No output for "openstack port list --project project_name" in case of non-admin user

[Kiran Pawar]

Bug
====
openstack port list --project project_id command works for both admin and non-admin users.
openstack port list --project project_name command works for only admin users.

Expected behavior
==================
openstack port list --project project_name command should work for both admin and non-admin users.

Steps to reproduce
===================
1. source openrc admin admin
2. openstack port list --project <project_id_or_name> [this works]
3, source openrc demo demo
4. openstack port list --project <project_id> [this works]
5. openstack port list --project <project_name> [No output]

On running with --debug flag, seems like non-admin(i.e. demo) users don't have authorization to list projects and so name resolution from project_name to project_id fails. The query forwarded to neutron with project_name instead of project_id. The neutron then filters DB using {project_id: project_name} and query returns empty result.

[Kiran Pawar (kpawar)]

Ideally, openstack port list command should display ports only belonging to current project as default option. Also this command should not allow to specify --project option for non-admin users as this is security-concern to see ports from other project (even if port is in shared network).

Only admin can see all ports as default option and can use --project to filter output for specific project.

[Darrick Horton (vmaccel)]

Ideally, this should allow the user to specify --project project_name for any projects the user has access to. Currently, it allows you to specify --project project_id for any project the user has access to. So, the only change that needs to be made is allowing non-admin users specify project_name instead of project_id for projects they have access to

[Bernard Cafarelli (bcafarel)]

Note that an user can be part of several projects, so "current project" for CLI is not really an option - and it can be useful for non-admin user to only list ports from a specific project

As for "--project project_name", this fails with the reproducer steps with:
"GET /identity/v3/projects/demo HTTP/1.1"
{"code":403,"message":"You are not authorized to perform the requested action: identity:get_project.","title":"Forbidden"}
"GET /identity/v3/projects?name=demo HTTP/1.1"
{"code":403,"message":"You are not authorized to perform the requested action: identity:list_projects.","title":"Forbidden"}

[Bernard Cafarelli (bcafarel)]

After checking on IRC [0], this is working as designed on the keystone side, regular users aren't allowed to list projects
As this is the way used to find the project ID, this is why non-admin users get an empty list

[0] https://meetings.opendev.org/irclogs/%23openstack-neutron/%23openstack-neutron.2022-11-15.log.html#t2022-11-15T14:53:04

[Kiran Pawar (kpawar)]

if openstack port list --project project_id works for normal-user, openstack port list --project project_name should also work. There should be workaround to get project_name resolved to project_id. Otherwise command option (and its description) need to change from --project to --project-id, as customer confuse why name does not work. WDYT @bcafarel ?

[Brian Haley (brian-haley)]

I would disagree with comment #5, --project is standard across the CLI and changing it would cause confusion. Not being admin means you cannot lookup other projects or their info by name.

[Kiran Pawar (kpawar)]

Not being admin user should be able to see at least his project. User can do openstack project list and see his project, but if project_name(of his own project) is used in query, it fails.