Description of problem: There two keystone domains - default and cee, cee is mapped to LDAP. We want set a default admin user as domain admin of cee (LDAP) domain. Command doesn't fail, but admin user cannot act as admin of domain cee. Version-Release number of selected component (if applicable): How reproducible: always Steps to Reproduce: 1. let have two domains in keystone, default and LDAP based named e.g. cee 2. grant admin user admin role on cee domain 3. authorize against cee domain with admin user (without project/tenant) Actual results: auth error Expected results: admin can access all projects/tenants in cee domain Additional info: This BZ came from CloudForms integration https://bugzilla.redhat.com/show_bug.cgi?id=1455829 see the original BZ for more information.
Can you confirm that OS_PROJECT_DOMAIN_NAME is set to the cee domain?
openstack_domain_id was set to cee domain IIRC, but I cannot say what project was specified or if it was nil. Does OS_PROJECT_DOMAIN_NAME matter for this case in Keystone HTTP API?
Hi Marek, Yes, for this case OS_PROJECT_DOMAIN_NAME will be important to define the scope of the token. We add more details in the original bugzilla report: https://bugzilla.redhat.com/show_bug.cgi?id=1455829 Can you confirm that is enough to fix their problem?
Hi, we're testing adding OS_PROJECT_DOMAIN_NAME and OS_USER_DOMAIN_NAME parameters instead of OPENSTACK_DOMAIN_ID. Do you know from what OSP version are OS_PROJECT_DOMAIN_NAME and OS_USER_DOMAIN_NAME were parameters supported?
Using OS_PROJECT_DOMAIN_NAME and OS_USER_DOMAIN_NAME parameters looks to be working for us. No need for fix on Keystone side, thanks.