<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000">Hi there,<br></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000">I know that it's not the default configuration for openstack nor tempest but I need to make a script that test user isolation _inside_ the same tenant.<br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000">Some of our users are in the same tenant but they must not interfere with each others.</div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000">We have modified the nova policy rules and we must test these policies (the default one is : "rule:admin_or_user").<br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000">We are using tempest as a base tool with pre-provisioned credentials (cannot use admin account for security reasons)<br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000">First thought was "easy" : load tempest with pre-created users via account.yaml file, all in the same tenant, and launch 'tempest.api.compute.test_authorization' that contains almost what we need to test.<br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000">But we ran into the "BadAltAuth" exception and I don't know how to get rid of it except breaking the tempest_lib (skipping/commenting this exception)<br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000">This exception is thrown when the accounts used in tempest have the same auth url.<br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000">I tried another approach, without alt_authentication :<br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000">From a prompt, I'm launching a test that creates a test_server and export its ID, then wait until the timeout value (default to 500s)<br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000">From another prompt, I launch the real test that get the server ID and try to delete it. But the same BadAltAuth thing happen...<br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000">(I'm using an account file with 2 different users in the same tenant and with the locking mechanism, the logic is using both accounts for this group of tests)<br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000">So I'm asking here if someone have a clue to help us ?<br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000">It could be some kind of rewrite of tempest_lib/auth regarding this BadAltAuth, throwing a warning instead of a critical exception.<br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000">Thank you all for your time answering this,<br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000">Regards,<br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000">Vincent<br data-mce-bogus="1"></div></div></body></html>