| commit | 30d48ff88782347e5deb31369aa228f7345cfc6f | [log] [tgz] |
|---|---|---|
| author | Lance Bragstad <lbragstad@gmail.com> | Wed Dec 12 19:41:36 2018 +0000 |
| committer | Lance Bragstad <lbragstad@gmail.com> | Wed Feb 27 19:53:58 2019 +0000 |
| tree | 062ae19a6ee20579bdac9a6edc66c8884fc5be1d | |
| parent | 72f632222f6d90d3545b5d7ca48297da4218e2ea [diff] |
Remove admin_domain_scope tempest setting Keystone is currently working through a bunch of changes to add proper system, domain, and project scope support for its API. This includes implementing ``admin``, ``member``, and ``reader`` roles for system, domain, and project assignments. More informaiton on those specific changes can be found here: https://review.openstack.org/#/q/(status:open+OR+status:closed)+project:openstack/keystone+branch:master+topic:implement-default-roles One thing that was uncovered in implementing that support for the project API was that setting tempest ``CONF.identity.admin_domain_scope = True`` meant domain admins of one domain would be able to list projects in other domains, highlighted in the following patch: https://review.openstack.org/#/c/624218/2 This commit doesn't set this option and assumes the proper domain-scoping behavior being built into keystone natively. Change-Id: I12a57cc43de0b17eababa19b7b94de5277689f82 Related-Bug: 1750660