Open Stack

Hi Vinod!

I think you can simplify the roles in the hierarchical model by only passing the roles for the authenticated project and above. All roles are then inherited down. This means it isn’t necessary to pass a scope along with each role. The scope is just passed once with the token and the project-admin role (for example) would be checking to see that the user has the project-admin role and that the project_id prefix matches.

There is only one case that this doesn’t handle, and that is when the user has one role (say member) in ProjA and project-admin in ProjA2. If the user is authenticated to ProjA, he can’t do project-adminy stuff for ProjA2 without reauthenticating. I think this is a reasonable sacrifice considering how much easier it would be to just pass the parent roles instead of going through all of the children.

Vish

On Feb 13, 2014, at 2:31 AM, Vinod Kumar Boppanna <vinod.kumar.boppanna at cern.ch> wrote:

> Dear All,
> 
> At the meeting last week we (myself and Ulrich) have been assigned the task of doing POC for Quota Management in the Hierarchical Multitenancy setup. 
> 
> So, here it is:
> 
> Wiki Page -> https://wiki.openstack.org/wiki/POC_for_QuotaManagement   (explained here an example setup and my thoughts)
> 
> Code -> https://github.com/vinodkumarboppanna/POC-For-Quotas/commit/391e9108fa579d292880c8836cadfd7253586f37
> 
> Please post your comments or any inputs and i hope this POC will be discussed in this weeks meeting on Friday at 1600 UTC.
> 
> 
> In addition to this, we have completed the implementation the Domain Quota Management in Nova with V2 APIs, and if anybody interested, please have a look
> 
> BluePrint -> https://blueprints.launchpad.net/nova/+spec/domain-quota-driver-api
> Wiki Page -> https://wiki.openstack.org/wiki/APIs_for_Domain_Quota_Driver
> GitHub Code -> https://github.com/vinodkumarboppanna/DomainQuotaAPIs
> 
> 
> Thanks & Regards,
> Vinod Kumar Boppanna
> 
> _______________________________________________
> OpenStack-dev mailing list
> OpenStack-dev at lists.openstack.org
> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20140214/e3e5d135/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 455 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20140214/e3e5d135/attachment.pgp>