<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr">I have set up my openstack environment with V3 Keystone domains enabled after reading a few blogs (notably this one: <a href="http://www.florentflament.com/blog/setting-keystone-v3-domains.html" id="yui_3_16_0_1_1424214203221_3498">http://www.florentflament.com/blog/setting-keystone-v3-domains.html</a>). I am not able to get the list of projects in a given domain when querying as the domain admin. Below are the steps I followed:</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr"><br></div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style="">1. I created an admin domain and added the ID of the domain to my new policy.json file (which is a copy of the latest policy.v3cloudsample.json):</div><div class="" style="" id="yui_3_16_0_1_1424214203221_3908"><span class="" style=""> </span></div><div class="" style="" id="yui_3_16_0_1_1424214203221_3907"><span class="" style="">"admin_required"</span><span class="" style="">: </span><span class="" style="" id="yui_3_16_0_1_1424214203221_3925">"role:admin"</span><span class="" style="" id="yui_3_16_0_1_1424214203221_14600">,</span></div><div class="" style="" id="yui_3_16_0_1_1424214203221_3797"><b id="yui_3_16_0_1_1424214203221_3829"><span class="" style="" id="yui_3_16_0_1_1424214203221_3806"> </span><span class="" style="" id="yui_3_16_0_1_1424214203221_3805">"cloud_admin"</span><span class="" style="" id="yui_3_16_0_1_1424214203221_3822">: </span><span class="" style="" id="yui_3_16_0_1_1424214203221_3804">"rule:admin_required and domain_id:43eebba390b64b86ad073f690f76ee7f"</span><span class="" style="" id="yui_3_16_0_1_1424214203221_3828">,</span></b></div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style="">
</div><div class="" style="" id="yui_3_16_0_1_1424214203221_3803"><span class="" style=""> </span><span class="" style="" id="yui_3_16_0_1_1424214203221_3807">"service_role"</span><span class="" style="" id="yui_3_16_0_1_1424214203221_3814">: </span><span class="" style="" id="yui_3_16_0_1_1424214203221_3815">"role:service"</span><span class="" style="">,</span></div><div class="" style="" id="yui_3_16_0_1_1424214203221_3803"><span class="" style="">....</span></div><div class="" style="" id="yui_3_16_0_1_1424214203221_3803" dir="ltr"><span class="" style=""><br></span></div><div class="" style="" id="yui_3_16_0_1_1424214203221_3803" dir="ltr"><span class="" style="" id="yui_3_16_0_1_1424214203221_4276">2. Restarted keystone.</span></div><div class="" style="" id="yui_3_16_0_1_1424214203221_3803"><span class="" style=""><br></span></div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style="">3. I went ahead and created a new domain: dom1. A new user (admin1) for that domain and assigned admin role to that user. admin1 is now supposed to be the domain admin for dom1. I logged in as admin1 with scope set to domain id of dom1 and have a valid token as well. The body of the post request was as follows: </div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""><br></div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style="">{</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> "auth": {</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> "identity": {</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> "methods": [</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> "password"</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> ],</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> "password": {</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> "user": {</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> "domain": {</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> "id": "6a530272037f4672b41e5be12b2d1670"</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> },</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> "name": "admin1",</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> "password": "admin123"</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> }</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> }</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> },</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> "scope": {</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> "domain": {</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> "id": "6a530272037f4672b41e5be12b2d1670"</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> }</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> }</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""> }</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style="">}</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""><br></div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style="">4. I then created two projects in the domain dom1. </div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""><br></div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style="">5. Now when I try to get a list of all the projects in that domain using <b id="yui_3_16_0_1_1424214203221_4097">HTTP GET /keystone/v3/projects</b> API call (and passing the admin1 login token) I get a 403 error with the following response: </div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""><br></div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""><span style="color: rgb(17, 17, 17); font-family: Consolas, 'Andale Mono', Courier, monospace; font-size: 13px; line-height: 20px;" class="">{</span></div><ul class="" style="padding-left: 0px; margin-top: 0px; margin-bottom: 0px; margin-left: 2em; list-style-type: none; color: rgb(17, 17, 17); font-family: Consolas, 'Andale Mono', Courier, monospace; font-size: 13px; line-height: 20px;" id="yui_3_16_0_1_1424214203221_4144"><li class="" style="position: relative;" id="yui_3_16_0_1_1424214203221_4143"><div class="" style="; left: -1em; cursor: pointer;"></div><span class="" style="font-weight: bold;" id="yui_3_16_0_1_1424214203221_4278">"error"</span>: {<ul class="" style="padding-left: 0px; margin-top: 0px; margin-bottom: 0px; margin-left: 2em; list-style-type: none;" id="yui_3_16_0_1_1424214203221_4146"><li class="" style="position: relative;" id="yui_3_16_0_1_1424214203221_4151"><span class="" style="font-weight: bold;" id="yui_3_16_0_1_1424214203221_4277">"code"</span>: <span class="" style="color: blue;" id="yui_3_16_0_1_1424214203221_4150">403</span>,</li><li class="" style="position: relative;" id="yui_3_16_0_1_1424214203221_4149"><span class="" style="font-weight: bold;" id="yui_3_16_0_1_1424214203221_4148">"message"</span>: <span class="" style="color: green;" id="yui_3_16_0_1_1424214203221_4196">"You are not authorized to perform the requested action: identity:list_projects"</span>,</li><li class="" style="position: relative;" id="yui_3_16_0_1_1424214203221_4145"><span class="" style="font-weight: bold;" id="yui_3_16_0_1_1424214203221_4147">"title"</span>: <span class="" style="color: green;">"Forbidden"</span></li></ul>}</li></ul><div dir="ltr" class="" id="yui_3_16_0_1_1424214203221_4142"><span style="color: rgb(17, 17, 17); font-family: Consolas, 'Andale Mono', Courier, monospace; font-size: 13px; line-height: 20px;" class="" id="yui_3_16_0_1_1424214203221_4141">}</span><br></div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""><br></div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style="">What am I missing? Would really appreciate any pointers...</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style=""><br></div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style="">Regards,</div><div id="yui_3_16_0_1_1424214203221_3439" dir="ltr" class="" style="">-Deep.</div><div dir="ltr" id="yui_3_16_0_1_1424214203221_3602"> <br></div></div></body></html>