OpenStack Identity (keystone)

Make role-assignment a first class entity

Registered by Henry Nash

In Havana, we introduced the GET /role-assignment API, but deferred its promotion to a first class entity with full crud access. This would replace the existing grant crud of, e.g., DELETE /users/{user_id}/projects/{project_id}/roles/{role_id}. These would, of course, still be supported, but marked as depreciated.

Blueprint information

Status:
Complete
Approver:
None
Priority:
Not
Drafter:
Henry Nash
Direction:
Needs approval
Assignee:
Henry Nash
Definition:
Obsolete
Series goal:
None
Implementation:
Not started
Milestone target:
None
Completed by
Steve Martinelli

Related branches

Sprints

Whiteboard

Identifiers in Role assignments need to be scoped by domain. We can do a migration for the current set of assignments: if it is a UUID, lookup the domain for that uuid and add it to the assignment.

The reason for this is to make it possible to identity which backend a user or group is stored in.

stevemar: mark this as obsolete so it doesn't show up, i'm unsure if this is something we want to pursue. let's use the spec process

(?)

Work Items

This blueprint contains Public information 
Everyone can see this information.