Clone from upstream blueprint: https://blueprints.launchpad.net/keystone/+spec/reseller Description of problem: Implementing a support to limit sharing of resources both upwards and downwards in the hierarchy. To achieve this, the domains construct will be merged with project, allowing to distribute users in any point of the hierarchy, instead of only in a single domain. This blueprint covers the 1st phase of reseller, where projects can act as a domain, but only as a top level domain - i.e. no sub domains are allowed. A separate blueprint & spec will cover the augmentation of this to allow sub domains.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:1245