I think they are. If they are not, things will break if federation is used for sure. If you know that it is please let me know. I want to deploy federation at some point but was waiting for dashboard support. Now that the dashboard supports it, I may try it soon. Its a no-go still though if heat doesn't work with it.
Thanks, Kevin ________________________________________ From: Jay Pipes [jaypi...@gmail.com] Sent: Wednesday, March 15, 2017 11:41 AM To: openstack-dev@lists.openstack.org Subject: Re: [openstack-dev] [tc][appcat] The future of the App Catalog On 03/15/2017 01:21 PM, Fox, Kevin M wrote: > Other OpenStack subsystems (such as Heat) handle this with Trusts. A service > account is made in a different, usually SQL backed Keystone Domain and a > trust is created associating the service account with the User. > > This mostly works but does give the trusted account a lot of power, as the > roles by default in OpenStack are pretty coarse grained. That should be > solvable though. I didn't think Keystone trusts and Keystone federation were compatible with each other, though? Did that change recently? Best, -jay __________________________________________________________________________ OpenStack Development Mailing List (not for usage questions) Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev __________________________________________________________________________ OpenStack Development Mailing List (not for usage questions) Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev