<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; "><div><div>Hi Adam,</div><div><br></div><div>Thanks for that. :) I'm researching the Trust Capability now to see if that will get my close to what I need using different roles and then delegating those roles. Not sure how unwieldy that will be in terms of the policy management but I'm going to investigate it.</div><div><br></div><div>-Brian</div></div><div><br></div><span id="OLK_SRC_BODY_SECTION"><div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span style="font-weight:bold">From: </span> Adam Young <<a href="mailto:ayoung@redhat.com">ayoung@redhat.com</a>><br><span style="font-weight:bold">Date: </span> Tuesday, November 12, 2013 12:42 PM<br><span style="font-weight:bold">To: </span> "<a href="mailto:openstack@lists.openstack.org">openstack@lists.openstack.org</a>" <<a href="mailto:openstack@lists.openstack.org">openstack@lists.openstack.org</a>><br><span style="font-weight:bold">Subject: </span> Re: [Openstack] One Time Keystone Use Tokens?<br></div><div><br></div><div><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><div bgcolor="#FFFFFF" text="#000000"><div class="moz-cite-prefix">On 10/25/2013 11:19 AM, Brian Chong wrote:<br></div><blockquote cite="mid:CE8FD9F4.19A11%25brian_chong@symantec.com" type="cite"><div>Hi,</div><div><br></div><div>I'm trying to figure out if its possible to configure KeyStone tokens to be one time use. My use case is that when a user requests that they want to take a action on the platform (i.e.: boot a VM) they aren't also using that same token to load a image
in Glance or delete another VM, etc.</div></blockquote>
I filed a bug for this feature.<br><br><a class="moz-txt-link-freetext" href="https://bugs.launchpad.net/keystone/+bug/1250617">https://bugs.launchpad.net/keystone/+bug/1250617</a><br><br>
However, not that the feature you are requesting is best supported by trusts in general: you need to split up the roels for each action (create vm, upload image to glance) and then delegate only the roles for the operations desired.<br><br><br><blockquote cite="mid:CE8FD9F4.19A11%25brian_chong@symantec.com" type="cite"><div><br></div><div>How would I do that or is that even possible?</div><div><br></div><div>Thanks a lot!</div><div>-Brian</div><br><fieldset class="mimeAttachmentHeader"></fieldset> <br><pre wrap="">_______________________________________________
Mailing list: <a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a>
Post to : <a class="moz-txt-link-abbreviated" href="mailto:openstack@lists.openstack.org">openstack@lists.openstack.org</a>
Unsubscribe : <a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a></pre></blockquote><br></div></div></span></body></html>