<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>Great. BTW, Dolph just started work on this, so we've updated the status of the blueprint.</div>
<div><br>
</div>
<div>Z</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Judd Maltin <<a href="mailto:openstack@newgoliath.com">openstack@newgoliath.com</a>><br>
<span style="font-weight:bold">Date: </span>Fri, 2 Dec 2011 11:27:57 -0500<br>
<span style="font-weight:bold">To: </span>Ziad Sawalha <<a href="mailto:ziad.sawalha@rackspace.com">ziad.sawalha@rackspace.com</a>><br>
<span style="font-weight:bold">Cc: </span>"<a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>" <<a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a>>, "Rouault, Jason (Cloud Services)" <<a href="mailto:jason.rouault@hp.com">jason.rouault@hp.com</a>>,
John Dickinson <<a href="mailto:me@not.mn">me@not.mn</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openstack] Keystone & Swift: swiftauth tenant namespace collisions?<br>
</div>
<div><br>
</div>
<p>Ziad!</p>
<p>Just knowing that your team has these issues in mind is a huge help.</p>
<p>-judd</p>
<div class="gmail_quote">On Dec 1, 2011 6:00 PM, "Ziad Sawalha" <<a href="mailto:ziad.sawalha@rackspace.com">ziad.sawalha@rackspace.com</a>> wrote:<br type="attribution">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>OK, that helps.</div>
<div><br>
</div>
<div>We have a blueprint to use a string ID instead of the integer in the database: <a href="https://blueprints.launchpad.net/keystone/+spec/portable-identifiers" target="_blank">https://blueprints.launchpad.net/keystone/+spec/portable-identifiers</a></div>
<div><br>
</div>
<div>I think that will address your needs (eventually).</div>
<div><br>
</div>
<div>We intend to deliver that without any API changes (the API supports string IDs) and with full migration support from stable/diablo.</div>
<div><br>
</div>
<div>To summarize the intent:</div>
<ul>
<li>we add a string UID to the database schema</li><li>For deployments with the integer ID, we copy that into the UID field</li><li>For deployments where the ID is a string (cactus and pre-Diablo) we copy that into the UID field</li><li>We use the UID field in the URLs displayed by Keystone</li></ul>
<div>That will allow migrations into Keystone and you can decide in your data import what value to make the ID that shows up as the REST URL. </div>
<div><br>
</div>
<div>This is a future answer to your need. We plan on doing this very soon (maybe by E2). But for the current Keystone schema I don't have any alternative suggestions unfortunately.</div>
<div><br>
</div>
<div>Does this help?</div>
<div><br>
</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span>Judd Maltin <<a href="mailto:openstack@newgoliath.com" target="_blank">openstack@newgoliath.com</a>><br>
<span style="font-weight:bold">Date: </span>Thu, 1 Dec 2011 16:32:00 -0500<br>
<span style="font-weight:bold">To: </span>Ziad Sawalha <<a href="mailto:ziad.sawalha@rackspace.com" target="_blank">ziad.sawalha@rackspace.com</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Openstack] Keystone & Swift: swiftauth tenant namespace collisions?<br>
</div>
<div><br>
</div>
Hi Ziad,<br>
<br>
The current authentication systems for Swift use a hash as the tenant_id. I saw that keystone is using a sequential integer from the DB as the tenant_id. This doesn't allow Keystone to match an existing Swift tenant_id (called "account" in Swift). This prevents
Keystone from just "taking over" for swauth or tempauth.<br>
<br>
If the definition of tenant_id is changed in Keystone to be configurable by the administrator, or at least NOT be a seq from the DB, then migration from swauth to keystone is possible, and may even be automated.<br>
<br>
Looking forward to your thoughts,<br>
-judd<br>
<br>
<div class="gmail_quote">On Sun, Nov 27, 2011 at 12:51 AM, Ziad Sawalha <span dir="ltr">
<<a href="mailto:ziad.sawalha@rackspace.com" target="_blank">ziad.sawalha@rackspace.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word;color:rgb(0,0,0);font-size:14px;font-family:Calibri,sans-serif">
<div>Hi Judd –</div>
<div><br>
</div>
<div>Account in swift is the same thing as tenant in Keystone.</div>
<div><br>
</div>
<div>Is the problem that you are specifying account 'name' instead of the ID?</div>
<div><br>
</div>
<div>I'm asking because we have had a number of users having problems migrating into Keystone after we switched to ID/Name for tenants and users and we are considering a schema change that would allow for simpler migration into Keystone and support tenant ID
and name being the same.</div>
<div><br>
</div>
<div>I'm not sure that would help you, but if it would we would like to get your input on the design we are considering.</div>
<div><br>
</div>
<span>
<div style="font-family:Calibri;font-size:11pt;text-align:left;color:black;BORDER-BOTTOM:medium none;BORDER-LEFT:medium none;PADDING-BOTTOM:0in;PADDING-LEFT:0in;PADDING-RIGHT:0in;BORDER-TOP:#b5c4df 1pt solid;BORDER-RIGHT:medium none;PADDING-TOP:3pt">
<span style="font-weight:bold">From: </span>Judd Maltin <<a href="mailto:openstack@newgoliath.com" target="_blank">openstack@newgoliath.com</a>><br>
<span style="font-weight:bold">Date: </span>Fri, 25 Nov 2011 11:31:50 -0500<br>
<span style="font-weight:bold">To: </span>"Rouault, Jason (Cloud Services)" <<a href="mailto:jason.rouault@hp.com" target="_blank">jason.rouault@hp.com</a>><br>
<span style="font-weight:bold">Cc: </span>John Dickinson <<a href="mailto:me@not.mn" target="_blank">me@not.mn</a>>, Ziad Sawalha <<a href="mailto:ziad.sawalha@rackspace.com" target="_blank">ziad.sawalha@rackspace.com</a>>, "<a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a>"
<<a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a>>
<div>
<div><br>
<span style="font-weight:bold">Subject: </span>Re: [Openstack] Keystone & Swift: swiftauth tenant namespace collisions?<br>
</div>
</div>
</div>
<div>
<div>
<div><br>
</div>
Thanks Jason,<br>
<br>
I am indeed working off stable/diablo. It looks like I'm going to have to use mod_proxy and mod_rewrite to migrate my users form AUTH_<account_name> to AUTH_<tenant_id> Any other ideas for this sort of migration?<br>
<br>
-judd<br>
<br>
<br>
<br>
<br>
<div class="gmail_quote">On Mon, Nov 21, 2011 at 9:42 AM, Rouault, Jason (Cloud Services)
<span dir="ltr"><<a href="mailto:jason.rouault@hp.com" target="_blank">jason.rouault@hp.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Yes, I am aware of the new swift code for Keystone, but the question came<br>
from Judd who may be working off of Diablo-stable.<br>
<div>
<div></div>
<div><br>
-----Original Message-----<br>
From: John Dickinson [mailto:<a href="mailto:me@not.mn" target="_blank">me@not.mn</a>]<br>
Sent: Sunday, November 20, 2011 8:59 AM<br>
To: Rouault, Jason (Cloud Services)<br>
Cc: Ziad Sawalha; Judd Maltin; <a href="mailto:openstack@lists.launchpad.net" target="_blank">
openstack@lists.launchpad.net</a><br>
Subject: Re: [Openstack] Keystone & Swift: swiftauth tenant namespace<br>
collisions?<br>
<br>
I don't think that is exactly right, but my understanding of tenants vs<br>
accounts vs users may be lacking. Nonetheless, auth v2.0 support was added<br>
to the swift cli tool by Chmouel recently. Have you tried with the code in<br>
swift's trunk (also the 1.4.4 release scheduled for Tuesday)?<br>
<br>
--John<br>
<br>
<br>
On Nov 20, 2011, at 8:55 AM, Rouault, Jason (Cloud Services) wrote:<br>
<br>
> Ziad,<br>
><br>
> I think the problem is that the 'swift' command scopes a user to an<br>
account(tenant) via the concatenation of account:username when providing<br>
credentials for a valid token. With Keystone and /v2.0 auth the tenantId<br>
(or tenantName) are passed in the body of the request.<br>
><br>
> Jason<br>
><br>
> From: openstack-bounces+jason.rouault=<a href="mailto:hp.com@lists.launchpad.net" target="_blank">hp.com@lists.launchpad.net</a><br>
[mailto:<a href="mailto:openstack-bounces%2Bjason.rouault" target="_blank">openstack-bounces+jason.rouault</a>=<a href="mailto:hp.com@lists.launchpad.net" target="_blank">hp.com@lists.launchpad.net</a>] On<br>
Behalf Of Ziad Sawalha<br>
> Sent: Friday, November 18, 2011 2:10 PM<br>
> To: Judd Maltin; <a href="mailto:openstack@lists.launchpad.net" target="_blank">
openstack@lists.launchpad.net</a><br>
> Subject: Re: [Openstack] Keystone & Swift: swiftauth tenant namespace<br>
collisions?<br>
><br>
> Hi Judd - I'm not sire I understand. Can you give me an example of two<br>
tenants, their usernames, and the endpoints you would like them to have in<br>
Keystone?<br>
><br>
><br>
> From: Judd Maltin <<a href="mailto:judd@newgoliath.com" target="_blank">judd@newgoliath.com</a>><br>
> Date: Fri, 18 Nov 2011 15:22:09 -0500<br>
> To: <<a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a>><br>
> Subject: [Openstack] Keystone & Swift: swiftauth tenant namespace<br>
collisions?<br>
><br>
> In keystone auth for swift (swiftauth), is there a way to eliminate<br>
namespace conflicts across tenants?"<br>
><br>
> i.e. in tempauth we use account:username password<br>
><br>
> curl -k -v -H 'X-Auth-User: test:tester' -H 'X-Auth-Token: testing'<br>
<a href="http://127.0.0.1:8080/auth/v1.0" target="_blank">http://127.0.0.1:8080/auth/v1.0</a><br>
><br>
> in swiftauth we use username password:<br>
> $ swift -A <a href="http://127.0.0.1:5000/v1.0" target="_blank">http://127.0.0.1:5000/v1.0</a> -U joeuser -K secrete stat -v<br>
> StorageURL: <a href="http://127.0.0.1:8888/v1/AUTH_1234" target="_blank">http://127.0.0.1:8888/v1/AUTH_1234</a><br>
> Auth Token: 74ce1b05-e839-43b7-bd76-85ef178726c3<br>
> Account: AUTH_12<br>
><br>
> How can I indicate my tenant (aka account) in this scheme. I already have<br>
lots of data.<br>
><br>
> Further, should I create custom endpoint templates for each tenant to<br>
address "Account: AUTH_12" being unknown to my current swift account db?<br>
><br>
> Thanks very much,<br>
> -judd<br>
><br>
><br>
> --<br>
> Judd Maltin<br>
> T: <a href="tel:917-882-1270" value="+19178821270" target="_blank">917-882-1270</a><br>
> F: <a href="tel:501-694-7809" value="+15016947809" target="_blank">501-694-7809</a><br>
> A loving heart is never wrong.<br>
><br>
><br>
><br>
> _______________________________________________ Mailing list:<br>
<a href="https://launchpad.net/%7Eopenstack" target="_blank">https://launchpad.net/~openstack</a> Post to :<a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/%7Eopenstack" target="_blank">https://launchpad.net/~openstack</a> More help :<br>
<a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
> _______________________________________________<br>
> Mailing list: <a href="https://launchpad.net/%7Eopenstack" target="_blank">https://launchpad.net/~openstack</a><br>
> Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
> Unsubscribe : <a href="https://launchpad.net/%7Eopenstack" target="_blank">https://launchpad.net/~openstack</a><br>
> More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
<br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</div>
</span></div>
</blockquote>
</div>
<br>
</span></div>
</blockquote>
</div>
</span>
</body>
</html>