<div dir="ltr">On Fri, Jun 16, 2017 at 7:03 PM, Zane Bitter <span dir="ltr"><<a href="mailto:zbitter@redhat.com" target="_blank">zbitter@redhat.com</a>></span> wrote:<br>[snip]<span class="gmail-"></span><br><span class="gmail-"></span><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-">
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
I'm not sure whether this works with keystone v2 and anyone is using<br>
it or not. Keeping in mind that heat-cli is deprecated and keystone<br>
v3 is now the default, we've 2 options<br>
<br>
1. Continue to support 'deferred_auth_method=passswor<wbr>d' option and<br>
fix all the above issues.<br>
<br>
2. Remove/deprecate the option in pike itlsef.<br>
<br>
I would prefer option 2, but probably I miss some history and use<br>
cases for it.<br>
</blockquote>
<br></span>
Am I right in thinking that any user (i.e. not just the [heat] service user) can create a trust? I still see occasional requests about 'standalone mode' for clouds that don't have Heat available to users (which I suspect is broken, otherwise people wouldn't be asking), and I'm guessing that standalone mode has heretofore required deferred_auth_method=password.<br></blockquote><div><br></div><div>I think standalone heat is broken in more than one way based on my testing. It seems changes have not kept up with heat standalone as 'authpassword' middleware is broken[1] and we don't seem to pass correct domain details in the rpc context. I've tried to fix them in[2].<br><br>I'm also not sure why heat standalone historically restricts deferred_auth_method to 'password'[3]. It seems to work well with 'trusts' though. <br><br><br>[1] <a href="https://bugs.launchpad.net/heat/+bug/1699418">https://bugs.launchpad.net/heat/+bug/1699418</a><br>[2] <a href="https://review.openstack.org/#/c/476014/">https://review.openstack.org/#/c/476014/</a><br>[3] <a href="https://github.com/openstack/heat/blob/master/devstack/lib/heat#L74">https://github.com/openstack/heat/blob/master/devstack/lib/heat#L74</a><br><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
So if we're going to remove the option then we should probably either officially disown standalone mode or rewrite the instructions such that it can be used with the trusts method.<br>
<br></blockquote><div>I think disowning the standalone mode would be an easier option. Probably we should rewrite the instructions for it to be used with 'trusts' method as it seems to work, unless I miss something. However, without any testing at the gate we would surely break it from time to time.<br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
cheers,<br>
Zane.<div class="gmail-HOEnZb"><div class="gmail-h5"><br>
<br>
______________________________<wbr>______________________________<wbr>______________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.op<wbr>enstack.org?subject:unsubscrib<wbr>e</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi<wbr>-bin/mailman/listinfo/openstac<wbr>k-dev</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div dir="ltr"><div>Regards,</div>Rabi Mishra<div><br></div></div></div>
</div></div>