Open Stack

Hi, I'd like you to take a look at this patch for potential
DocImpact.
https://review.openstack.org/35986

Log:
commit 38018a7a8f5c02d63e8cd4182239d82caf89122b
Author: Henry Nash <henryn at linux.vnet.ibm.com>
Date:   Fri Jul 5 06:04:25 2013 +0100

    Implement role assignment inheritance (OS-INHERIT extension)
    
    This extension allows for project roles to be optionally
    inherited from the owning domain.  The v3 grant APIs are extended
    to take an inherited_to_projects flag.  The GET role_assignments
    API will also include these roles in its response, either showing them
    as inherited roles assigned to the domain or, if the 'effective'
    query parameter is set, will interpret the inheritance and reflect
    those role assignments on the projects.
    
    The inherited_to_projects flag is encoded in the role list in
    the metadata of the relevant entries in the grant tables. The
    'roles' key in the metadata is now a list of dicts, as opposed
    to a simple list, where each dict is either
    
    {'id': role_id} for a regular role, or
    {'id': role_id, 'inherited_to': 'projects'} for an inherited role
    
    Remember that a previous patch had rationalized the way metadata is
    handled so that its structure is entirely hidden within the driver
    layer.
    
    The extension can be enabled/disabled via a config setting.
    
    Limitations:
    
    - The extension is not yet discoverable via url, this will be added
      as a separate patch when the v3/extensions work is complete.
    
    A separate issue has been discovered with the fact that the v2
    calls of 'get_projects_for_user()' and 'list_user_projects()'
    should be rationalized and also honor both group (and inherited)
    role assignments.  This is being raised as a separate bug.
    
    DocImpact
    
    Implements bp inherited-domain-roles
    
    Change-Id: I35b57ce0df668f12462e96b3467cef0239594e97

Automatically generated bug (please review):
https://bugs.launchpad.net/bugs/1201965