Re: [openstack-dev] [heat] Problems with Heat software configurations and KeystoneV2

2014-04-07 Thread Steven Hardy
On Sun, Apr 06, 2014 at 10:22:15PM -0400, Michael Elder wrote: If Keystone is configured with an external identity provider (LDAP, OpenID, etc), how does the creation of a new user per resource affect that external identity source? My understanding is that it should be possible to configure

Re: [openstack-dev] [heat] Problems with Heat software configurations and KeystoneV2

2014-04-07 Thread Michael Elder
; success is learning how to solve the customer’s problem.” -Mark Cook From: Steven Hardy sha...@redhat.com To: OpenStack Development Mailing List (not for usage questions) openstack-dev@lists.openstack.org Date: 04/07/2014 12:00 PM Subject:Re: [openstack-dev] [heat] Problems

Re: [openstack-dev] [heat] Problems with Heat software configurations and KeystoneV2

2014-04-06 Thread Michael Elder
@lists.openstack.org Date: 04/04/2014 09:54 PM Subject:Re: [openstack-dev] [heat] Problems with Heat software configurations and KeystoneV2 On 04/04/2014 02:46 PM, Clint Byrum wrote: Excerpts from Michael Elder's message of 2014-04-04 07:16:55 -0700: Opened in Launchpad: https

Re: [openstack-dev] [heat] Problems with Heat software configurations and KeystoneV2

2014-04-06 Thread Steve Baker
On 07/04/14 12:52, Michael Elder wrote: I think the net of the statement still holds though: the Keystone token mechanism defines a mechanism for authorization, why doesn't the heat stack manage a token for any behavior that requires authorization? Heat does use a token, but that token is

Re: [openstack-dev] [heat] Problems with Heat software configurations and KeystoneV2

2014-04-06 Thread Michael Elder
@lists.openstack.org Date: 04/06/2014 09:16 PM Subject:Re: [openstack-dev] [heat] Problems with Heat software configurations and KeystoneV2 On 07/04/14 12:52, Michael Elder wrote: I think the net of the statement still holds though: the Keystone token mechanism defines a mechanism

Re: [openstack-dev] [heat] Problems with Heat software configurations and KeystoneV2

2014-04-04 Thread Michael Elder
is not delivering a feature; success is learning how to solve the customer’s problem.” -Mark Cook From: Steve Baker sba...@redhat.com To: openstack-dev@lists.openstack.org Date: 04/03/2014 10:13 PM Subject:Re: [openstack-dev] [heat] Problems with Heat software configurations

Re: [openstack-dev] [heat] Problems with Heat software configurations and KeystoneV2

2014-04-04 Thread Clint Byrum
Excerpts from Michael Elder's message of 2014-04-04 07:16:55 -0700: Opened in Launchpad: https://bugs.launchpad.net/heat/+bug/1302624 I still have concerns though about the design approach of creating a new project for every stack and new users for every resource. If I provision 1000

Re: [openstack-dev] [heat] Problems with Heat software configurations and KeystoneV2

2014-04-04 Thread Clint Byrum
Excerpts from Adam Young's message of 2014-04-04 18:48:40 -0700: On 04/04/2014 02:46 PM, Clint Byrum wrote: Excerpts from Michael Elder's message of 2014-04-04 07:16:55 -0700: Opened in Launchpad: https://bugs.launchpad.net/heat/+bug/1302624 I still have concerns though about the design

[openstack-dev] [heat] Problems with Heat software configurations and KeystoneV2

2014-04-03 Thread Michael Elder
Hello, I'm looking for insights about the interaction between keystone and the software configuration work that's gone into Icehouse in the last month or so. I've found that when using software configuration, the KeystoneV2 is broken because the server.py#_create_transport_credentials()

Re: [openstack-dev] [heat] Problems with Heat software configurations and KeystoneV2

2014-04-03 Thread Steve Baker
On 04/04/14 14:05, Michael Elder wrote: Hello, I'm looking for insights about the interaction between keystone and the software configuration work that's gone into Icehouse in the last month or so. I've found that when using software configuration, the KeystoneV2 is broken because the