V3 Identity API: No documented purpose for unscoped tokens

[justinsb]

The V3 Identity API does not document a purpose for unscoped tokens (vs domain tokens).

This causes confusion, see e.g. Bug #1208640, Bug #1208639.

[Adam Young (ayoung)]

This is probably optimized for Horizon, where they need to get a token from just userid and password, but want to have it linked to a project if possible in order to avoid doing multiple calls to keystone:

But Horizon needs to do multiple calls anyway. Probably what should haoppen is that if a user requests a token without explicit scope, they should get an unscoped token and a list of their projects, and optionally domains for which they have roles as well as a default project id. Then, Horizon or other UIs could chose to get a scoped token for the default project, or let the user select a project at that point.

Once we can do that, we have a cleaner way to do token reissue. tokens should only be reissued for the same or smaller scope. An unscoped token could get a token scoped to project or domain. Domain can only get other domain scoped tokens with fewer roles.

[Dolph Mathews (dolph)]

So, it turns out there is a documented purpose for unscoped tokens [1]. Aaand I probably wrote it:

  A response without an explicit authorization scope does not contain a catalog,
  project, domain or roles but can be used to uniquely identify the user.

Further, we turn around and illustrate a use for an unscoped tokens [2]:

  If the authenticating user is already in possession of a valid token, then
  that token is sufficient to identity the user. This method is typically used
  in combination with request to change authorization scope.

I came across this because I'm also working to replace "unscoped" tokens entirely with "service-scoped" tokens [3], which is exactly how we've always used and referred to them (as implicitly scoped to keystone itself)... so hopefully this will be a non-issue by the end of icehouse.

[1]: https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#authentication-responses

[2]: https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#the-token-authentication-method

[3]: https://review.openstack.org/#/c/61869/