<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>I know there is a middleware piece: <a href="https://github.com/rackspace/keystone/blob/master/keystone/middleware/swift_auth.py">https://github.com/rackspace/keystone/blob/master/keystone/middleware/swift_auth.py</a></div>
<div><br>
</div>
<div>I'll defer to the swift folks on the other parts…</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>"Khandeshi, Divyesh" <<a href="mailto:divyesh.khandeshi@hp.com">divyesh.khandeshi@hp.com</a>><br>
<span style="font-weight:bold">Date: </span>Mon, 18 Jul 2011 15:47:31 +0100<br>
<span style="font-weight:bold">To: </span>Ziad Sawalha <<a href="mailto:ziad.sawalha@rackspace.com">ziad.sawalha@rackspace.com</a>>, "<a href="mailto:'openstack@lists.launchpad.net">'openstack@lists.launchpad.net</a>'" <<a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>><br>
<span style="font-weight:bold">Subject: </span>RE: [Openstack] [Keystone] [Swift] Keystone Tenant vs Swift Account<br>
</div>
<div><br>
</div>
<div xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:Consolas;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:551691647;
mso-list-type:hybrid;
mso-list-template-ids:-1310448326 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:Consolas;color:#1F497D">Ziad,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><span style="font-family:Consolas;color:#1F497D"><span style="mso-list:Ignore">1.<span style="font:7.0pt "Times New Roman"">
</span></span></span><span style="font-family:Consolas;color:#1F497D">You mention that Nova has a shim for lazy syncing of accounts with Keystone. What about Swift? Or the account_autocreate (in proxy-server.conf) the only option to achieve this?<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><span style="font-family:Consolas;color:#1F497D"><span style="mso-list:Ignore">2.<span style="font:7.0pt "Times New Roman"">
</span></span></span><span style="font-family:Consolas;color:#1F497D">As to the Rackspace dashboard, what API does it use for provisioning? Is it a Rackspace-only API or some undocumented/unexposed Account management API in Swift?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas;color:#1F497D">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas;color:#1F497D">Divyesh<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:Consolas;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">
<a href="mailto:openstack-bounces+divyesh.khandeshi=hp.com@lists.launchpad.net">openstack-bounces+divyesh.khandeshi=hp.com@lists.launchpad.net</a> [<a href="mailto:openstack-bounces+divyesh.khandeshi=hp.com@lists.launchpad.net">mailto:openstack-bounces+divyesh.khandeshi=hp.com@lists.launchpad.net</a>]
<b>On Behalf Of </b>Ziad Sawalha<br>
<b>Sent:</b> Saturday, July 16, 2011 3:30 PM<br>
<b>To:</b> Nguyen, Liem Manh; <a href="mailto:'openstack@lists.launchpad.net">'openstack@lists.launchpad.net</a>'<br>
<b>Subject:</b> Re: [Openstack] [Keystone] [Swift] Keystone Tenant vs Swift Account<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Swift account and tenant should be the same. This does not prescribe that Swift not store them locally (Nova still stores projects).<br>
<br>
The synchronization can be lazy (Nova does this with a shim in Keystone. If a request is authorized by Keystone on a tenant that does not have a corresponding project, it creates it right there and then). Or it can be proactive (as opposed to lazy).<br>
<br>
For proactive provisioning (where accounts would be synched to swift when they are created.<br>
<br>
Summarizing:<br>
Lazy provisioning: Users and tenants are created as authenticated requests come in to the openstack service for the first time.<br>
Proactive provisioning: Users and tenants are created in all services as they are created in Keystone.<br>
,Ote: my personal preference is for lazy provisioning.<br>
<br>
For proactive provisioning, we would need a service to own orchestration (or provisioning or order fullfilment - pick your model). We don't have one today. The Dashboard does some of that. Rackspace does it using non-openstack components which contain Rackspace
business logic.<br>
Will this ever become an OpenStack project or wiL this always live in the business systems of the operator (an enterprise deploying and operating openstack)...<br>
<br>
Z</span><span style="font-size: 12pt; font-family: 'Times New Roman', serif; "><br>
<o:p></o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">: Nguyen, Liem Manh [<a href="mailto:liem_m_nguyen@hp.com">mailto:liem_m_nguyen@hp.com</a>]
<br>
<b>Sent</b>: Friday, July 15, 2011 05:56 PM<br>
<b>To</b>: <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a> <<a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>>
<br>
<b>Subject</b>: [Openstack] [Keystone] [Swift] Keystone Tenant vs Swift Account <br>
</span><span style="font-size: 12pt; font-family: 'Times New Roman', serif; "> <o:p></o:p></span></p>
</div>
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">For Nova, the Keystone Tenant maps to a Nova project, and according to the “Finalize Auth integration” blueprint, the Nova project is going away (“no more project/roleuser info in nova”).
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">What about Swift’s account? I assume the Keystone tenant would map to a Swift account. How would this mapping occur? Would Swift still maintain account information in the db and these will get synchronized with Keystone tenant information
(i.e., auto-create accounts), or would Swift get rid of the account concept and have a mapping between tenant and containers instead? If there is any existing blue-print/docs on Keystone/Swift integration plan for Diablo, that would be greatly appreciated.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Liem<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size: 12pt; font-family: 'Courier New'; ">This email may include confidential information. If you received it in error, please delete it.</span><span style="font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p></o:p></span></p>
</div>
</div>
</div>
</span>
<PRE>
Confidentiality Notice: This e-mail message (including any attached or
embedded documents) is intended for the exclusive and confidential use of the
individual or entity to which this message is addressed, and unless otherwise
expressly indicated, is confidential and privileged information of Rackspace.
Any dissemination, distribution or copying of the enclosed material is prohibited.
If you receive this transmission in error, please notify us immediately by e-mail
at abuse@rackspace.com, and delete the original message.
Your cooperation is appreciated.
</PRE></body>
</html>