<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>+1 <strong>
<div><font face="Tahoma" color="#000000" size="2"> </font></div>
</strong>
<hr tabindex="-1">
<font face="Tahoma" size="2"><b>From:</b> Adam Young<br>
<b>Sent:</b> Friday, September 04, 2015 7:43:08 PM<br>
<b>To:</b> openstack-dev@lists.openstack.org<br>
<b>Subject:</b> Re: [openstack-dev] This is what disabled-by-policy should look like to the user<br>
</font><br>
<div></div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">On 09/04/2015 10:04 AM, Monty Taylor wrote:<br>
> mordred@camelot:~$ neutron net-create test-net-mt<br>
> Policy doesn't allow create_network to be performed.<br>
><br>
> Thank you neutron. Excellent job.<br>
><br>
> Here's what that looks like at the REST layer:<br>
><br>
> DEBUG: keystoneclient.session RESP: [403] date: Fri, 04 Sep 2015 <br>
> 13:55:47 GMT connection: close content-type: application/json; <br>
> charset=UTF-8 content-length: 130 x-openstack-request-id: <br>
> req-ba05b555-82f4-4aaf-91b2-bae37916498d<br>
> RESP BODY: {"NeutronError": {"message": "Policy doesn't allow <br>
> create_network to be performed.", "type": "PolicyNotAuthorized", <br>
> "detail": ""}}<br>
><br>
> As a user, I am not confused. I do not think that maybe I made a <br>
> mistake with my credentials. The cloud in question simply does not <br>
> allow user creation of networks. I'm fine with that. (as a user, that <br>
> might make this cloud unusable to me - but that's a choice I can now <br>
> make with solid information easily. Turns out, I don't need to create <br>
> networks for my application, so this actually makes it easier for me <br>
> personally)<br>
><br>
> In any case- rather than complaining and being a whiny brat about <br>
> something that annoys me - I thought I'd say something nice about <br>
> something that the neutron team has done that especially pleases me.<br>
<br>
Then let my Hijack:<br>
<br>
Policy is still broken. We need the pieces of Dynamic policy.<br>
<br>
I am going to call for a cross project policy discussion for the <br>
upcoming summit. Please, please, please all the projects attend. The <br>
operators have made it clear they need better policy support.<br>
<br>
<br>
> I would love it if this became the experience across the board in <br>
> OpenStack for times when a feature of the API is disabled by local <br>
> policy. It's possible it already is and I just haven't directly <br>
> experienced it - so please don't take this as a backhanded <br>
> condemnation of anyone else.<br>
><br>
> Monty<br>
><br>
> __________________________________________________________________________ <br>
><br>
> OpenStack Development Mailing List (not for usage questions)<br>
> Unsubscribe: <br>
> OpenStack-dev-request@lists.openstack.org?subject:unsubscribe<br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br>
<br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: OpenStack-dev-request@lists.openstack.org?subject:unsubscribe<br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</div>
</span></font>
</body>
</html>