<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div dir="ltr" id="yui_3_16_0_1_1424302176935_7623">GET /projects?domain_id=<domain is for dom1> did the trick. Thanks so much, Henry. </div><div dir="ltr" id="yui_3_16_0_1_1424302176935_7623"><br></div><div dir="ltr" id="yui_3_16_0_1_1424302176935_7623">Regards,</div><div dir="ltr" id="yui_3_16_0_1_1424302176935_7623">-Deep. <br></div> <div class="qtdSeparateBR" id="yui_3_16_0_1_1424302176935_7916"><br><br></div><div class="yahoo_quoted" style="display: block;" id="yui_3_16_0_1_1424302176935_7696"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_1_1424302176935_7695"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_1_1424302176935_7694"> <div dir="ltr" id="yui_3_16_0_1_1424302176935_7919"> <font size="2" face="Arial" id="yui_3_16_0_1_1424302176935_8226"> On Wednesday, February 18, 2015 5:20 AM, Henry Nash <henry.nash@uk.ibm.com> wrote:<br> </font> </div> <br><br> <div class="y_msg_container" id="yui_3_16_0_1_1424302176935_7693"><div id="yiv6450938584"><div id="yui_3_16_0_1_1424302176935_7692"><div id="yui_3_16_0_1_1424302176935_8216">Hi</div><div id="yui_3_16_0_1_1424302176935_7927"><br clear="none"></div><div id="yui_3_16_0_1_1424302176935_8215">So one thing to try is to pass the domain_id as a filter to list projects, I.e.:</div><div id="yui_3_16_0_1_1424302176935_7920"><br clear="none"></div><div id="yui_3_16_0_1_1424302176935_7809">GET /projects?domain_id=<domain is for dom1></div><div id="yui_3_16_0_1_1424302176935_8214"><br clear="none"></div><div id="yui_3_16_0_1_1424302176935_7691">I thought that a domain scoped token would have been sufficient, but let's try that. Could you also send me your policy file so I can check it?</div><div id="yui_3_16_0_1_1424302176935_7697"><br clear="none"></div><div id="yui_3_16_0_1_1424302176935_7698">Thanks</div><div id="yui_3_16_0_1_1424302176935_7699"><br clear="none"></div><div>Henry</div><div id="yui_3_16_0_1_1424302176935_9358"><br clear="none"></div><div class="yiv6450938584yqt2712996027" id="yiv6450938584yqt23536"><div><br clear="none">On 17 Feb 2015, at 23:29, Ratnadeep Bhattacharjee <<a rel="nofollow" shape="rect" ymailto="mailto:bhatt246@yahoo.com" target="_blank" href="mailto:bhatt246@yahoo.com">bhatt246@yahoo.com</a>> wrote:<br clear="none"><br clear="none"></div><blockquote type="cite"><div><div style="color:#000;background-color:#fff;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;"><div dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439">I have set up my openstack environment with V3 Keystone domains enabled after reading a few blogs (notably this one: <a rel="nofollow" shape="rect" id="yiv6450938584yui_3_16_0_1_1424214203221_3498" target="_blank" href="http://www.florentflament.com/blog/setting-keystone-v3-domains.html">http://www.florentflament.com/blog/setting-keystone-v3-domains.html</a>). I am not able to get the list of projects in a given domain when querying as the domain admin. Below are the steps I followed:</div><div dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439"><br clear="none"></div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style="">1. I created an admin domain and added the ID of the domain to my new policy.json file (which is a copy of the latest policy.v3cloudsample.json):</div><div class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_3908" style=""><span class="yiv6450938584" style=""> </span></div><div class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_3907" style=""><span class="yiv6450938584" style="">"admin_required"</span><span class="yiv6450938584" style="">: </span><span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_3925" style="">"role:admin"</span><span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_14600" style="">,</span></div><div class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_3797" style=""><b id="yiv6450938584yui_3_16_0_1_1424214203221_3829"><span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_3806" style=""> </span><span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_3805" style="">"cloud_admin"</span><span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_3822" style="">: </span><span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_3804" style="">"rule:admin_required and domain_id:43eebba390b64b86ad073f690f76ee7f"</span><span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_3828" style="">,</span></b></div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style="">
</div><div class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_3803" style=""><span class="yiv6450938584" style=""> </span><span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_3807" style="">"service_role"</span><span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_3814" style="">: </span><span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_3815" style="">"role:service"</span><span class="yiv6450938584" style="">,</span></div><div class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_3803" style=""><span class="yiv6450938584" style="">....</span></div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3803" style=""><span class="yiv6450938584" style=""><br clear="none"></span></div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3803" style=""><span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_4276" style="">2. Restarted keystone.</span></div><div class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_3803" style=""><span class="yiv6450938584" style=""><br clear="none"></span></div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style="">3. I went ahead and created a new domain: dom1. A new user (admin1) for that domain and assigned admin role to that user. admin1 is now supposed to be the domain admin for dom1. I logged in as admin1 with scope set to domain id of dom1 and have a valid token as well. The body of the post request was as follows: </div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""><br clear="none"></div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style="">{</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> "auth": {</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> "identity": {</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> "methods": [</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> "password"</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> ],</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> "password": {</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> "user": {</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> "domain": {</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> "id": "6a530272037f4672b41e5be12b2d1670"</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> },</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> "name": "admin1",</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> "password": "admin123"</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> }</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> }</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> },</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> "scope": {</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> "domain": {</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> "id": "6a530272037f4672b41e5be12b2d1670"</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> }</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> }</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""> }</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style="">}</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""><br clear="none"></div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style="">4. I then created two projects in the domain dom1. </div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""><br clear="none"></div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style="">5. Now when I try to get a list of all the projects in that domain using <b id="yiv6450938584yui_3_16_0_1_1424214203221_4097">HTTP GET /keystone/v3/projects</b> API call (and passing the admin1 login token) I get a 403 error with the following response: </div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""><br clear="none"></div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""><span class="yiv6450938584" style="color:rgb(17, 17, 17);font-family:Consolas, 'Andale Mono', Courier, monospace;font-size:13px;line-height:20px;">{</span></div><ul class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_4144" style="padding-left:0px;margin-top:0px;margin-bottom:0px;margin-left:2em;list-style-type:none;color:rgb(17, 17, 17);font-family:Consolas, 'Andale Mono', Courier, monospace;font-size:13px;line-height:20px;"><li class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_4143" style=""><div class="yiv6450938584" style="cursor:pointer;"></div><span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_4278" style="font-weight:bold;">"error"</span>: {<ul class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_4146" style="padding-left:0px;margin-top:0px;margin-bottom:0px;margin-left:2em;list-style-type:none;"><li class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_4151" style=""><span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_4277" style="font-weight:bold;">"code"</span>: <span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_4150" style="color:blue;">403</span>,</li><li class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_4149" style=""><span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_4148" style="font-weight:bold;">"message"</span>: <span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_4196" style="color:green;">"You are not authorized to perform the requested action: identity:list_projects"</span>,</li><li class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_4145" style=""><span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_4147" style="font-weight:bold;">"title"</span>: <span class="yiv6450938584" style="color:green;">"Forbidden"</span></li></ul>}</li></ul><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_4142"><span class="yiv6450938584" id="yiv6450938584yui_3_16_0_1_1424214203221_4141" style="color:rgb(17, 17, 17);font-family:Consolas, 'Andale Mono', Courier, monospace;font-size:13px;line-height:20px;">}</span><br clear="none"></div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""><br clear="none"></div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style="">What am I missing? Would really appreciate any pointers...</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style=""><br clear="none"></div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style="">Regards,</div><div class="yiv6450938584" dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3439" style="">-Deep.</div><div dir="ltr" id="yiv6450938584yui_3_16_0_1_1424214203221_3602"> <br clear="none"></div></div></div></blockquote></div></div></div><br><br></div> </div> </div> </div> </div></body></html>