On Thu, Dec 7, 2017 at 5:37 PM, Pavlo Shchelokovskyy <pshchelokovs...@mirantis.com> wrote: > Hi all, > > We have a following use case - several independent keystones (say KeyA and > KeyB), using fernet tokens and synchronized fernet keys, and single external > IdP for federated auth. > > Is it generally possible to configure both KeyA and KeyB such that scoped > token issued by KeyA for a federated user is valid on KeyB? > > Currently we have the next problem - although domains/projects where > keystone's mapping engine assigns federated users are equal by name between > KeyA and KeyB, the UUIDs of projects/domains in KeyA and KeyB are > different, which seems to invalidate the scoped token issued by KeyA when > trying to use it for KeyB. And it is not possible to create projects/domains > with specific UUIDs via keystone API (which would probably solve this > problem for non-autoprovisioned projects). > > Is such usage scenario supported? Or one should always use the unscoped > token first to list projects/domains available on a specific keystone > instance and then get a scoped token for usage o this instance only?
No, it is not currently possible to use the same token on projects in different keystones, for the reasons you gave. You might be interested in following https://review.openstack.org/#/c/323499/ if you're not already aware of it, which has the goal of solving that problem. It's also been brought up before: https://review.openstack.org/#/c/403866/ http://lists.openstack.org/pipermail/openstack-dev/2016-December/108466.html And we talked about it a lot at the last Forum (sorry my brief summary does not really do the discussion justice): http://www.gazlene.net/sydney-summit.html#keystone-operator-and-user-feedback Lance mentioned today that we'd likely try to discuss it at our next weekly meeting: http://eavesdrop.openstack.org/#Keystone_Team_Meeting Colleen __________________________________________________________________________ OpenStack Development Mailing List (not for usage questions) Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
