[
https://issues.apache.org/jira/browse/JCLOUDS-1414?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16456932#comment-16456932
]
Alix Lourme commented on JCLOUDS-1414:
--------------------------------------
Hello [~andreaturli],
{quote}
I'm not sure I understand when authentication domain and scope can be
different. Why can't you use the same domain to authenticate and to specify the
scope?
{quote}
The use case is for HP Helion Openstack platform in my company, and the
improvment of
[teamcity-openstack-plugin|https://github.com/yandex-qatools/teamcity-openstack-plugin]
to support Keystone V3 in this case: when user authentication is binded on a
third-part IAM solution (here LDAP), the _user/domain_ can be different than
the _tenant/domain_ (generally _default_).
And it seems to be the only way to login. I have tried with
[scope|https://github.com/jclouds/jclouds/blob/f7b45341328410dea583901a31218a3588cb5aad/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/config/KeystoneProperties.java#L81]
_domain_ (and not _project_) but it fails.
These informations are part of [OpenStack authentication
properties|https://docs.openstack.org/mitaka/install-guide-ubuntu/keystone-openrc.html].
For sample, for OpenStack instances interaction with _ansible_
([os_server|https://docs.ansible.com/ansible/latest/modules/os_server_module.html]),
the _auth_ dictionary is:
{code}
auth_url: https://[hostname]/v3
project_domain_name: default
project_name: myTenantName
user_domain_name: ldap
username: foo
password: bar
{code}
{quote}
Can you please elaborate a bit more about the scenario you want to support?
{quote}
_+NB+: I'm not a specialist of OpenStack, so my following proposals are perhaps
not the best practices about usage and other cloud platforms authentication._
The [extraction of tenant name from
identity|https://github.com/jclouds/jclouds/blob/f7b45341328410dea583901a31218a3588cb5aad/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/auth/functions/BaseAuthenticator.java#L72]
_seems_ come from OpenStack Keystone v2, but does not match with this dubble
domain Keystone v3 use case.
So 2 potential way:
1° _Identity_ contains all informations about domains & tenant & user => a 4
blocks string:
{code}
default:myTenantName:ldap:foo --> Covers the use case
myTenantName:ldap:foo --> "default" domain is used for tenant (because
not defined)
myTenantName:foo --> "default" domain is used for tenant & user
domains ; and compatible with v2
{code}
2° The [project
scope|https://github.com/jclouds/jclouds/blob/f7b45341328410dea583901a31218a3588cb5aad/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/config/KeystoneProperties.java#L74]
could contain the domain:
{code}
overrides.put(KeystoneProperties.SCOPE, "project:default:jclouds");
{code}
where _identity_ keep the user/domain:
{code}
.credentials("ldap:foo", "bar")
{code}
Available for any complements or tests (Monday, because I have no OpenStack
platform @ home ^^)
Best regards
> OpenStack Keystone V3: Support different "domain" for "identity/user" and
> "project"
> -----------------------------------------------------------------------------------
>
> Key: JCLOUDS-1414
> URL: https://issues.apache.org/jira/browse/JCLOUDS-1414
> Project: jclouds
> Issue Type: Improvement
> Components: jclouds-core
> Affects Versions: 2.1.0
> Reporter: Alix Lourme
> Priority: Critical
> Labels: keystone, openstack
>
> The [OpenStack KeyStone
> V3|https://jclouds.apache.org/blog/2018/01/16/keystone-v3/] is great, but
> fails when OpenStack platform in endpoint requires a _identify/user_ *domain*
> different than _project_ *domain.*
> Consider this required content for https://[host]/v3/auth/tokens endpoint:
> {code}
> {
> "auth": {
> "identity": {
> "methods": ["password"],
> "password": {
> "user": {
> "name": "foo",
> "domain": {
> "name": "ldap"
> },
> "password": "bar"
> }
> }
> },
> "scope": {
> "project": {
> "name": "myTenantName",
> "domain": {
> "name": "default"
> }
> }
> }
> }
> }
> {code}
> The
> [BaseAuthenticator|https://github.com/jclouds/jclouds/blob/f7b45341328410dea583901a31218a3588cb5aad/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/auth/functions/BaseAuthenticator.java#L84]
> is using always the same domain for the request :(.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
