Comment 1 for bug 1762411

Revision history for this message
Rabi Mishra (rabi) wrote :

--all-projects allows you to see the stacks of all projects as an admin user. However, that would not allow you do update/delete of those stacks.

user with admin role in a specific project (ex. user with admin role in admin project) can update/delete the stacks of other projects with the stack id, provided,

The following is set in keystone.conf

admin_project_name = admin
admin_project_domain_name = Default

This makes users with admin role in the above project (admin), global administrators. Tokens scoped to this project will contain a true 'is_admin_project` attribute to indicate to policy systems that the role assignments on that specific project should apply equally across every project.