<div dir="ltr">Hi everyone,<div><br></div><div>Thanks for helping me. I did wrong filter of my mailing, so I missed the topic. Thanks for Farhan forward the email to me. </div><div><br></div><div>Thanks <b style="color:rgb(136,136,136);font-size:12.8000001907349px">Dolph Mathews, you gave the point. Binggo!!! I didn't assign the admin user to default domain. </b><b style="color:rgb(136,136,136);font-size:12.8000001907349px">I didn't have this problem when I worked with icehouse version, I guess it didn't check the domain scope for admin user back then. </b><b style="color:rgb(136,136,136);font-size:12.8000001907349px">After I assigned admin to default domain, it all works correct now. Thanks a lot. </b></div><div><b style="color:rgb(136,136,136);font-size:12.8000001907349px"><br></b></div><div><b style="color:rgb(136,136,136);font-size:12.8000001907349px">Thanks </b><b style="color:rgb(136,136,136);font-size:12.8000001907349px">Lin Hua Cheng, yes, the problem is I missed the domain scope token for admin user.</b></div><div><b style="color:rgb(136,136,136);font-size:12.8000001907349px"><br></b></div><div><b style="color:rgb(136,136,136);font-size:12.8000001907349px">To </b><b style="color:rgb(136,136,136);font-size:12.8000001907349px">Rich Megginson: I am using the v3 sample policy file, which is </b><span style="font-size:12.8000001907349px"> </span><a href="https://github.com/openstack/keystone/blob/f6c01dd1673b290578e9fff063e27104412ffeda/etc/policy.v3cloudsample.json" target="_blank" style="font-size:12.8000001907349px">https://github.com/openstack/keystone/blob/f6c01dd1673b290578e9fff063e27104412ffeda/etc/policy.v3cloudsample.json</a></div><div>For any change in policy file, you don't need to restart the service. You only restart the service when you change the code in the server.</div><div><br></div><div>Thanks for all.</div><div><br></div><div>Amy Zhang</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jun 5, 2015 at 3:17 PM, Farhan Patwa <span dir="ltr"><<a href="mailto:farhan.patwa@gmail.com" target="_blank">farhan.patwa@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><br><div class="gmail_quote"><span style="font-size:large;font-weight:bold">Forwarded conversation</span><br>Subject: <b class="gmail_sendername">[openstack-dev] Kilo v3 identity problems</b><br>------------------------<br><br><span><font color="#888">From: <b>Amy Zhang</b> <span dir="ltr"><<a href="mailto:amy.u.zhang@gmail.com" target="_blank">amy.u.zhang@gmail.com</a>></span><br>Date: Wed, Jun 3, 2015 at 11:29 AM<br>To: "OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br></font><br></span><div><div class="h5"><br><div dir="ltr">Hi guys,<div><br></div><div>I have installed Kilo and try to use identity v3. I am using v3 policy file. I changed the domain_id for cloud admin as "default". As cloud admin, I tried "openstack domain list" and got the error message saying that I was not authorized.</div><div><br></div><div>The part I changed in policy.json:</div><div>
<p>"cloud_admin"<span>: </span>"rule:admin_required and domain_id:default"<span>,</span></p><p><span><br></span></p><p><span>The error I got from "openstack domain list":</span></p><p><span>
</span></p><p>ERROR: openstack You are not authorized to perform the requested action: identity:create_domain (Disable debug mode to suppress these details.) (HTTP 403) (Request-ID: req-2f42b1da-9933-4494-9b39-c1664d154377)</p><div><br></div><div>Has anyone tried identity v3 in Kilo? Did you have this problem? Any suggestions?</div><div><br></div><div>Thanks</div><span><font color="#888888"><div>Amy </div>-- <br><div>Best regards,<br>Amy (Yun Zhang)<br></div>
</font></span></div></div>
<br></div></div>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br><br>----------<br><span><font color="#888">From: <b>Rich Megginson</b> <span dir="ltr"><<a href="mailto:rmeggins@redhat.com" target="_blank">rmeggins@redhat.com</a>></span><br>Date: Wed, Jun 3, 2015 at 11:52 AM<br>To: "OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br></font><br></span><br>
<div bgcolor="#FFFFFF" text="#000000"><div></div>
Can you paste your policy file somewhere? Did you restart the
keystone service after changing your policy? Can you provide your
exactly openstack command line arguments and/or the rc file you
sourced into your shell environment before running openstack?<br>
<br>
<blockquote type="cite"><span class=""><span>
<div dir="ltr">
<div>
<div><br>
</div>
<div>Thanks</div>
<div>Amy </div>
-- <br>
<div>Best regards,<br>
Amy (Yun Zhang)<br>
</div>
</div>
</div>
<br>
<fieldset></fieldset>
<br>
</span></span><pre>__________________________________________________________________________
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: <a href="mailto:OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a>
</pre>
</blockquote>
<br>
</div>
<br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br><br>----------<br><span><font color="#888">From: <b>Lin Hua Cheng</b> <span dir="ltr"><<a href="mailto:os.lcheng@gmail.com" target="_blank">os.lcheng@gmail.com</a>></span><br>Date: Wed, Jun 3, 2015 at 1:00 PM<br>To: "OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br></font><br></span><br><div dir="ltr"><div>The command requires a domain scoped token.</div><div><br></div><div>Did you set the environment variable so that OSC uses a domain scoped token? This can be done by providing OS_DOMAIN_NAME instead of OS_PROJECT_NAME.</div><span><font color="#888888"><div><br></div><div>-Lin</div></font></span></div><div class="gmail_extra"><br><div class="gmail_quote"><div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div></div><span>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></span></blockquote></div><br></div>
<br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br><br>----------<br><span><font color="#888">From: <b>Dolph Mathews</b> <span dir="ltr"><<a href="mailto:dolph.mathews@gmail.com" target="_blank">dolph.mathews@gmail.com</a>></span><br>Date: Wed, Jun 3, 2015 at 1:16 PM<br>To: "OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br></font><br></span><br><div dir="ltr">I assume that by "v3 policy file" you're specifically referring to:<div><br></div><div> <a href="https://github.com/openstack/keystone/blob/f6c01dd1673b290578e9fff063e27104412ffeda/etc/policy.v3cloudsample.json" target="_blank">https://github.com/openstack/keystone/blob/f6c01dd1673b290578e9fff063e27104412ffeda/etc/policy.v3cloudsample.json</a></div><div><br></div><div>Which essentially illustrates enforcement of a much more powerful authorization model than most deployers are familiar with today. You'll need to create and consume a domain-based role assignment, for example (do you have a role assigned to your user on the "default" domain? Are you accessing "openstack domain list" with a domain-scoped token?).</div><div><br></div><div>Unless you're ready to experiment with that new policy model, the default policy file is also designed for v3 and it's behavior is probably what you're expecting:</div><div><br></div><div> <a href="https://github.com/openstack/keystone/blob/f6c01dd1673b290578e9fff063e27104412ffeda/etc/policy.json" target="_blank">https://github.com/openstack/keystone/blob/f6c01dd1673b290578e9fff063e27104412ffeda/etc/policy.json</a><br><div class="gmail_extra"><br></div><div class="gmail_extra">Perhaps "policy.v3cloudsample.json" is poorly named if it implies that it's somehow a pre-requisite to getting started with the v3 API?</div><div class="gmail_extra"><br><div class="gmail_quote"><div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div></div><span>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></span></blockquote></div><br></div></div></div>
<br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br><br>----------<br><span><font color="#888">From: <b>Steve Martinelli</b> <span dir="ltr"><<a href="mailto:stevemar@ca.ibm.com" target="_blank">stevemar@ca.ibm.com</a>></span><br>Date: Wed, Jun 3, 2015 at 2:20 PM<br>To: "OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>><br></font><br></span><br><tt><font size="2">Dolph Mathews <<a href="mailto:dolph.mathews@gmail.com" target="_blank">dolph.mathews@gmail.com</a>> wrote on
06/03/2015 02:16:55 PM:<br>
<br>
> From: Dolph Mathews <<a href="mailto:dolph.mathews@gmail.com" target="_blank">dolph.mathews@gmail.com</a>></font></tt>
<br><tt><font size="2">> To: "OpenStack Development Mailing List
(not for usage questions)" <br>
> <<a href="mailto:openstack-dev@lists.openstack.org" target="_blank">openstack-dev@lists.openstack.org</a>></font></tt>
<br><tt><font size="2">> Date: 06/03/2015 02:17 PM</font></tt>
<br><tt><font size="2">> Subject: Re: [openstack-dev] Kilo v3 identity
problems</font></tt>
<br><span><tt><font size="2">> <br>
> I assume that by "v3 policy file" you're specifically referring
to:</font></tt>
<br><tt><font size="2">> <br>
> </font></tt><a href="https://github.com/openstack/keystone/blob/" target="_blank"><tt><font size="2">https://github.com/openstack/keystone/blob/</font></tt></a><tt><font size="2"><br>
> f6c01dd1673b290578e9fff063e27104412ffeda/etc/policy.v3cloudsample.json</font></tt>
<br><tt><font size="2">> <br>
> Which essentially illustrates enforcement of a much more powerful
<br>
> authorization model than most deployers are familiar with today. <br>
> You'll need to create and consume a domain-based role assignment,
<br>
> for example (do you have a role assigned to your user on the <br>
> "default" domain? Are you accessing "openstack domain
list" with a <br>
> domain-scoped token?).</font></tt>
<br><tt><font size="2">> <br>
> Unless you're ready to experiment with that new policy model, the
<br>
> default policy file is also designed for v3 and it's behavior is <br>
> probably what you're expecting:</font></tt>
<br><tt><font size="2">> <br>
> </font></tt><a href="https://github.com/openstack/keystone/blob/" target="_blank"><tt><font size="2">https://github.com/openstack/keystone/blob/</font></tt></a><tt><font size="2"><br>
> f6c01dd1673b290578e9fff063e27104412ffeda/etc/policy.json</font></tt>
<br><tt><font size="2">> <br>
> Perhaps "policy.v3cloudsample.json" is poorly named if it
implies <br>
> that it's somehow a pre-requisite to getting started with the v3 API?</font></tt>
<br>
<br></span><font size="2" face="sans-serif">++ I think so, I've had to field many
questions and comments about folks using this file when they</font>
<br><font size="2" face="sans-serif">really just need the "usual"
one.<span><font color="#888888"><br>
<br>
Steve Martinelli<br>
OpenStack Keystone Core</font></span></font><br>__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br><br></div><br></div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature">Best regards,<br>Amy (Yun Zhang)<br></div>
</div>