<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Hello - I'm using Liberty release devstack for the below
scenario. I have created project "abcd" with "john" as Member.
I've launched one instance, I can use curl to list the instance.
No problem.</p>
<p>I then modify /etc/nova/policy.json and redefine "admin_or_owner"
as follows:</p>
<p> "admin_or_owner": "role:admin or is_admin:True or
project_id:%(project_id)s",<br>
</p>
<p>My expectation was that I would be able to list the instance in
abcd using a token of admin. However, when I use the token of user
"admin" in project "admin" to list the instances I get the
following error:</p>
<p><i>stack@vlab:~/token$ curl <a class="moz-txt-link-freetext" href="http://localhost:8774/v2.1/">http://localhost:8774/v2.1/</a></i><i><font
color="#cc0000">378a4b9e0b594c24a8a753cfa40ecc14</font></i><i>/servers/detail
-H "User-Agent: python-novaclient" -H "Accept: application/json"
-H "X-OpenStack-Nova-API-Version: 2.6" -H "X-Auth-Token:
f221164cd9b44da6beec70d6e1f3382f"</i><i><br>
</i><i>{"badRequest": {"message": "Malformed request URL: URL's
project_id '</i><i><font color="#cc0000">378a4b9e0b594c24a8a753cfa40ecc14</font></i><i>'
doesn't match Context's project_id '</i><i><font color="#cc0000">f73175d9cc8b4fb58ad22021f03bfef5</font></i><i>'",
"code": 400}}</i></p>
<p>378a4b9e0b594c24a8a753cfa40ecc14 is project id of abcd and
f73175d9cc8b4fb58ad22021f03bfef5 is project id of admin.</p>
<p>I'm confused by this behavior and the reported error, because if
the project id used to acquire the token is the same as the
project id in /servers/detail then I would be an "owner". So where
is the "admin" in "admin_or_owner"? Shouldn't the "role:admin"
allow me to do whatever functionality "rule:admin_or_owner" allows
in policy.json, regardless of the project id used to acquire the
token?</p>
<p>I do understand that I can use the admin user and project to get
all instances of all tenants:<br>
<i>curl
<a class="moz-txt-link-freetext" href="http://localhost:8774/v2.1/f73175d9cc8b4fb58ad22021f03bfef5/servers/detail?all_tenants=1">http://localhost:8774/v2.1/f73175d9cc8b4fb58ad22021f03bfef5/servers/detail?all_tenants=1</a>
-H "User-Agent: python-novaclient" -H "Accept: application/json"
-H "X-OpenStack-Nova-API-Version: 2.6" -H "X-Auth-Token: $1"</i><br>
</p>
<p>My question is more centered around why nova has the additional
check to make sure that the token project id matches the url
project id - and whether this is a keystone requirement, or only
nova/cinder and programs that have a project-id in their API
choose to do this. In other words, is it the developers of each
project that decide to only expose some APIs for administrative
functionality (such all-tenants), but restrict everything else to
owners, or keystone requires this check?<br>
</p>
<p>Thanks,</p>
<p>Reza<br>
</p>
</body>
</html>