<p dir="auto">Hi</p>
<p dir="auto">I'm testing this simple template: https://github.com/openstack/heat-templates/blob/master/hot/autoscaling.yaml</p>
<p dir="auto">But please notice that Fuel Health Test autoscale also fails.....so I guess those trusts and domains might not be correctly deployed.......</p>
<p dir="auto">:(</p>
<p dir="auto">Regards <br>
J.<br></p>
<p dir="auto">De: Pavlo Shchelokovskyy<br>
Enviado: martes 10 de mayo 20:04<br>
Asunto: Re: [Openstack] Heat autoscaling: heat.engine.resource Forbidden: You are not authorized to perform the requested action.<br>
Para: magicboiz@hotmail.com<br>
Cc: openstack@lists.openstack.org<br></p>
<p dir="auto">Hi,</p>
<p dir="auto">no, "heat_stack_owner" role is actually not needed in MOS 8.0. Earlier it was used as a special role to pass via trusts, but now all roles are passed via trust by default. You also do not have to be "admin" either, priviledge "escalation" is handled by Heat using Keystone V3 trusts and domains which should have been set up automatically during deployment.</p>
<p dir="auto">One question though - Is by any chance the "heat_stack_user" role assigned to the actual ("human") user who is accessing Heat API? It _must_not_ be - this is a special role used by internal Heat-created users (implementation detail), and it has _very_ limited privileges in regard Heat API access.</p>
<p dir="auto">Also, could you show the template you are testing autoscaling with? just in case...<br></p>
<p dir="auto">Cheers,<br></p>
<p dir="auto">Dr. Pavlo Shchelokovskyy</p>
<p dir="auto">Senior Software Engineer</p>
<p dir="auto">Mirantis Inc</p>
<p dir="auto"><a href="http://www.mirantis.com">www.mirantis.com</a><br></p>
<p dir="auto">On Tue, May 10, 2016 at 6:52 PM, <a href="mailto:magicboiz@hotmail.com">magicboiz</a><a href="mailto:magicboiz@hotmail.com">@hotmail.com</a> <<a href="mailto:magicboiz@hotmail.com">magicboiz</a><a href="mailto:magicboiz@hotmail.com">@hotmail.com</a>> wrote:</p>
<blockquote type="cite"><p dir="auto">Hi again,</p>
<p dir="auto">these are the roles I have :</p>
<p dir="auto">#openstack role list <br>
+----------------------------------+-----------------+<br>
| ID | Name |<br>
+----------------------------------+-----------------+<br>
| 0d77782f1ae54fa799b0585b267fb746 | ResellerAdmin |<br>
| 2c0a5b381f2b4f10b42aaa09678210a5 | heat_stack_user |<br>
| 9fe2ff9ee4384b1894a90878d3e92bab | _member_ |<br>
| d819d32c0eba4c86a99241e741c241c1 | admin |<br>
| e0729bbb6f8544268fd371e50682754a | SwiftOperator |<br></p>
<p dir="auto">So, there is no "heat_stack_owner" role defined in my environment, but you're right, in <a href="http://docs.openstack.org/draft/install-guide-ubuntu/heat-install.html">http://docs.openstack.org/</a><a href="http://docs.openstack.org/draft/install-guide-ubuntu/heat-install.html">draft</a><a href="http://docs.openstack.org/draft/install-guide-ubuntu/heat-install.html">/</a><a href="http://docs.openstack.org/draft/install-guide-ubuntu/heat-install.html">install</a><a href="http://docs.openstack.org/draft/install-guide-ubuntu/heat-install.html">-</a><a href="http://docs.openstack.org/draft/install-guide-ubuntu/heat-install.html">guide</a><a href="http://docs.openstack.org/draft/install-guide-ubuntu/heat-install.html">-</a><a href="http://docs.openstack.org/draft/install-guide-ubuntu/heat-install.html">ubuntu</a><a href="http://docs.openstack.org/draft/install-guide-ubuntu/heat-install.html">/</a><a href="http://docs.openstack.org/draft/install-guide-ubuntu/heat-install.html">heat</a><a href="http://docs.openstack.org/draft/install-guide-ubuntu/heat-install.html">-install.html</a> docs says:</p>
<p dir="auto"><i>Add</i><i> the </i><i>heat_stack_owner</i><i> role to the </i><i>demo</i><i> </i><i>project</i><i> and </i><i>user</i><i> to </i><i>enable</i><i> </i><i>stack</i><i> </i><i>management</i><i> </i><i>by</i><i> the </i><i>demo</i><i> </i><i>user</i><i>:</i></p>
<p dir="auto"><i>$</i><i> </i><i>openstack</i><i> role </i><i>add</i><i> --</i><i>project</i><i> demo --</i><i>user</i><i> demo heat_stack_owner</i> <br></p>
<p dir="auto">Is this a bug in Mirantis MOS 8.0? <br></p>
<p dir="auto">On 10/05/16 17:05, <a href="mailto:magicboiz@hotmail.com">magicboiz</a><a href="mailto:magicboiz@hotmail.com">@hotmail.com</a> wrote:</p>
</blockquote>
<blockquote type="cite"><blockquote type="cite"><p dir="auto">Hi Raghavendra,<br></p>
<p dir="auto">how can I check those privileges? Even with "admin" user, I get the same error..... :(</p>
<p dir="auto">Best regards</p>
<p dir="auto">J.</p>
<p dir="auto">On 10/05/16 13:23, <a href="mailto:raghavendra.lad@accenture.com">raghavendra.lad@accenture.com</a> wrote:</p>
</blockquote>
</blockquote>
<blockquote type="cite"><blockquote type="cite"><blockquote type="cite"><p dir="auto">Hi Mag,</p>
<p dir="auto"> </p>
<p dir="auto">Please check if you have provided the <b>heat</b><b>-</b><b>stack</b><b>-</b><b>owner</b> and <b>admin</b><b> </b>privileges to the tenant then try to spin up the Heat stack.</p>
<p dir="auto"> </p>
<p dir="auto">Regards,</p>
<p dir="auto">Raghavendra Lad</p>
<p dir="auto"> </p>
<p dir="auto"><b>From</b><b>:</b> <a href="mailto:magicboiz@hotmail.com">magicboiz</a><a href="mailto:magicboiz@hotmail.com">@hotmail.com</a> [<a href="mailto:magicboiz@hotmail.com">mailto:magicboiz@hotmail.com</a>] <br>
<b>Sent</b><b>:</b> Tuesday, May 10, 2016 4:30 PM<br>
<b>To:</b> <a href="mailto:openstack@lists.openstack.org">openstack</a><a href="mailto:openstack@lists.openstack.org">@lists.openstack.org</a><br>
<b>Subject</b><b>:</b> [Openstack] Heat autoscaling: heat.engine.resource Forbidden: You are not authorized to perform the requested action.</p>
<p dir="auto"> </p>
<p dir="auto">Hi</p>
<p dir="auto">testing Openstack Mitaka (deployed with Mirantis FUEL 8.0), when testing Heat Autoscaling, I get this error:</p>
<p dir="auto"><i>heat.engine.resource </i><i>Forbidden</i><i>: You are </i><i>not</i><i> </i><i>authorized</i><i> to </i><i>perform</i><i> the </i><i>requested</i><i> </i><i>action</i><i>.</i></p>
<p dir="auto"> </p>
<p dir="auto">Any ideas on what's going on?</p>
<p dir="auto"> </p>
<p dir="auto">Thanks in advance.</p>
<p dir="auto">J</p>
<p dir="auto"> </p>
<p dir="auto"> <br><br></p>
<p dir="auto"><font color ="#888888">This</font><font color ="#888888"> </font><font color ="#888888">message</font><font color ="#888888"> is </font><font color ="#888888">for</font><font color ="#888888"> the </font><font color ="#888888">designated</font><font color ="#888888"> </font><font color ="#888888">recipient</font><font color ="#888888"> </font><font color ="#888888">only</font><font color ="#888888"> and </font><font color ="#888888">may</font><font color ="#888888"> </font><font color ="#888888">contain</font><font color ="#888888"> </font><font color ="#888888">privileged</font><font color ="#888888">, </font><font color ="#888888">proprietary</font><font color ="#888888">, or </font><font color ="#888888">otherwise</font><font color ="#888888"> </font><font color ="#888888">confidential</font><font color ="#888888"> </font><font color ="#888888">information</font><font color ="#888888">. </font><font color ="#888888">If</font><font color ="#888888"> you </font><font color ="#888888">have</font><font color ="#888888"> </font><font color ="#888888">received</font><font color ="#888888"> </font><font color ="#888888">it</font><font color ="#888888"> in error, </font><font color ="#888888">please</font><font color ="#888888"> </font><font color ="#888888">notify</font><font color ="#888888"> the </font><font color ="#888888">sender</font><font color ="#888888"> </font><font color ="#888888">immediately</font><font color ="#888888"> and </font><font color ="#888888">delete</font><font color ="#888888"> the original. </font><font color ="#888888">Any</font><font color ="#888888"> </font><font color ="#888888">other</font><font color ="#888888"> use of the e-</font><font color ="#888888">mail</font><font color ="#888888"> </font><font color ="#888888">by</font><font color ="#888888"> you is </font><font color ="#888888">prohibited</font><font color ="#888888">. </font><font color ="#888888">Where</font><font color ="#888888"> </font><font color ="#888888">allowed</font><font color ="#888888"> </font><font color ="#888888">by</font><font color ="#888888"> local </font><font color ="#888888">law</font><font color ="#888888">, </font><font color ="#888888">electronic</font><font color ="#888888"> </font><font color ="#888888">communications</font><font color ="#888888"> with </font><font color ="#888888">Accenture</font><font color ="#888888"> and </font><font color ="#888888">its</font><font color ="#888888"> </font><font color ="#888888">affiliates</font><font color ="#888888">, </font><font color ="#888888">including</font><font color ="#888888"> e-</font><font color ="#888888">mail</font><font color ="#888888"> and </font><font color ="#888888">instant</font><font color ="#888888"> </font><font color ="#888888">messaging</font><font color ="#888888"> (</font><font color ="#888888">including</font><font color ="#888888"> </font><font color ="#888888">content</font><font color ="#888888">), </font><font color ="#888888">may</font><font color ="#888888"> be </font><font color ="#888888">scanned</font><font color ="#888888"> </font><font color ="#888888">by</font><font color ="#888888"> our </font><font color ="#888888">systems</font><font color ="#888888"> </font><font color ="#888888">for</font><font color ="#888888"> the </font><font color ="#888888">purposes</font><font color ="#888888"> of </font><font color ="#888888">information</font><font color ="#888888"> </font><font color ="#888888">security</font><font color ="#888888"> and </font><font color ="#888888">assessment</font><font color ="#888888"> of </font><font color ="#888888">internal</font><font color ="#888888"> </font><font color ="#888888">compliance</font><font color ="#888888"> with </font><font color ="#888888">Accenture</font><font color ="#888888"> </font><font color ="#888888">policy</font><font color ="#888888">. </font><br>
<font color ="#888888">______________________________________________________________________________________</font></p>
<p dir="auto"><a href="http://www.accenture.com"><font color ="#888888">www.accenture.com</font></a><br>
</p>
</blockquote>
</blockquote>
</blockquote>
<blockquote type="cite"><blockquote type="cite"><p dir="auto"><br><br></p>
<p dir="auto">_______________________________________________ Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">http://lists.openstack.org/</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">cgi</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">-</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">bin</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">/</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">mailman</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">/</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">listinfo</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">/</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">openstack</a> Post to : <a href="mailto:openstack@lists.openstack.org">openstack</a><a href="mailto:openstack@lists.openstack.org">@lists.openstack.org</a> Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">http://lists.openstack.org/</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">cgi</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">-</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">bin</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">/</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">mailman</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">/</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">listinfo</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">/</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">openstack</a> <br>
</p>
</blockquote>
</blockquote>
<blockquote type="cite"><p dir="auto"><br></p>
<p dir="auto">_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">http://lists.openstack.org/</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">cgi</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">-</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">bin</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">/</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">mailman</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">/</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">listinfo</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">/</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org">openstack</a><a href="mailto:openstack@lists.openstack.org">@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">http://lists.openstack.org/</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">cgi</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">-</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">bin</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">/</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">mailman</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">/</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">listinfo</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">/</a><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack">openstack</a><br>
</p>
</blockquote>
<p dir="auto"><br><br></p>