<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Hi all,</div>
<div> </div>
<div>I’m playing around with a Swift cluster (Liberty) and cannot get the Swift ACL’s to work. My objective is to give users from one project (and thus Swift account?) selective access to specific containers in another project.</div>
<div> </div>
<div><font size="3"><span style="font-size:12pt;">According to <a href="http://docs.openstack.org/developer/swift/middleware.html#keystoneauth"><font color="#0563C1"><u>http://docs.openstack.org/developer/swift/middleware.html#keystoneauth</u></font></a>, the<font size="2"><span style="font-size:11pt;">
swift/keystoneauth plugin should support cross-tenant (now cross-project) ACL’s by setting the read-acl of a container to something like:</span></font></span></font></div>
<div> </div>
<div><font face="Lucida Console" size="3"><span style="font-size:12pt;">swift post <containername> --read-acl '<projectname>:<username>'</span></font></div>
<div><font face="Lucida Console" size="3"><span style="font-size:12pt;"> </span></font></div>
<div><font size="3"><span style="font-size:12pt;">Using a project name instead of a UUID should be supported if all projects are in the default domain. </span></font></div>
<div> </div>
<div>But if I set this for a user in a different project / different swift account, it doesn’t seem to work. The last reference to Swift container ACL’s from the archives is somewhere in 2011.. </div>
<div> </div>
<div>I have found a few Swift ACL examples / tutorials online, but they are all outdated or appear to use special / proprietary middleware. Does anybody have (or can anybody create) an example that is up-to-date for OpenStack Liberty or later, and shows container
ACL’s together with Keystone integration? </div>
<div> </div>
<div>What I would like to do:</div>
<div>- I have a bunch of users and projects in Keystone, and thus a bunch of (automatically created) Swift accounts</div>
<div>- I would like to allow one specific user in a project (say project X) to access a container from a different project (Y)</div>
<div>- And/or, I would like to allow all users in project X to access one specific container in project Y. </div>
<div>Both these options should include listing the objects in the container, but exclude listing all containers in the other account.</div>
<div> </div>
<div>I hope there is someone who can help, thanks a lot in advance!</div>
<div> </div>
<div>With kind regards,</div>
<div>Pieter van Wijngaarden</div>
<div>System Architect</div>
<div>Digital Pathology Solutions</div>
<div>Philips Healthcare</div>
<div> </div>
<div>Veenpluis 4-6, Building QY-2.006, 5684 PC Best</div>
<div>Tel: +31 6 2958 6736, Email: pieter.van.wijngaarden@philips.com </div>
<div> </div>
<div> </div>
<div> </div>
<div><font face="Times New Roman" size="3"><span style="font-size:12pt;"><br>
</span></font></div>
<div><font face="Times New Roman" size="3"><span style="font-size:12pt;"><u> ________________________________ </u></span></font></div>
<div><font face="Arial" size="1" color="gray"><span style="font-size:7.5pt;">The information contained in this message may be confidential and legally protected under applicable law. The message is intended solely for the addressee(s). If you are not the intended
recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message is strictly prohibited and may be unlawful. If you are not the intended recipient, please contact the sender by return e-mail and destroy all copies
of the original message.<br>
</span></font></div>
</span></font>
</body>
</html>