Comment 13 for bug 1329564

Our admin role is called "Admin" roles are case insensitive so this shouldn't matter?
I renamed it to admin to check and doesn't make a difference. (had to hack the DB in keystone)

When I debug this at the below line I always get an auth_project = <tenant id of the service tenant> (on_behalf_of is always None too)

auth_project = _get_auth_project(on_behalf_of)

I can't see the bit in the code where if the request has admin role it doesn't care what the project_id is and just returns all the alarms.
For instance if I do any other command as an ceilometer I don't get any results as the ceilometer user doesn't have any resources.

I also came across the following comment
    # when an alarm is created by an admin on behalf of another tenant
    # we must ensure for:

Does this mean the alarm is actually meant to be owned by service tenant and not the users tenant? Maybe the issue is that the alarms aren't being created correctly?

The alarm as stored in mongo is: (the project and user ID mentioned are my user ID)

> db.alarm.findOne()
{
 "_id" : ObjectId("53c62215499af2dbd3cf2b4d"),
 "alarm_actions" : [ ],
 "alarm_id" : "75a66cbe-6817-422a-80b8-d826fc53c0f9",
 "description" : "Alarm when cpu_util is eq a avg of 60.0 over 60 seconds",
 "enabled" : true,
 "insufficient_data_actions" : [ ],
 "name" : "test",
 "ok_actions" : [ ],
 "project_id" : "0bdf024c921848c4b74d9e69af9edf08",
 "repeat_actions" : false,
 "rule" : {
  "meter_name" : "cpu_util",
  "evaluation_periods" : 1,
  "period" : 60,
  "statistic" : "avg",
  "threshold" : 60,
  "query" : [
   {
    "field" : "project_id",
    "value" : "0bdf024c921848c4b74d9e69af9edf08",
    "op" : "eq"
   }
  ],
  "comparison_operator" : "eq",
  "exclude_outliers" : false
 },
 "state" : "insufficient data",
 "state_timestamp" : ISODate("2014-07-16T06:56:21.332Z"),
 "time_constraints" : [ ],
 "timestamp" : ISODate("2014-07-16T06:56:21.332Z"),
 "type" : "threshold",
 "user_id" : "d9646718471b46aeb5fd94c702336ca9"
}