<html><head><base href="x-msg://76/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Perhaps a poor analogy with email - The domain is an arbitrary string that's intended for tenant isolation in large openstack environments. It's a place to hang policy so that you can delegate things like "password changing" (where the keystone backend supports it) to someone other than the keystone-uber-administrator.<div><br></div><div>I expect almost any smaller/smallish deployment of OpenStack to likely use just a single domain, which is mostly ignored. It's really a mechanism in place for service-provider sized clouds, or where you want to be able to enforce hard boundaries in permissions between groups of tenants by customizing the policy.json files to respect domain_id information.</div><div><br></div><div>I would expect that in any implementation, it would be independent of email domain names or such - At least that wouldn't be a way that I'd slice up permissions across projects.</div><div><br></div><div>-joe</div><div><br><div><div>On Jul 18, 2012, at 9:25 AM, Tim Bell wrote:</div><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div bgcolor="white" lang="EN-GB" link="blue" vlink="purple"><div class="WordSection1" style="page: WordSection1; "><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Thanks…. My worry is the username. Currently, I have<o:p></o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">OS_USERNAME=timbell<o:p></o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Not<o:p></o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><a href="mailto:OS_USERNAME=timbell@cern.ch" style="color: blue; text-decoration: underline; ">OS_USERNAME=timbell@cern.ch</a><o:p></o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Does that mean in the future that my<o:p></o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">OS_USERNAME=timbell<o:p></o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">OS_DOMAINNAME=cern.ch<o:p></o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">I would like that I could still register as timbell in my domain even if someone else on the same OpenStack instance has a user id of timbell.<o:p></o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Cross domain, federated identity as part of an authorization layer would be an interesting development (as we look to federated clouds and bursting) but I didn’t see something like that in v3.<o:p></o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Tim<o:p></o:p></span></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p> </o:p></span></div><div style="font-family: Helvetica; font-size: medium; border-top-style: none; border-right-style: none; border-bottom-style: none; border-width: initial; border-color: initial; border-left-style: solid; border-left-color: blue; border-left-width: 1.5pt; padding-top: 0cm; padding-right: 0cm; padding-bottom: 0cm; padding-left: 4pt; "><div><div style="border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; border-top-style: solid; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding-top: 3pt; padding-right: 0cm; padding-bottom: 0cm; padding-left: 0cm; "><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><b><span lang="EN-US" style="font-size: 10pt; font-family: Tahoma, sans-serif; color: windowtext; ">From:</span></b><span lang="EN-US" style="font-size: 10pt; font-family: Tahoma, sans-serif; color: windowtext; "><span class="Apple-converted-space"> </span><a href="mailto:openstack-bounces+tim.bell=cern.ch@lists.launchpad.net" style="color: blue; text-decoration: underline; ">openstack-bounces+tim.bell=cern.ch@lists.launchpad.net</a><span class="Apple-converted-space"> </span>[mailto:openstack-bounces+tim.bell=<a href="mailto:cern.ch@lists.launchpad.net" style="color: blue; text-decoration: underline; ">cern.ch@lists.launchpad.net</a>]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Adam Young<br><b>Sent:</b><span class="Apple-converted-space"> </span>18 July 2012 17:46<br><b>To:</b><span class="Apple-converted-space"> </span><a href="mailto:openstack@lists.launchpad.net" style="color: blue; text-decoration: underline; ">openstack@lists.launchpad.net</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Openstack] Identity API v3 - Why allow multi-tenant users?<o:p></o:p></span></div></div></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><o:p> </o:p></div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; ">The idea of a Domain is that it is a single administrative entity, such as a company.<span class="Apple-converted-space"> </span><br><br>When a person joins a company, they get an email adddress. THat address does not change regardless of the position they hold. <span class="Apple-converted-space"> </span><br><br>Tenants are administrative groupings below that. It is unfortunate that we used the name tenants for this, as it actually contradicts the usual meaning of the term. We will be shortly switching back to using the term projects, and I think that is clearer.<br><br><br>It certainly makes sense for a user to belong to one domain, but have access to a project controlled in another domain. Here is a scenario. Joe's Sporting Goods and Local Bank are both companies that have a presense in a coud provider. Each has their own domain. <span class="Apple-converted-space"> </span><a href="mailto:tom@localbank.com" style="color: blue; text-decoration: underline; ">tom@localbank.com</a> is going to set up a Point of Sale system for Joe. So Joe creates a project called joes-point-of-sale and provides access to user<span class="Apple-converted-space"> </span><a href="mailto:tom@localbank.com" style="color: blue; text-decoration: underline; ">tom@localbank.com</a>.<br><br><br><br><br>On 07/18/2012 02:46 AM, Matt Joyce wrote:<o:p></o:p></div></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt; "><p class="MsoNormal" style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 12pt; ">I could see service users and security / operations teams having a need to span many domains.<br><br>-Matt<o:p></o:p></p><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; ">On Tue, Jul 17, 2012 at 11:24 PM, Tim Bell <<a href="mailto:Tim.Bell@cern.ch" target="_blank" style="color: blue; text-decoration: underline; ">Tim.Bell@cern.ch</a>> wrote:<o:p></o:p></div><div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span><o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">I thought that the v3 API supports domains as a group of tenants which would make the question rather different.</span><o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span><o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Thus, I guess the question is</span><o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span><o:p></o:p></div><p style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">A.</span><span style="font-size: 7pt; color: rgb(31, 73, 125); "> <span class="Apple-converted-space"> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Should there be users in multiple tenants in a single domain ?</span><o:p></o:p></p><p style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">B.</span><span style="font-size: 7pt; color: rgb(31, 73, 125); "> <span class="Apple-converted-space"> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Should there be users in multiple domains ?</span><o:p></o:p></p><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span><o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">There are clear use cases for A (such as researchers working on multiple projects sharing project quotas)</span><o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span><o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">For B, it is less clear as if I am a domain administrator, I do not want to be told that I cannot allocate user X since another domain has already taken it. On the other hand, there is a clear architectural benefit from having the concept of identity (and authentication) split off from roles and projects.</span><o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span><o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Tim</span><o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span><o:p></o:p></div><div style="border-top-style: none; border-right-style: none; border-bottom-style: none; border-width: initial; border-color: initial; border-left-style: solid; border-left-color: blue; border-left-width: 1.5pt; padding-top: 0cm; padding-right: 0cm; padding-bottom: 0cm; padding-left: 4pt; "><div><div style="border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; border-top-style: solid; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding-top: 3pt; padding-right: 0cm; padding-bottom: 0cm; padding-left: 0cm; "><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><b><span lang="EN-US" style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span lang="EN-US" style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span>openstack-bounces+tim.bell=<a href="mailto:cern.ch@lists.launchpad.net" target="_blank" style="color: blue; text-decoration: underline; ">cern.ch@lists.launchpad.net</a><span class="Apple-converted-space"> </span>[mailto:<a href="mailto:openstack-bounces%2Btim.bell" target="_blank" style="color: blue; text-decoration: underline; ">openstack-bounces+tim.bell</a>=<a href="mailto:cern.ch@lists.launchpad.net" target="_blank" style="color: blue; text-decoration: underline; ">cern.ch@lists.launchpad.net</a>]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>John Postlethwait<br><b>Sent:</b><span class="Apple-converted-space"> </span>18 July 2012 07:42<br><b>To:</b><span class="Apple-converted-space"> </span>Rouault, Jason (Cloud Services)<br><b>Cc:</b><span class="Apple-converted-space"> </span><a href="mailto:openstack@lists.launchpad.net" target="_blank" style="color: blue; text-decoration: underline; ">openstack@lists.launchpad.net</a></span><o:p></o:p></div><div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Openstack] Identity API v3 - Why allow multi-tenant users?<o:p></o:p></div></div></div></div></div><div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "> <o:p></o:p></div><div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 9pt; font-family: Helvetica, sans-serif; ">Forcing a user to remember different usernames and/or passwords for each project they are a part of, when it is possible they are part of N projects, really isn't an acceptable option in my opinion.</span><o:p></o:p></div></div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 9pt; font-family: Helvetica, sans-serif; "> </span><o:p></o:p></div></div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="font-size: 9pt; font-family: Helvetica, sans-serif; ">I believe that regardless of the engineering complexities, the end users shouldn't have to feel pain in order to make engineering the solutions and features they interact with easier. Software is for end users (in their various forms) and as such we need to take that into account when we make decisions. While no functionality is lost per se, there is a major end-user impact, and that should be reason enough to implement it…</span><o:p></o:p></div></div></div><div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "> <o:p></o:p></div></div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "> <o:p></o:p></div></div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; ">John Postlethwait<o:p></o:p></div></div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; ">Nebula, Inc.<o:p></o:p></div></div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><a href="tel:206-999-4492" target="_blank" style="color: blue; text-decoration: underline; ">206-999-4492</a><o:p></o:p></div></div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "> <o:p></o:p></div></div></div><p style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; "><span style="color: rgb(160, 160, 168); ">On Tuesday, July 17, 2012 at 4:15 PM, Rouault, Jason (Cloud Services) wrote:</span><o:p></o:p></p><blockquote style="border-top-style: none; border-right-style: none; border-bottom-style: none; border-width: initial; border-color: initial; border-left-style: solid; border-left-color: windowtext; border-left-width: 1pt; padding-top: 0cm; padding-right: 0cm; padding-bottom: 0cm; padding-left: 8pt; margin-left: 0cm; margin-top: 5pt; margin-bottom: 5pt; "><div><div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="color: rgb(31, 73, 125); ">One benefit is the user does not need to have multiple sets of credentials to interact with multiple projects.</span><o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="color: rgb(31, 73, 125); "> </span><o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="color: rgb(31, 73, 125); ">Jason</span><o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><span style="color: rgb(31, 73, 125); "> </span><o:p></o:p></div><div><div style="border-right-style: none; border-bottom-style: none; border-left-style: none; border-width: initial; border-color: initial; border-top-style: solid; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding-top: 3pt; padding-right: 0cm; padding-bottom: 0cm; padding-left: 0cm; "><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif; "><span class="Apple-converted-space"> </span><a href="mailto:openstack-bounces+jason.rouault=hp.com@lists.launchpad.net" target="_blank" style="color: blue; text-decoration: underline; ">openstack-bounces+jason.rouault=hp.com@lists.launchpad.net</a><span class="Apple-converted-space"> </span>[<a href="mailto:openstack-bounces" target="_blank" style="color: blue; text-decoration: underline; ">mailto:openstack-bounces</a>+jason.rouault=<a href="mailto:hp.com@lists.launchpad.net" target="_blank" style="color: blue; text-decoration: underline; ">hp.com@lists.launchpad.net</a>]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Adam Young<br><b>Sent:</b><span class="Apple-converted-space"> </span>Tuesday, July 17, 2012 11:55 AM<br><b>To:</b><span class="Apple-converted-space"> </span><a href="mailto:openstack@lists.launchpad.net" target="_blank" style="color: blue; text-decoration: underline; ">openstack@lists.launchpad.net</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Openstack] Identity API v3 - Why allow multi-tenant users?</span><o:p></o:p></div></div></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "> <o:p></o:p></div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; ">On 05/29/2012 01:18 PM, Caitlin Bestler wrote:<o:p></o:p></div></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt; "><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; ">One of the major complication I see in the API is that users can be associated with multiple tenants.<o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "> <o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; ">What is the benefit of this? What functionality would be lost if a human user merely had to use a different account with each tenant?<o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "> <o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; ">There are numerous issues with multi-tenant users. For example, if a user is associated with multiple tenants, who resets the user’s password?<o:p></o:p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "> <o:p></o:p></div><p style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-bottom: 12pt; "><o:p> </o:p></p><pre style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; color: black; ">_______________________________________________<o:p></o:p></pre><pre style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; color: black; ">Mailing list: <a href="https://launchpad.net/%7Eopenstack" target="_blank" style="color: blue; text-decoration: underline; ">https://launchpad.net/~openstack</a><o:p></o:p></pre><pre style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; color: black; ">Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank" style="color: blue; text-decoration: underline; ">openstack@lists.launchpad.net</a><o:p></o:p></pre><pre style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; color: black; ">Unsubscribe : <a href="https://launchpad.net/%7Eopenstack" target="_blank" style="color: blue; text-decoration: underline; ">https://launchpad.net/~openstack</a><o:p></o:p></pre><pre style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; color: black; ">More help : <a href="https://help.launchpad.net/ListHelp" target="_blank" style="color: blue; text-decoration: underline; ">https://help.launchpad.net/ListHelp</a><o:p></o:p></pre></blockquote><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; ">Did you ever get an answer? This has been discussed in depth.<o:p></o:p></div></div></div><div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; ">_______________________________________________<o:p></o:p></div></div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; ">Mailing list:<span class="Apple-converted-space"> </span><a href="https://launchpad.net/%7Eopenstack" target="_blank" style="color: blue; text-decoration: underline; ">https://launchpad.net/~openstack</a><o:p></o:p></div></div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; ">Post to :<span class="Apple-converted-space"> </span><a href="mailto:openstack@lists.launchpad.net" target="_blank" style="color: blue; text-decoration: underline; ">openstack@lists.launchpad.net</a><o:p></o:p></div></div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; ">Unsubscribe :<span class="Apple-converted-space"> </span><a href="https://launchpad.net/%7Eopenstack" target="_blank" style="color: blue; text-decoration: underline; ">https://launchpad.net/~openstack</a><o:p></o:p></div></div><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; ">More help :<span class="Apple-converted-space"> </span><a href="https://help.launchpad.net/ListHelp" target="_blank" style="color: blue; text-decoration: underline; ">https://help.launchpad.net/ListHelp</a><o:p></o:p></div></div></div></div></blockquote><div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "> <o:p></o:p></div></div></div></div></div></div></div><p class="MsoNormal" style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 12pt; "><br>_______________________________________________<br>Mailing list:<span class="Apple-converted-space"> </span><a href="https://launchpad.net/%7Eopenstack" target="_blank" style="color: blue; text-decoration: underline; ">https://launchpad.net/~openstack</a><br>Post to :<span class="Apple-converted-space"> </span><a href="mailto:openstack@lists.launchpad.net" style="color: blue; text-decoration: underline; ">openstack@lists.launchpad.net</a><br>Unsubscribe :<span class="Apple-converted-space"> </span><a href="https://launchpad.net/%7Eopenstack" target="_blank" style="color: blue; text-decoration: underline; ">https://launchpad.net/~openstack</a><br>More help :<span class="Apple-converted-space"> </span><a href="https://help.launchpad.net/ListHelp" target="_blank" style="color: blue; text-decoration: underline; ">https://help.launchpad.net/ListHelp</a><o:p></o:p></p></div><div style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 0.0001pt; "><br><br><br><br><o:p></o:p></div><pre style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; color: black; ">_______________________________________________<o:p></o:p></pre><pre style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; color: black; ">Mailing list: <a href="https://launchpad.net/~openstack" style="color: blue; text-decoration: underline; ">https://launchpad.net/~openstack</a><o:p></o:p></pre><pre style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; color: black; ">Post to : <a href="mailto:openstack@lists.launchpad.net" style="color: blue; text-decoration: underline; ">openstack@lists.launchpad.net</a><o:p></o:p></pre><pre style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; color: black; ">Unsubscribe : <a href="https://launchpad.net/~openstack" style="color: blue; text-decoration: underline; ">https://launchpad.net/~openstack</a><o:p></o:p></pre><pre style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 10pt; font-family: 'Courier New'; color: black; ">More help : <a href="https://help.launchpad.net/ListHelp" style="color: blue; text-decoration: underline; ">https://help.launchpad.net/ListHelp</a><o:p></o:p></pre></blockquote><p class="MsoNormal" style="margin-right: 0cm; margin-left: 0cm; font-size: 12pt; font-family: 'Times New Roman', serif; color: black; margin-top: 0cm; margin-bottom: 12pt; "><o:p> </o:p></p></div></div>_______________________________________________<br>Mailing list:<span class="Apple-converted-space" style="font-family: Helvetica; font-size: medium; "> </span><a href="https://launchpad.net/~openstack" style="font-family: Helvetica; font-size: medium; color: blue; text-decoration: underline; ">https://launchpad.net/~openstack</a><br>Post to :<span class="Apple-converted-space" style="font-family: Helvetica; font-size: medium; "> </span><a href="mailto:openstack@lists.launchpad.net" style="font-family: Helvetica; font-size: medium; color: blue; text-decoration: underline; ">openstack@lists.launchpad.net</a><br>Unsubscribe :<span class="Apple-converted-space" style="font-family: Helvetica; font-size: medium; "> </span><a href="https://launchpad.net/~openstack" style="font-family: Helvetica; font-size: medium; color: blue; text-decoration: underline; ">https://launchpad.net/~openstack</a><br>More help :<span class="Apple-converted-space" style="font-family: Helvetica; font-size: medium; "> </span><a href="https://help.launchpad.net/ListHelp" style="font-family: Helvetica; font-size: medium; color: blue; text-decoration: underline; ">https://help.launchpad.net/ListHelp</a><br></div></span></blockquote></div><br></div></body></html>