<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi again,<div class="">After some struggling I modified policies so most of them works fine. But I have problem with identity: create_user and identity: create_group.</div><div class=""><br class=""></div><div class="">In the case of create group I can do it from Horizon (domain_admin user), but I can’t do it from CLI (with command Openstack group create —domain <span style="font-size: 12px;" class="">3a08xxxx82c1 SOME_GROUP_NAME) </span>and I was wondering why. After analyzing logs it turned out, that tokens from Horizon and CLI are different! The one from CLI does not contain domain_id (which I specify from CLI???), while the one from Horizon contains it, and there is a match for policy rules.</div><div class=""><br class=""></div><div class=""><b class="">Token from CLI:</b></div><div class=""><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">DEBUG keystone.server.flask.request_processing.middleware.auth_context</div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">[req-b00bccae-c3d2-4a53-a8e2-bd9b0bbdfd84</div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">9adbxxxx02ef</div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">61d4xxxx9c0f <b class=""><- user default Project_ID here</b></div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">- 3a08xxxxb82c1 3a08xxxx82c1] RBAC: auth_context: {'token': <TokenModel (audit_id=1JdN5qJXReutPgsp5r0DMw, audit_chain_id=['1JdN5qJXReutPgsp5r0DMw']) at 0x7f38b2210ca0>,</div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'domain_id': None, <b class=""><- no domain_id</b></div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'trust_id': None,</div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'trustor_id': None,</div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'trustee_id': None,</div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'domain_name': None, <b class=""><- no domain name</b></div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'group_ids': [],</div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'user_id': '9adbxxxx02ef',</div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'user_domain_id': '3a08xxxx82c1',</div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'system_scope': None,</div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'project_id': '61d4xxxx9c0f',<b class=""><- user default Project_ID here</b></div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'project_domain_id': '3a08xxxx82c1’, <b class=""><- default user project domain_id</b></div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'roles': ['reader', 'member', 'project_admin', 'domain_admin'],</div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'is_admin_project': True,</div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'service_user_id': None,</div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'service_user_domain_id': None,</div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'service_project_id': None,</div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'service_project_domain_id': None,</div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class="">'service_roles': []} fill_context /var/lib/kolla/venv/lib/python3.8/site-packages/keystone/server/flask/request_processing/middleware/auth_context.py:478</div></div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class=""><br class=""></div><div style="margin: 0px; font-stretch: normal; font-size: 12px; line-height: normal;" class=""><b class="">Token from Horizon:</b></div><div style="margin: 0px; font-stretch: normal; line-height: normal;" class=""><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">DEBUG keystone.server.flask.request_processing.middleware.auth_context</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">[req-aeeec218-fe13-4048-98a7-3240df0dacae</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">9adbxxxxb02ef</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal; min-height: 14px;" class=""><b class=""><- no user default Project_ID here</b></div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">- 3a08xxxx82c1 3a08xxxx82c1 -] RBAC: auth_context: {'token': <TokenModel (audit_id=8bHfrpZjQPihquFwJew7oQ, audit_chain_id=['8bHfrpZjQPihquFwJew7oQ', 'j0X6mtDHSFG8NDTBT52vcw']) at 0x7f38b205e880>,</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'domain_id': '3a08xxxx82c1’, <b class=""><- domain_id</b></div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'trust_id': None,</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'trustor_id': None,</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'trustee_id': None,</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'domain_name': ’some_domain’, <b class=""><- domain name</b></div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'group_ids': [],</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'user_id': '9adbxxxx02ef',</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'user_domain_id': '3a08xxxx82c1',</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'system_scope': None,</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'project_id': None,<b class=""><- no user default Project_ID here</b></div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'project_domain_id': None,<b class=""><- default user project domain_id</b></div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'roles': ['member', 'domain_admin', 'project_admin', 'reader'],</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'is_admin_project': False,</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'service_user_id': None,</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'service_user_domain_id': None,</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'service_project_id': None,</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'service_project_domain_id': None,</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">'service_roles': []} fill_context /var/lib/kolla/venv/lib/python3.8/site-packages/keystone/server/flask/request_processing/middleware/auth_context.py:478</div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class=""><br class=""></div><div style="font-size: 12px; margin: 0px; font-stretch: normal; line-height: normal;" class="">The policy rules:</div><div style="margin: 0px; font-stretch: normal; line-height: normal;" class=""><span style="font-size: 12px;" class="">"identity:create_group": "rule:cloud_admin or rule:admin_and_matching_target_group_domain_id”,</span></div><div style="margin: 0px; font-stretch: normal; line-height: normal;" class=""><span style="font-size: 12px;" class="">"admin_and_matching_target_group_domain_id": "rule:admin_required and domain_id:%(target.group.domain_id)s”,</span></div><div style="margin: 0px; font-stretch: normal; line-height: normal;" class=""><span style="font-size: 12px;" class="">"admin_required": "role:admin or role:domain_admin or role:project_admin",</span></div></div><div class=""><div><br class=""></div><div><b class="">CLI user openrc file:</b></div><div><div>export OS_AUTH_URL=<a href="http://some-fancy-url:5000" class="">http://some-fancy-url:5000</a></div><div>export OS_PROJECT_ID=61d4xxxx9c0f</div><div>export OS_PROJECT_NAME=„some_project_name"</div><div>export OS_USER_DOMAIN_NAME=„some_domain"</div><div>if [ -z "$OS_USER_DOMAIN_NAME" ]; then unset OS_USER_DOMAIN_NAME; fi</div><div>export OS_PROJECT_DOMAIN_ID="3a08xxxx82c1"</div><div>if [ -z "$OS_PROJECT_DOMAIN_ID" ]; then unset OS_PROJECT_DOMAIN_ID; fi</div><div>unset OS_TENANT_ID</div><div>unset OS_TENANT_NAME</div><div>export OS_USERNAME=„some_user"</div><div>echo "Please enter your OpenStack Password for project $OS_PROJECT_NAME as user $OS_USERNAME: "</div><div>read -sr OS_PASSWORD_INPUT</div><div>export OS_PASSWORD=$OS_PASSWORD_INPUT</div><div>export OS_REGION_NAME="RegionOne"</div><div>if [ -z "$OS_REGION_NAME" ]; then unset OS_REGION_NAME; fi</div><div>export OS_INTERFACE=public</div><div>export OS_IDENTITY_API_VERSION=3</div></div><div><br class=""></div><div>How to put domain_id into CLI token if —domain xxxxx doesn’t do that? The same situation is with create_user. And the best part - ofcource cloud_admin=admin is able to do both, because he don’t need to be checked against domain_id. Ofcourse there is also some kind of a bug, that prevents displaying „Create user” button in the horizon interface, but when you eneter direct link (…/users/create) you can create user. After some struggling with horizon (as suggested here: <a href="https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/575272/1/templates/mitaka/keystonev3_policy.json#b38" class="">https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/575272/1/templates/mitaka/keystonev3_policy.json#b38</a>) „create group” button showed up, but not "create user” - not even for admin user…</div><div>What’s wrong??</div><div><br class=""></div><div>Best regards</div><div>Adam</div><div><br class=""></div><div><br class=""><blockquote type="cite" class=""><div class="">Wiadomość napisana przez Mark Goddard <<a href="mailto:mark@stackhpc.com" class="">mark@stackhpc.com</a>> w dniu 30.03.2021, o godz. 12:51:</div><br class="Apple-interchange-newline"><div class=""><div class="">On Tue, 30 Mar 2021 at 10:52, Adam Tomas <<a href="mailto:bkslash@poczta.onet.pl" class="">bkslash@poczta.onet.pl</a>> wrote:<blockquote type="cite" class=""><br class="">Without any custom policies when I look inside the horizon container I see (in /etc/openstack-dashboard) current/default policies. If I override (for example keystone_policy.json) with a file placed in /etc/kolla/config/horizon which contains only 3 rules, then after kolla-ansible reconfigure inside horizon container there is of course keystone_police.json file, but only with my 3 rules - should I assume, that previously seen default rules (other than the ones overridden by my rules) still works, whether I see them in the file or not?<br class=""></blockquote></div></div></blockquote></div><br class=""></div></body></html>