on this should eventually work.</div><div><br></div><div>-Lin</div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">On Wed, Mar 11, 2015 at 7:33 PM, Lei Zhang <span dir="ltr"><<a href="mailto:zhang.lei.fly@gmail.com" target="_blank">zhang.lei.fly@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div dir="ltr"><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">is there anyone tryed this and successfully?</div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Mar 9, 2015 at 4:25 PM, Lei Zhang <span dir="ltr"><<a href="mailto:zhang.lei.fly@gmail.com" target="_blank">zhang.lei.fly@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div style="font-family:'trebuchet ms',sans-serif">Hi guys,</div><div style="font-family:'trebuchet ms',sans-serif"><br></div><div style="font-family:'trebuchet ms',sans-serif">I am setting up the keytone v3 api. Now I meet a issue about the `cloud_admin` policy.</div><div style="font-family:'trebuchet ms',sans-serif"><br></div><div style="font-family:'trebuchet ms',sans-serif">Base on the <a href="http://www.florentflament.com/blog/setting-keystone-v3-domains.html" target="_blank">http://www.florentflament.com/blog/setting-keystone-v3-domains.html</a> article, I modify the cloud_admin policy to </div><div style="font-family:'trebuchet ms',sans-serif"><br></div><div style="font-family:'trebuchet ms',sans-serif">```</div><div><font face="monospace, monospace">"cloud_admin": "rule:admin_required and domain_id:ef0d30167f744401a0cbfcc938ea7d63",</font><br></div><div style="font-family:'trebuchet ms',sans-serif">```</div><div style="font-family:'trebuchet ms',sans-serif"><br></div><div style="font-family:'trebuchet ms',sans-serif">But the cloud_admin don't work as expected. I failed to open all the identity panel ( like http://<host>/horizon/identity/domains/)</div><div><font face="trebuchet ms, sans-serif">Horizon tell me</font>" Error: Unable to retrieve project list."</div><div>And keystone log warning: </div><div><br></div><div>```</div><div><font face="monospace, monospace">2015-03-09 16:00:06.423 9415 DEBUG keystone.policy.backends.rules [-] enforce identity:list_user_projects: {'is_delegated_auth': False, 'access_token_id': None, 'user_id': u'6433222efd78459bb70ad9adbcfac418', 'roles': [u'_member_', u'admin'], 'trustee_id': None, 'trustor_id': None, 'consumer_id': None, 'token': <KeystoneToken (audit_id=DWsSa6yYSWi0ht9E7q4uhw, audit_chain_id=w_zLBBeFQ82KevtJrdKIJw) at 0x7f4503fab3c8>, 'project_id': u'4d170baaa89b4e46b239249eb5ec6b00', 'trust_id': None}, enforce /usr/lib/python2.7/dist-packages/keystone/policy/backends/rules.py:100</font><br></div><div><font face="monospace, monospace">2015-03-09 16:00:06.061 9410 WARNING keystone.common.wsgi [-] You are not authorized to perform the requested action: identity:list_projects (Disable debug mode to suppress these details.) <br></font></div><div>```</div><div><br></div><div><div style="font-family:'trebuchet ms',sans-serif">I make some debug and found that, the root cause is that the `context` variable in keystone has no `domain_id` field( like the above keystone log). So the `cloud_admin` rule failed. if i change the `cloud_admin` to following. It works as expected. </div><div style="font-family:'trebuchet ms',sans-serif"><br></div><div style="font-family:'trebuchet ms',sans-serif"><div>```</div><div style="font-family:arial,sans-serif"><font face="monospace, monospace">"cloud_admin": "rule:admin_required and user_id:</font><span style="font-family:monospace,monospace">6433222efd78459bb70ad9adbcfac418</span><font face="monospace, monospace">",</font></div><div>```</div><div><br></div><div>I found that in the keystone code[0], the domain_id only exist when it is a domain scope. But i believe that the horizon login token is a project one( I am not very sure this)</div><div><br></div><div>```</div><div><div> if token.project_scoped:</div><div> auth_context['project_id'] = token.project_id</div><div> elif token.domain_scoped:</div><div> auth_context['domain_id'] = token.domain_id</div><div> else:</div><div> LOG.debug('RBAC: Proceeding without project or domain scope')</div><div><br></div></div><div>```</div></div><div style="font-family:'trebuchet ms',sans-serif"><br></div><div style="font-family:'trebuchet ms',sans-serif">Is it a bug? or some wrong configuration? </div><div style="font-family:'trebuchet ms',sans-serif"><br></div><div style="font-family:'trebuchet ms',sans-serif"><br></div><div style="font-family:'trebuchet ms',sans-serif">Following is my configuration.</div><div style="font-family:'trebuchet ms',sans-serif"><br></div><div style="font-family:'trebuchet ms',sans-serif"><br></div><div style="font-family:'trebuchet ms',sans-serif">```</div><div><font face="monospace, monospace"># /etc/keystone/keystone.conf</font></div><div><div><font face="monospace, monospace">[DEFAULT]</font></div><div><font face="monospace, monospace">debug=true</font></div><div><font face="monospace, monospace">verbose=true</font></div><div><font face="monospace, monospace">log_dir=/var/log/keystone</font></div><div><font face="monospace, monospace">[assignment]</font></div><div><font face="monospace, monospace">driver = keystone.assignment.backends.sql.Assignment </font></div><div><div><font face="monospace, monospace">[database]</font></div><div><font face="monospace, monospace">connection=mysql://xxxx:xxxx@controller/keystone</font></div><div><div><font face="monospace, monospace">[identity]</font></div><div><font face="monospace, monospace">driver=keystone.identity.backends.sql.Identity</font></div><div><div><font face="monospace, monospace">[memcache]</font></div><div><font face="monospace, monospace">servers=controller1:11211,controller2:11211,controller3:1121</font></div></div><div><div><font face="monospace, monospace">[token]</font></div><div><font face="monospace, monospace">provider=keystone.token.providers.uuid.Provider</font></div></div><div style="font-family:'trebuchet ms',sans-serif">```</div><div style="font-family:'trebuchet ms',sans-serif"><br></div><div style="font-family:'trebuchet ms',sans-serif">```</div><div><font face="monospace, monospace"># /etc/openstack-dashboard/local_settings.py ( partly )</font></div><div><font face="monospace, monospace">POLICY_FILES_PATH = "/etc/openstack-dashboard/"</font></div><div><font face="monospace, monospace">POLICY_FILES = {</font></div><div><font face="monospace, monospace"> 'identity': 'keystone_policy.json',</font></div><div><font face="monospace, monospace">}</font></div><div><font face="monospace, monospace">OPENSTACK_HOST = "127.0.0.1"</font></div><div><font face="monospace, monospace">OPENSTACK_KEYSTONE_URL = "<a href="http://%s:5000/v3">http://%s:5000/v3</a>" % OPENSTACK_HOST</font></div><div><font face="monospace, monospace">OPENSTACK_KEYSTONE_DEFAULT_ROLE = "_member_"</font></div><div><font face="monospace, monospace">OPENSTACK_API_VERSIONS = {</font></div><div><font face="monospace, monospace"> "data_processing": 1.1,</font></div><div><font face="monospace, monospace"> "identity": 3,</font></div><div><font face="monospace, monospace"> "volume": 2</font></div><div><font face="monospace, monospace">}</font></div><div><font face="monospace, monospace">OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True</font></div><div><font face="monospace, monospace">OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = 'admin'</font></div><div style="font-family:'trebuchet ms',sans-serif">``` </div><div style="font-family:'trebuchet ms',sans-serif"><br></div></div></div></div></div><div><div style="font-family:'trebuchet ms',sans-serif">[0] <a href="https://github.com/openstack/keystone/blob/master/keystone/common/authorization.py#L58" target="_blank">https://github.com/openstack/keystone/blob/master/keystone/common/authorization.py#L58</a></div><span><font color="#888888"><span><font color="#888888"><br></font></span></font></span></div><span><font color="#888888"><span><font color="#888888">-- <br><div><div dir="ltr"><div><span style="font-size:13px;border-collapse:collapse"><font face="trebuchet ms, sans-serif">Lei Zhang</font></span></div><div><font face="trebuchet ms, sans-serif">Blog: <a href="http://xcodest.me" target="_blank">http://xcodest.me</a></font></div><div><font face="trebuchet ms, sans-serif">twitter/weibo: @jeffrey4l</font></div></div></div>
</font></span></font></span></div><span><font color="#888888">
</font></span></blockquote></div><span><font color="#888888"><br><br clear="all"><div><br></div>-- <br><div><div dir="ltr"><div><span style="font-size:13px;border-collapse:collapse"><font face="trebuchet ms, sans-serif">Lei Zhang</font></span></div><div><font face="trebuchet ms, sans-serif">Blog: <a href="http://xcodest.me" target="_blank">http://xcodest.me</a></font></div><div><font face="trebuchet ms, sans-serif">twitter/weibo: @jeffrey4l</font></div></div></div>
</font></span></div></div>
<br></div></div>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div>
<br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div><span style="font-size:13px;border-collapse:collapse"><font face="trebuchet ms, sans-serif">Lei Zhang</font></span></div><div><font face="trebuchet ms, sans-serif">Blog: <a href="http://xcodest.me" target="_blank">http://xcodest.me</a></font></div><div><font face="trebuchet ms, sans-serif">twitter/weibo: @jeffrey4l</font></div></div></div>
</div>
</div></blockquote><blockquote type="cite"><div><span>__________________________________________________________________________</span><br><span>OpenStack Development Mailing List (not for usage questions)</span><br><span>Unsubscribe: <a href="mailto:OpenStack-dev-request@lists.openstack.org">OpenStack-dev-request@lists.openstack.org</a>?subject:unsubscribe</span><br><span><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a></span><br></div></blockquote></body></html>