<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I think keystone client is still V2 by default, which is enforcing admin_required. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Try this<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal>"admin_required": [["role:KeystoneAdmin"], ["role:admin"], ["is_admin:1"]],<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Guang<o:p></o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> Openstack [mailto:openstack-bounces+guang.yee=hp.com@lists.launchpad.net] <b>On Behalf Of </b>Adam Young<br><b>Sent:</b> Thursday, June 06, 2013 7:28 PM<br><b>To:</b> Heiko Krämer; openstack<br><b>Subject:</b> Re: [Openstack] [Keystone] Policy settings not working correctly<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>What is the actualy question here? Is it "why is this failing" or "why was it done that way?"<br><br><br>On 06/04/2013 07:47 AM, Heiko Krämer wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal>Heyho guys :)<br><br>I've a little problem with policy settings in keystone. I've create a new rule in my policy-file and restarts keystone but keystone i don't have privileges. <o:p></o:p></p></blockquote><p class=MsoNormal><br>What is the rule?<br><br><o:p></o:p></p><p class=MsoNormal><br>Example:<br><br><br>keystone user-create --name kadmin --pw lala <br>keystone user-role-add --<br><br>keystone role-list --user kadmin --role KeystoneAdmin --tenant admin<br><br>+----------------------------------+----------------------+<br>| id | name |<br>+----------------------------------+----------------------+<br>| 3f5c0af585db46aeaec49da28900de28 | KeystoneAdmin |<br>| dccfed0bd790420bbf1982686cbf7e31 | KeystoneServiceAdmin |<br><br><br>cat /etc/keystone/policy.json<br><br>{<br> "admin_required": [["role:admin"], ["is_admin:1"]],<br> "owner" : [["user_id:%(user_id)s"]],<br> "admin_or_owner": [["rule:admin_required"], ["rule:owner"]],<br> "admin_or_kadmin": [["rule:admin_required"], ["role:KeystoneAdmin"]],<br><br> "default": [["rule:admin_required"]],<br>[.....]<br> "identity:list_users": [["rule:admin_or_kadmin"]],<br>[....]<br><br><loading kadmin creds><br><br>keystone user-list<br>Unable to communicate with identity service: {"error": {"message": "You are not authorized to perform the requested action: admin_required", "code": 403, "title": "Not Authorized"}}. (HTTP 403)<br><br><br>In log file i see:<br>DEBUG [keystone.policy.backends.rules] enforce admin_required: {'tenant_id': u'b33bf3927d4e449a98cec4a883148110', 'user_id': u'46a6a9e429db483f8346f0259e99d6a5', u'roles': [u'KeystoneAdmin']}<br><br><br><br><br>Why does keystone enforce <i>admin_required</i> rule instead of the defined rule (<i>admin_or_kadmin</i>).<o:p></o:p></p><p class=MsoNormal><br>Historical reasons. We are trying to clean this up. <br><br><br><o:p></o:p></p><p class=MsoNormal><br><br><br>Keystone conf:<br>[...]<br><br># Path to your policy definition containing identity actions<br>policy_file = policy.json<br>[..]<br>[policy]<br>driver = keystone.policy.backends.rules.Policy<br><br><br><br><br>Any have an idea ?<br><br>Thx and greetings<br>Heiko<br><br><br><br><br><o:p></o:p></p><pre>_______________________________________________<o:p></o:p></pre><pre>Mailing list: <a href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a><o:p></o:p></pre><pre>Post to : <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><o:p></o:p></pre><pre>Unsubscribe : <a href="https://launchpad.net/~openstack">https://launchpad.net/~openstack</a><o:p></o:p></pre><pre>More help : <a href="https://help.launchpad.net/ListHelp">https://help.launchpad.net/ListHelp</a><o:p></o:p></pre><p class=MsoNormal><o:p> </o:p></p></div></body></html>