thanks for the "admin" clarify : )<br><br>here is more information about other extensions avoid the problem:<br>i read the policy.json file, find some other extension meet the same problem and watch how they impl<br>
for example. the quota api just shows like this<br><br><div class="row d1306e13791">
<div class="span5"><span class="label success">GET</span> v2/{tenant_id}/os-quota-sets/{tenant_id} Show quotas for tenant</div></div>
<div class="span5"><span class="label success">POST</span> v2/{tenant_id}/os-quota-sets/{tenant_id} Update quotas for tenant.</div><br>so the quota meet the same problem and just add the target tenant id to the url, <br>
and its update function takes the id from the result of routes.mapper point to the secondary tenant_id<br><br>since some extension even don't care which tenant is operate on, <br>they just need to know if the token in the header is a admin token, for exampl<font><span style="font-family:arial,helvetica,sans-serif">e<font>:<br>
</font></span></font><pre><font><span style="font-family:arial,helvetica,sans-serif"><span class="nt">"compute_extension:server_diagnostics"</span><span class="p">:</span> <span class="p">[[</span><span class="s2">"rule:admin_api"</span><span class="p">]]</span></span></font><br>
</pre><div class="span5"><span class="label success">GET</span> v2/{tenant_id}/servers/{server_id}/diagnostics Retrieves basic usage data for a given server.
</div>from the source code, it doesn't check the tenant id at all. it just invoke authorize(context) to check if it is admin.<br><br>But i do know for some case tenant_id is necessary for policy/security check or as a param<br>
and for the consistency, the extension should act the same way.<br>and since the APIRouter use ProjectMapper as the mapper and routes the request, <br>so it seems the redundent tenant_id cannot be avoid.<br><pre><span class="nt"></span><span class="p"></span><span class="p"></span><span class="s2"></span><span class="p"><br>
</span></pre><div class="gmail_quote">On Thu, Mar 28, 2013 at 11:12 PM, Vishvananda Ishaya <span dir="ltr"><<a href="mailto:vishvananda@gmail.com" target="_blank">vishvananda@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">I just looked at the code and it appears this is not possible through the os_networks extension. This appears to be an oversight. It should probably allow a project to be passed in.<div><br>
</div><div>Bug report here: <a href="https://bugs.launchpad.net/nova/+bug/1161441" target="_blank">https://bugs.launchpad.net/nova/+bug/1161441</a></div><div><br></div><div>That said, the first time a user boots an instance, he automatically gets assigned a network, so in many cases it isn't needed.</div>
<div><br></div><div>Another option would be to modify the code you mentioned to allow a workaround:</div><div><br></div><div><div><span>if</span> <span>(</span><span>context</span> <span>and</span> not <a href="http://context.is" target="_blank">context.is</a>_admin and <span>project_id</span> <span>and</span> <span>(</span><span>project_id</span> <span>!=</span> <span>context</span><span>.</span><span>project_id</span><span>)):</span></div>
<div><span><br></span></div><div><span>Vish</span></div><div><span><br></span></div><div><div><div class="im"><div>On Mar 28, 2013, at 1:46 AM, Ajiva Fan <<a href="mailto:aji.zqfan@gmail.com" target="_blank">aji.zqfan@gmail.com</a>> wrote:</div>
<br></div><blockquote type="cite"><div><div class="h5">hello everyone:<br><br>i have a very simple question which confuses me for a long time:<br>how should i add a network to a project via rest api?<br><br>1) i'm admin of the whole cloud env essex, (i think the folsom is same in this case)<br>
2) using nova-network:vlan (if using flatdhcp, the associate action is meanless)<br>3) a user project "user-project" is created, and the admin:admin is not that project's admin (and even not a member of it)<br>
4) a network "user-network" is created, but not associated with "user-project"<br>5) how to associate the "user-network" with "user-project" ?<br><br>i know i can use "nova-manage" via nova-client in the control node, <br>
but what i need to know is how to do this operation via rest api, like curl or in horizon?<br><br>the rest api is: <a href="http://api.openstack.org/api-ref.html" target="_blank">http://api.openstack.org/api-ref.html</a><br>
<div>
<span>POST</span></div>
<div>v2/{tenant_id}/os-networks/add <br>with a body identifier the network's id<br><br>the problem is that, even i have admin:admin token, i *cannot* associate the "user-network" with "user-project", <br>
because from the source code of folsom(and essex) nova, in the <a href="http://nova.api.openstack.wsgi.py/" target="_blank">nova.api.openstack.wsgi.py</a> of line 931, i find this:<br></div><div><span><br>
project_id</span> <span>=</span> <span>action_args</span><span>.</span><span>pop</span><span>(</span><span>"project_id"</span><span>,</span> <span>None</span><span>)</span></div>
<div> <span>context</span> <span>=</span> <span>request</span><span>.</span><span>environ</span><span>.</span><span>get</span><span>(</span><span>'nova.context'</span><span>)</span></div>
<div> <span>if</span> <span>(</span><span>context</span> <span>and</span> <span>project_id</span> <span>and</span> <span>(</span><span>project_id</span> <span>!=</span> <span>context</span><span>.</span><span>project_id</span><span>)):</span></div>
<div> <span>msg</span> <span>=</span> <span>_</span><span>(</span><span>"Malformed request url"</span><span>)</span></div>
<div> <span>return</span> <span>Fault</span><span>(</span><span>webob</span><span>.</span><span>exc</span><span>.</span><span>HTTPBadRequest</span><span>(</span><span>explanation</span><span>=</span><span>msg</span><span>))<br>
<br>since nova.context.project_id is the project admin_id, and the project_id is extract from the url, <br>so the webob.exc is returned.<br><br>please help me, i read a lot, (both document and source code, i just cannot understand or just miss something important)<br>
but still don't know how to do it.<br></span></div><br>ps: i have sent a mail to openstack-dev on mar 8, but no one reply me. is my question nonsense?<br>Note this mail is not the exactly same as previous one since i've more knowledge of it but the main problem is same<br>
</div></div><div class="im">
_______________________________________________<br>Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
</div></blockquote></div><br></div></div></div></blockquote></div><br>