<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
I am guessing <a href="http://Salesforce.com">Salesforce.com</a>
<div><br>
<div>
<div>On Jul 16, 2011, at 2:40 PM, Ziad Sawalha wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div bgcolor="#FFFFFF"><font style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">What's (who is) sfdc?<br>
</font><br>
<br>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<font style="font-size:10.0pt;font-family:"Tahoma","sans-serif""><b>From</b>: andi abes [mailto:andi.abes@gmail.com]
<br>
<b>Sent</b>: Friday, July 15, 2011 02:07 PM<br>
<b>To</b>: Yuriy Taraday <<a href="mailto:yorik.sar@gmail.com">yorik.sar@gmail.com</a>>
<br>
<b>Cc</b>: <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a> <<a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>>
<br>
<b>Subject</b>: Re: [Openstack] Keystone tenants vs. Nova projects <br>
</font> <br>
</div>
<div>I guess sfdc disagrees with you - they allow e.g Dell to use a single sign on to authenticate to their services - as a @dell user, you can login with the same email/password to internal resources as well as sfdc ones. ( in case it's not obvious - you also
update your password in one location - the Dell AD directory)<br>
<br>
On Jul 15, 2011, at 14:14, Yuriy Taraday <<a href="mailto:yorik.sar@gmail.com">yorik.sar@gmail.com</a>> wrote:<br>
<br>
</div>
<div></div>
<blockquote type="cite">
<div>Currently there is a basic skeleton for only one backend (identity store) configuration per Keystone instance. It can be either DB or LDAP (the latter is almost done).
<div>May be in future we should be somehow able to specify not only tenants but also an backend for each authentication request.</div>
<div>But I cannot imagine a real use case for that. All identities should be stored in one place. I doubt that it'll be useful to keep different users and/or tenants (or roles or whatever) in different stores. There usually is one single central repository,
DB, LDAP or may be some billing system. If we have two isolated systems, we should consider using two separate auth services.<br clear="all">
<br>
<div>Kind regards, Yuriy.</div>
<br>
<br>
<div class="gmail_quote">On Fri, Jul 15, 2011 at 21:40, andi abes <span dir="ltr">
<<a href="mailto:andi.abes@gmail.com"></a><a href="mailto:andi.abes@gmail.com">andi.abes@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
Yuriy,
<div><br>
</div>
<div>a use-case scenario for keystone would be a service provider servicing large customers with their own authentication infrastructure (e.g. LDAP/ AD etc). Obviously, different tenants have different instances. To authenticate a user, the correct authentication
back end must be selected.</div>
<div><br>
</div>
<div>In your model, how would a service provide be able to allow delegated authentication to different customers? </div>
<div><br>
</div>
<div><br>
<div class="gmail_quote">
<div>
<div></div>
<div class="h5">On Fri, Jul 15, 2011 at 1:37 AM, Yuriy Taraday <span dir="ltr"><<a href="mailto:yorik.sar@gmail.com" target="_blank"></a><a href="mailto:yorik.sar@gmail.com">yorik.sar@gmail.com</a>></span> wrote:<br>
</div>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div></div>
<div class="h5">I think, there should not be such thing as default tenant.
<div>If user does not specify tenant in authentication data, ones token should not be bound to any tenant, and user should have access to resources based on global role assignments.</div>
<div>If user specify tenant, one should be either explicitly bound to tenant (probably through UserRoleAssignment model, but it is not the best way) or in some global role. Then one will have access to resources based on global role assignments and tenant role
assignments.</div>
<div>I'm not sure whether users should be added to a tenant and then to roles in this tenant or we should remove totally direct link between user and tenant, so that user is in tenant if and only if one is in any role in this tenant.<br clear="all">
<br>
<div>Kind regards, Yuriy.</div>
<div>
<div></div>
<div>
<div><br>
</div>
<br>
<div class="gmail_quote">On Fri, Jul 15, 2011 at 00:07, Nguyen, Liem Manh <span dir="ltr">
<<a href="mailto:liem_m_nguyen@hp.com" target="_blank"></a><a href="mailto:liem_m_nguyen@hp.com">liem_m_nguyen@hp.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">When one creates a user, should a user always have a tenant associated with her? If that’s the case, then the “default” tenant is the tenant that the user is associated with at creation time?
Sorry for responding to the question with another question, but it is unclear for me from looking at the model (there is no non-null constraint on the tenant_id fk on the user table).<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">Thanks,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">Liem<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt">From:</span></b><span style="font-size:10.0pt"> openstack-bounces+liem_m_nguyen=<a href="http://hp.com/" target="_blank"></a><a href="http://hp.com/">hp.com</a>@<a href="http://lists.launchpad.net/" target="_blank"></a><a href="http://lists.launchpad.net/">lists.launchpad.net</a>
[mailto:<a href="mailto:openstack-bounces%2Bliem_m_nguyen" target="_blank">openstack-bounces+liem_m_nguyen</a>=<a href="http://hp.com/" target="_blank"></a><a href="http://hp.com/">hp.com</a>@<a href="http://lists.launchpad.net/" target="_blank"></a><a href="http://lists.launchpad.net/">lists.launchpad.net</a>]
<b>On Behalf Of </b>Ziad Sawalha<br>
<b>Sent:</b> Thursday, July 14, 2011 12:22 PM</span></p>
<div>
<div></div>
<div><br>
<b>To:</b> Rouault, Jason (Cloud Services); Yuriy Taraday; <a href="mailto:openstack@lists.launchpad.net" target="_blank">
</a><a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
<b>Subject:</b> Re: [Openstack] Keystone tenants vs. Nova projects<u></u><u></u></div>
</div>
<div><br class="webkit-block-placeholder">
</div>
</div>
</div>
<div>
<div></div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">In the example I gave below they are not members of any group and have no roles assigned to them. Should they still be authenticated?<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><u></u> <u></u></span></p>
</div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;color:black">From: </span></b><span style="font-size:11.0pt;color:black">"Rouault, Jason (Cloud Services)" <<a href="mailto:jason.rouault@hp.com" target="_blank"></a><a href="mailto:jason.rouault@hp.com">jason.rouault@hp.com</a>><br>
<b>Date: </b>Thu, 14 Jul 2011 16:25:22 +0000<br>
<b>To: </b>Ziad Sawalha <<a href="mailto:ziad.sawalha@rackspace.com" target="_blank"></a><a href="mailto:ziad.sawalha@rackspace.com">ziad.sawalha@rackspace.com</a>>, Yuriy Taraday <<a href="mailto:yorik.sar@gmail.com" target="_blank"></a><a href="mailto:yorik.sar@gmail.com">yorik.sar@gmail.com</a>>,
"<a href="mailto:openstack@lists.launchpad.net" target="_blank"></a><a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>" <<a href="mailto:openstack@lists.launchpad.net" target="_blank"></a><a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>><br>
<b>Subject: </b>RE: [Openstack] Keystone tenants vs. Nova projects<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"><u></u> <u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">A user can specify a tenantID at the time of authentication. If no tenantID is specified during authentication, then I would expect the ‘default’ tenant for the user would apply. The capabilities
of User1 on TenantA (in this case the default tenant for the user) would be determined by their role and group assignments within the context of TenantA.
</span><span style="color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span><span style="color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">Jason</span><span style="color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span><span style="color:black"><u></u><u></u></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:black">From:</span></b><span style="font-size:10.0pt;color:black"> Ziad Sawalha [<a href="mailto:ziad.sawalha@rackspace.com" target="_blank"></a><a href="mailto:ziad.sawalha@rackspace.com">mailto:ziad.sawalha@rackspace.com</a>]
<br>
<b>Sent:</b> Wednesday, July 13, 2011 10:35 PM<br>
<b>To:</b> Rouault, Jason (Cloud Services); Yuriy Taraday; <a href="mailto:openstack@lists.launchpad.net" target="_blank">
</a><a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
<b>Subject:</b> Re: [Openstack] Keystone tenants vs. Nova projects</span><span style="color:black"><u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span style="color:black"> <u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">What if:</span><span style="color:black"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><u></u><u></u></span></p>
</div>
<div>
<p><span style="font-size:11.0pt;color:#1F497D">-</span><span style="font-size:7.0pt;color:#1F497D"> </span><span style="font-size:11.0pt;color:#1F497D">User1 has TenantA as her default tenant</span><span style="color:black"><u></u><u></u></span></p>
<p><span style="color:black"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Should the service authenticate the user against TenantA? And if so, why? What does the 'default tenant' grant User1 on TenantA? It's some nebulous, implied role…</span><span style="color:black"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><u></u><u></u></span></p>
</div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;color:black">From: </span></b><span style="font-size:11.0pt;color:black">"Rouault, Jason (Cloud Services)" <<a href="mailto:jason.rouault@hp.com" target="_blank"></a><a href="mailto:jason.rouault@hp.com">jason.rouault@hp.com</a>><br>
<b>Date: </b>Wed, 13 Jul 2011 13:18:44 +0000<br>
<b>To: </b>Ziad Sawalha <<a href="mailto:ziad.sawalha@rackspace.com" target="_blank"></a><a href="mailto:ziad.sawalha@rackspace.com">ziad.sawalha@rackspace.com</a>>, Yuriy Taraday <<a href="mailto:yorik.sar@gmail.com" target="_blank"></a><a href="mailto:yorik.sar@gmail.com">yorik.sar@gmail.com</a>>,
"<a href="mailto:openstack@lists.launchpad.net" target="_blank"></a><a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>" <<a href="mailto:openstack@lists.launchpad.net" target="_blank"></a><a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>><br>
<b>Subject: </b>RE: [Openstack] Keystone tenants vs. Nova projects</span><span style="color:black"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><u></u><u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">If a user is bound to their default tenant, why wouldn’t any role assignments for that user in their default tenant apply?</span><span style="color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span><span style="color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="color:black"> <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">User1 authenticates specifying TenantB, this binds User1 into the context of TenantB. In subsequent web service requests using the token received after authentication, the Auth component filter
would decorate the headers with RoleY.</span><span style="color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">If User1 authenticates specifying TenantA, or specifying no Tenant, this binds User1 into the context of TenantA. The headers would then be decorated with RoleX.</span><span style="color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span><span style="color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D">Jason</span><span style="color:black"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:#1F497D"> </span><span style="color:black"><u></u><u></u></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;color:black">From:</span></b><span style="font-size:10.0pt;color:black">
<a href="mailto:openstack-bounces+jason.rouault=hp.com@lists.launchpad.net" target="_blank">
</a><a href="mailto:openstack-bounces+jason.rouault=hp.com@lists.launchpad.net">openstack-bounces+jason.rouault=hp.com@lists.launchpad.net</a> [<a href="mailto:openstack-bounces+jason.rouault=hp.com@lists.launchpad.net" target="_blank"></a><a href="mailto:openstack-bounces+jason.rouault=hp.com@lists.launchpad.net">mailto:openstack-bounces+jason.rouault=hp.com@lists.launchpad.net</a>]
<b>On Behalf Of </b>Ziad Sawalha<br>
<b>Sent:</b> Tuesday, July 12, 2011 10:09 PM<br>
<b>To:</b> Yuriy Taraday; <a href="mailto:openstack@lists.launchpad.net" target="_blank">
</a><a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
<b>Subject:</b> Re: [Openstack] Keystone tenants vs. Nova projects</span><span style="color:black"><u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span style="color:black"> <u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Our goal is to support Nova use cases right now. You can provide access to multiple tenants using a role assignment (assigning a user a role on a specific tenant effectively binds them to that
tenant).</span><span style="color:black"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">However, this raises the issue of what the 'implied' role of a user is when they are bound to their
<i>default</i> tenant. So we're considering how to alter the model to clean that up. No great solution yet. Any suggestions are welcome….</span><span style="color:black"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Ziad</span><span style="color:black"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><u></u><u></u></span></p>
</div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;color:black">From: </span></b><span style="font-size:11.0pt;color:black">Yuriy Taraday <<a href="mailto:yorik.sar@gmail.com" target="_blank"></a><a href="mailto:yorik.sar@gmail.com">yorik.sar@gmail.com</a>><br>
<b>Date: </b>Tue, 28 Jun 2011 16:59:08 +0400<br>
<b>To: </b><<a href="mailto:openstack@lists.launchpad.net" target="_blank"></a><a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>><br>
<b>Subject: </b>[Openstack] Keystone tenants vs. Nova projects</span><span style="color:black"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black"> </span><span style="color:black"><u></u><u></u></span></p>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Currently Keystone model assumes that user is bound to exactly one tenant. It conflicts with the fact that in Nova user can have access to several projects.
</span><span style="color:black"><u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Which way will it be?<br clear="all">
</span><span style="color:black"><u></u><u></u></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Kind regards, Yuriy.</span><span style="color:black"><u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">_______________________________________________ Mailing list:
<a href="https://launchpad.net/~openstack" target="_blank"></a><a href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a> Post to :
<a href="mailto:openstack@lists.launchpad.net" target="_blank"></a><a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a> Unsubscribe :
<a href="https://launchpad.net/~openstack" target="_blank"></a><a href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a> More help :
<a href="https://help.launchpad.net/ListHelp" target="_blank"></a><a href="https://help.launchpad.net/ListHelp">https://help.launchpad.net/ListHelp</a>
</span><span style="font-size:10.5pt;font-family:"Courier New";color:black">This email may include confidential information. If you received it in error, please delete it.</span><span style="color:black"><u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Courier New";color:black">This email may include confidential information. If you received it in error, please delete it.</span><span style="color:black"><u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Courier New";color:black">This email may include confidential information. If you received it in error, please delete it.</span><span style="font-size:10.5pt;color:black"><u></u><u></u></span></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
<div><span>-- PASS THROUGH -- </span></div>
</div>
<br>
</div>
</div>
_______________________________________________
<div class="im"><br>
Mailing list: <a href="https://launchpad.net/~openstack" target="_blank"></a><a href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank"></a><a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank"></a><a href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank"></a><a href="https://help.launchpad.net/ListHelp">https://help.launchpad.net/ListHelp</a><br>
<br>
</div>
</blockquote>
</div>
<br>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</blockquote>
<font face="monospace">This email may include confidential information. If you received it in error, please delete it.</font></div>
_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp">https://help.launchpad.net/ListHelp</a><br>
</blockquote>
</div>
<br>
</div>
<font face="monospace">This email may include confidential information. If you received it in error, please delete it.</font></body>
</html>