Open Stack

Terry Howe <terrylhowe at gmail.com> wrote on 06/19/2015 10:22:51 AM:

> From: Terry Howe <terrylhowe at gmail.com>
> To: "OpenStack Development Mailing List (not for usage questions)" 
> <openstack-dev at lists.openstack.org>
> Date: 06/19/2015 10:25 AM
> Subject: Re: [openstack-dev] [Keystone][OSC] Keystone v3 user create
> --project $projid does not add user to project?
> 
> On Fri, Jun 19, 2015 at 12:30 AM, Matthias Runge <mrunge at redhat.com> 
wrote:
> On 18/06/15 17:58, Dolph Mathews wrote:
> This was entirely intentional, in order to replace the implicit role
> assignment behavior in v2 with an explicit behavior in v3.

> 
> I must admit, this is quite irritating, as the command line client 
> still offers the --project ability; dropping this silently leads to 
> somewhat unexpected results.
> 
> From a user perspective, I would appreciate a warning in such cases;
> this is a common pattern everywhere else in OpenStack.
> 
> A good place to vent your rage: 
https://launchpad.net/python-openstackclient 

I don't think OSC is the place to vent, we are simply following the APIs 
[0] and python clients [1]. It's a valid option for setting a default 
project.
The behavior of the "--project" parameter changed from v2 to v3. In v2.0 
it used to imply a "_member_" role in that project. Now, in v3, it sets a 
default project that the user can leverage at authentication time [2].

[0] 
http://specs.openstack.org/openstack/keystone-specs/api/v3/identity-api-v3.html#create-user
[1] 
https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v3/users.py#L51
[2] 
https://github.com/openstack/keystone/blob/master/keystone/auth/controllers.py#L413-L431

Thanks,

Steve Martinelli
OpenStack Keystone Core
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20150619/3d475d65/attachment.html>