Expose effective role assignments in client & CLI v3

[Andreas Jaeger]

The keystone client gives me with user-role-list the roles a single user has in one tenant - but there's no way to get a list of all tenants the user has a role in it.

[Dolph Mathews (dolph)]

This is available in the API via GET /v3/role_assignments -- but I don't see that functionality exposed in the client library (if so, it's definitely not available via OSC).

[Terry Howe (thowe-g)]

v3 just isn't working for me, abandoning the effort for now.

[Dolph Mathews (dolph)]

Terry: ping us in #openstack-keystone if you need a hand

[Rodrigo Duarte (rodrigodsousa)]

Hello there, in order to fix bug #1278920 we need to address this one. After taking a look at the current commands, we decided to create the following:

Positional argument: role-assignment-list with subcommands --tenant (and --tennant-id), --user (and --user-id) and --effective (see /role_assignments at http://api.openstack.org/api-ref-identity.html#Role_Calls).

To accomplish that, we'd need to create a new Resource and Manager (inheriting from base.CrudManager implementing only the list() method) classes at the keystoneclient project (in the /keystoneclient/v3/assignments.py file). In this way, the Python client call would be api.keystone.assignments.list().

Makes sense?

[Steve Martinelli (stevemar)]

@Rodrigo, that makes sense to me, and I think it warrants a blueprint for keystoneclient.

[Openstack Gerrit (openstack-gerrit)]

Related fix proposed to branch: master
Review: https://review.openstack.org/91578

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/91578
Committed: https://git.openstack.org/cgit/openstack/python-keystoneclient/commit/?id=0b0d2d3a9a909fcd00b1fda777201bd7c4608978
Submitter: Jenkins
Branch: master

commit 0b0d2d3a9a909fcd00b1fda777201bd7c4608978
Author: Rodrigo Duarte Sousa <email address hidden>
Date: Thu May 1 11:07:59 2014 -0300

    Add /role_assignments endpoint support

    This patch adds role assignments list support
    to keystoneclient.

    Created RoleAssignment resource and RoleAssignmentManager
    classes. RoleAssignmentManager only implements the list()
    method, the other inherited methods from base.CrudManager
    raises a MethodNotImplemented error with customized messages.

    This bp is complimented with the OSC part:
    https://blueprints.launchpad.net/python-openstackclient/+spec/roles-assignment-list

    Change-Id: I164b58b67ff42320238e943ddfa9d0a8aadd0a6d
    Implements: blueprint roles-assignment-support
    Closes-Bug: #1246310

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/91634
Committed: https://git.openstack.org/cgit/openstack/python-openstackclient/commit/?id=58f80e4c7544c0ee064c1629b3f128a628fc71d8
Submitter: Jenkins
Branch: master

commit 58f80e4c7544c0ee064c1629b3f128a628fc71d8
Author: henriquetruta <email address hidden>
Date: Wed May 28 11:09:46 2014 -0300

    Add role assignments list support to identity v3

    The assignments manager and its test class were created.
    Some fake stubs were also added on the fakes.py module.

    The "openstack role assignment list" command was created.

    Change-Id: Iae94f4fee608ea3e09ff38961ad22edc38efb89c
    Implements: blueprint roles-assignment-list
    Closes-Bug: 1246310