<div dir="ltr">Yes, those are the two use cases we're supporting, although I'd encourage Case 2, as it's generally much more intuitive.<br><div class="gmail_extra"><div><div><br></div>-Dolph</div>
<br><br><div class="gmail_quote">On Mon, Feb 25, 2013 at 1:54 AM, Leo Toyoda <span dir="ltr"><<a href="mailto:toyoda-reo@cnt.mxw.nes.nec.co.jp" target="_blank">toyoda-reo@cnt.mxw.nes.nec.co.jp</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Adam<br>
<br>
Thanks a lot for your answer.<br>
<br>
It is my understanding follows. Would that be OK with you?<br>
Case1: Create a user *with* specifying the tenant.<br>
* Default role is assigned.<br>
* I need to assign the required roles in "keystone user-role-add".<br>
* The user has two roles.<br>
<br>
Case2: Create a user *without* specifying the tenant.<br>
* I need to assign the required roles and the tenant in "keystone user-role-add".<br>
* The user has one role.<br>
<br>
Thanks,<br>
Leo Toyoda<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
> -----Original Message-----<br>
> From:<br>
> openstack-bounces+toyoda-reo=cnt.mxw.nes.nec.co.jp@lists.launc<br>
> <a href="http://hpad.net" target="_blank">hpad.net</a><br>
> [mailto:<a href="mailto:openstack-bounces%2Btoyoda-reo">openstack-bounces+toyoda-reo</a>=cnt.mxw.nes.nec.co.jp@lis<br>
> <a href="http://ts.launchpad.net" target="_blank">ts.launchpad.net</a>] On Behalf Of Adam Young<br>
> Sent: Saturday, February 23, 2013 5:31 AM<br>
> To: <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
> Subject: Re: [Openstack] [Keystone]Question: Assignment of<br>
> default role<br>
><br>
> Yes, this is new. We are removing the direct associtation<br>
> between users and projects (Project members) and replacing it<br>
> with a Role (_member_)<br>
><br>
> The _ is there to ensure it does not conflict with existing roles.<br>
><br>
> The two different ways of associating users to projects was<br>
> causing problems. With RBAC, we can now enforce policy about<br>
> project membership that we could not do before.<br>
><br>
><br>
><br>
><br>
><br>
> On 02/21/2013 09:39 PM, Leo Toyoda wrote:<br>
> > Hi, everyone<br>
> ><br>
> > I'm using the master branch devstack.<br>
> > I hava a question about assignment of default role (Keystone).<br>
> ><br>
> > When I create a user to specify the tenant, '_member_' is<br>
> assigned to the roles.<br>
> > $ keystone user-create --name test --tenant-id e61..7f6 --pass test<br>
> > --email <a href="mailto:test@example.com">test@example.com</a><br>
> > +----------+-------------------+<br>
> > | Property | Value |<br>
> > +----------+-------------------+<br>
> > | email | <a href="mailto:test5@example.com">test5@example.com</a> |<br>
> > | enabled | True |<br>
> > | id | af1..8d2 |<br>
> > | name | test |<br>
> > | tenantId | e61..7f6 |<br>
> > +----------+-------------------+<br>
> > $ keystone user-role-list --user test --tenant e61..7f6<br>
> > +----------+----------+----------+-----------+<br>
> > | id | name | user_id | tenant_id |<br>
> > +----------+----------+----------+-----------+<br>
> > | 9fe..bab | _member_ | af1..8d2 | e61..7f6 |<br>
> > +----------+----------+----------+-----------+<br>
> ><br>
> > Then, assign the "Member" role to the user.<br>
> > Hitting assigned two roles of 'Member' and '_member_'.<br>
> > $ keystone user-role-add --user af1..8d2 --role 57d..d1f --tenant<br>
> > e61..7f6 $ keystone user-role-list --user af1..8d2 --tenant e61..7f6<br>
> > +----------+----------+----------+-----------+<br>
> > | id | name | user_id | tenant_id |<br>
> > +----------+----------+----------+-----------+<br>
> > | 57d..d1f | Member | af1..8d2 | e61..7f6 | 9fe..bab |<br>
> _member_ |<br>
> > | af1..8d2 | e61..7f6 |<br>
> > +----------+----------+----------+-----------+<br>
> ><br>
> > When I create a user without specifying a tenant, I assign<br>
> 'Member' role.<br>
> > In this case, Only one role is assigned.<br>
> > $ keystone user-create --name test2 --pass test --email<br>
> > <a href="mailto:test2@example.com">test2@example.com</a><br>
> > +----------+-------------------+<br>
> > | Property | Value |<br>
> > +----------+-------------------+<br>
> > | email | <a href="mailto:test2@example.com">test2@example.com</a> |<br>
> > | enabled | True |<br>
> > | id | c22..a6d |<br>
> > | name | test2 |<br>
> > | tenantId | |<br>
> > +----------+-------------------+<br>
> > $ keystone user-role-add --user c22..a6d --role 57d..d1f --tenant<br>
> > e61..7f6 $ keystone user-role-list --user c22..a6d --tenant e61..7f6<br>
> > +----------+----------+----------+-----------+<br>
> > | id | name | user_id | tenant_id |<br>
> > +----------+----------+----------+-----------+<br>
> > | 57d..d1f | Member | c22..a6d | e61..7f6 |<br>
> > +----------+----------+----------+-----------+<br>
> ><br>
> > Is it expected behavior that two rolls are assigned?<br>
> ><br>
> > Thanks<br>
> > Leo Toyoda<br>
> ><br>
> ><br>
> > _______________________________________________<br>
> > Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
> > Post to : <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
> > Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
> > More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
><br>
><br>
> _______________________________________________<br>
> Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
> Post to : <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
> Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
> More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
><br>
<br>
<br>
_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
</div></div></blockquote></div><br></div></div>