<div dir="ltr">Apparently forgot to mention this is on Kilo (ubuntu cloudarchive packaged version which is still 2015.1.0)<br><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Aug 25, 2015 at 12:00 AM, Steve Martinelli <span dir="ltr"><<a href="mailto:stevemar@ca.ibm.com" target="_blank">stevemar@ca.ibm.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><p>Right, v2 and policy don't mix : (</p></div></blockquote><div><br></div><div>Ah yes! that gets me much further. After discovering I also needed to add 'list_roles' I'm getting:<br><br> 2015-08-25 14:30:52.659 12798 TRACE keystone.common.wsgi RuntimeError: maximum recursion depth exceeded<br><br></div><div>when running as the 'project_admin' this seems to be during the 'list_roles' call as I get the same error trying to list roles, though not as admin so pretty sure it's now my logic that's off. Also 'openstack role list' as admin works as project_admin it generates a similar error to the 'openstack role add --user jon-test --project test-group _memeber_'<br><br></div><div>Fresh grep of related policy:<br><br> "project_admin": "project_id:%(project_id)s and role:project_admin",<br> "admin_or_proj_admin": "rule:admin_required or rule:admin_or_proj_admin",<br> "identity:get_project": "rule:admin_or_proj_admin",<br> "identity:update_project": "rule:admin_or_proj_admin",<br> "identity:get_user": "rule:admin_or_proj_admin",<br> "identity:get_role": "rule:admin_or_proj_admin",<br> "identity:list_roles": "rule:admin_or_proj_admin",<br> "identity:create_grant": "rule:admin_or_proj_admin",<br> "identity:revoke_grant": "rule:admin_or_proj_admin",<br> "identity:list_role_assignments": "rule:admin_or_proj_admin",<br><br></div><div>full debug log of failed call from keystone server: <a href="http://paste.openstack.org/show/427313/">http://paste.openstack.org/show/427313/</a><br><br></div><div>Thanks,<br></div><div>-Jon<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><p>The controller goes right to checking for admin-ness: <a href="https://github.com/openstack/keystone/blob/master/keystone/assignment/controllers.py#L144-L161" target="_blank">https://github.com/openstack/keystone/blob/master/keystone/assignment/controllers.py#L144-L161</a><br>Whereas in v3, it actually checks the policy.json file: <a href="https://github.com/openstack/keystone/blob/master/keystone/assignment/controllers.py#L387-L396" target="_blank">https://github.com/openstack/keystone/blob/master/keystone/assignment/controllers.py#L387-L396</a><br><br>Use openstackclient with v3 settings, example env. vars here: <a href="http://docs.openstack.org/developer/python-openstackclient/authentication.html#authenticating-using-identity-server-api-v3" target="_blank">http://docs.openstack.org/developer/python-openstackclient/authentication.html#authenticating-using-identity-server-api-v3</a><br><br>and try `openstack role add _member --user jon-test --project test-group` it should work.<span class=""><br><br>Thanks,<br><br>Steve Martinelli<br>OpenStack Keystone Core<br><br></span><img src="cid:1__=8FBBF43FDF863B968f9e8a93df938690918c8FB@" alt="Inactive hide details for Morgan Fainberg ---2015/08/24 10:49:22 PM---The policy file is not really used for v2 keystone. There" height="16" width="16" border="0"><font color="#424282">Morgan Fainberg ---2015/08/24 10:49:22 PM---The policy file is not really used for v2 keystone. There are very limited things that can be done w</font><br><br><font color="#5F5F5F" size="2">From: </font><font size="2">Morgan Fainberg <<a href="mailto:morgan.fainberg@gmail.com" target="_blank">morgan.fainberg@gmail.com</a>></font><br><font color="#5F5F5F" size="2">To: </font><font size="2">Jonathan Proulx <<a href="mailto:jon@jonproulx.com" target="_blank">jon@jonproulx.com</a>></font><br><font color="#5F5F5F" size="2">Cc: </font><font size="2">"<a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a>" <<a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a>></font><br><font color="#5F5F5F" size="2">Date: </font><font size="2">2015/08/24 10:49 PM</font><br><font color="#5F5F5F" size="2">Subject: </font><font size="2">Re: [Openstack] Keystone policy to allow project_admins to add (existing) users to their projects</font><br></p><hr style="color:rgb(128,145,165)" width="100%" noshade size="2" align="left"><br><br><div><div class="h5"><br><tt>The policy file is not really used for v2 keystone. There are very limited things that can be done with v2 and policy. <br><br>Please also note that the keystoneclient cli only supports v2 (and is deprecated in favor of the common openstack client). <br><br>Other than those two point Steve's email is spot on. <br><br>Cheers,<br>Morgan<br><br>Sent via mobile<br><br>> On Aug 24, 2015, at 13:41, Jonathan Proulx <<a href="mailto:jon@jonproulx.com" target="_blank">jon@jonproulx.com</a>> wrote:<br>> <br>> HI,<br>> <br>> I want to create a 'project_admin' role with the ability to add and<br>> remove existing users from the project in which one has this role.<br>> But it's not working as I thought. Here's what I tried in policy.json<br>> (note #comments are not in the json file):<br>> <br>> # set up the rules<br>> "project_admin": "project_id:%(project_id)s and role:project_admin",<br>> "admin_or_proj_admin": "rule:admin_required or rule:admin_or_proj_admin",<br>> # grant role to some things that were previously rule:admin_required<br>> "identity:get_project": "rule:admin_or_proj_admin",<br>> "identity:update_project": "rule:admin_or_proj_admin",<br>> "identity:get_user": "rule:admin_or_proj_admin",<br>> "identity:get_role": "rule:admin_or_proj_admin",<br>> "identity:create_grant": "rule:admin_or_proj_admin",<br>> "identity:revoke_grant": "rule:admin_or_proj_admin",<br>> "identity:list_role_assignments": "rule:admin_or_proj_admin",<br>> <br>> I'd started off with a smaller set (just the create_grant and<br>> revoke_grant) but added more access due to failures, but still not<br>> working.<br>> <br>> what I did:<br>> <br>> restarted keystone after editing policy.json (is this required?)<br>> <br>> # as admin user<br>> keystone user-role-add --user jon --role project_admin --tenant test-group<br>> <br>> # as user 'jon'<br>> keystone --debug --os-tenant-name test-group user-role-add --user<br>> jon-test --role _member_ --tenant test-group<br>> DEBUG:keystoneclient.auth.identity.v2:Making authentication request to<br>> </tt><tt><a href="https://keystone:5001/v2.0/tokens" target="_blank">https://keystone:5001/v2.0/tokens</a></tt><tt><br>> INFO:urllib3.connectionpool:Starting new HTTPS connection (1): keystone<br>> DEBUG:urllib3.connectionpool:Setting read timeout to 600.0<br>> DEBUG:urllib3.connectionpool:"POST /v2.0/tokens HTTP/1.1" 200 4915<br>> DEBUG:keystoneclient.session:REQ: curl -i -X GET<br>> </tt><tt><a href="https://keystone:35358/v2.0/users/jon-test" target="_blank">https://keystone:35358/v2.0/users/jon-test</a></tt><tt> -H "User-Agent:<br>> python-keystoneclient" -H "X-Auth-Token: <redacted>"<br>> INFO:urllib3.connectionpool:Starting new HTTPS connection (1): keystone<br>> DEBUG:urllib3.connectionpool:Setting read timeout to 600.0<br>> DEBUG:urllib3.connectionpool:"GET /v2.0/users/jon-test HTTP/1.1" 403 131<br>> DEBUG:keystoneclient.session:RESP:<br>> DEBUG:keystoneclient.session:Request returned failure status: 403<br>> You are not authorized to perform the requested action: admin_required<br>> (HTTP 403)<br>> <br>> am I tweaking the wrong rules or is something deeper in my way?<br>> <br>> Thanks,<br>> -Jon<br>> <br>> _______________________________________________<br>> Mailing list: </tt><tt><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a></tt><tt><br>> Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>> Unsubscribe : </tt><tt><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a></tt><tt><br><br>_______________________________________________<br>Mailing list: </tt><tt><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a></tt><tt><br>Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>Unsubscribe : </tt><tt><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a></tt><tt><br><br></tt><br><br><br>
</div></div><p></p></div>
</blockquote></div><br></div></div></div></div>