[
https://issues.apache.org/jira/browse/JCLOUDS-1414?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16458500#comment-16458500
]
Alix Lourme commented on JCLOUDS-1414:
--------------------------------------
After debugging the _domain_ creation for _project_ & _user_, this use case is
supported: By using the *jclouds.keystone.tenant-id* property:
* The domain of project scope is retrieved firstly from _tenant-id_ (cf.
[BindAuthToJsonPayload.parseScope()|https://github.com/jclouds/jclouds/blob/f7b45341328410dea583901a31218a3588cb5aad/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v3/binders/BindAuthToJsonPayload.java#L96])
* The domain of user is retrieved only from _tenantOrDomainName_ (cf.
[BindAuthToJsonPayload.buildAuth()|https://github.com/jclouds/jclouds/blob/f7b45341328410dea583901a31218a3588cb5aad/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v3/binders/BindPasswordAuthToJsonPayload.java#L44]])
So this snippet does the job:
{code}
overrides.put(KeystoneProperties.TENANT_ID, "default");
overrides.put(KeystoneProperties.SCOPE, "project:myTenant");
ContextBuilder.newBuilder(...).credentials("ldap:foo", "bar")....buildApi(...);
{code}
But this is perhaps more a hack on scope creation than a real usage of these
properties.
> OpenStack Keystone V3: Support different "domain" for "identity/user" and
> "project"
> -----------------------------------------------------------------------------------
>
> Key: JCLOUDS-1414
> URL: https://issues.apache.org/jira/browse/JCLOUDS-1414
> Project: jclouds
> Issue Type: Improvement
> Components: jclouds-core
> Affects Versions: 2.1.0
> Reporter: Alix Lourme
> Priority: Critical
> Labels: keystone, openstack
>
> The [OpenStack KeyStone
> V3|https://jclouds.apache.org/blog/2018/01/16/keystone-v3/] is great, but
> fails when OpenStack platform in endpoint requires a _identify/user_ *domain*
> different than _project_ *domain.*
> Consider this required content for https://[host]/v3/auth/tokens endpoint:
> {code}
> {
> "auth": {
> "identity": {
> "methods": ["password"],
> "password": {
> "user": {
> "name": "foo",
> "domain": {
> "name": "ldap"
> },
> "password": "bar"
> }
> }
> },
> "scope": {
> "project": {
> "name": "myTenantName",
> "domain": {
> "name": "default"
> }
> }
> }
> }
> }
> {code}
> The
> [BaseAuthenticator|https://github.com/jclouds/jclouds/blob/f7b45341328410dea583901a31218a3588cb5aad/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/auth/functions/BaseAuthenticator.java#L84]
> is using always the same domain for the request :(.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
