openstack client help shows domain can be changed for a project

[apal]

(openstack) project set admin-apal -h
usage: project set [-h] [--name <name>] [--domain <domain>]
[--description <description>] [--enable | --disable]
[--property <key=value>]
<project>
Set project properties
positional arguments:
<project> Project to modify (name or ID)
optional arguments:
-h, --help show this help message and exit
--name <name> Set project name
--domain <domain> Set domain owning <project> (name or ID)
--description <description>
Set project description
--enable Enable project
--disable Disable project
--property <key=value>
Set a property on <project> (repeat option to set
multiple properties)
(openstack) project set admin-apal --domain admin-apal
ERROR: openstack Cannot change Domain ID (HTTP 400)

[Morgan Fainberg (mdrnstm)]

It is not supported to move a project between domains by design (as you can see by the error). This is for a number of reasons, notably around security.

I am not sure the best document for this to go into. The error is not a very deep explanation of what happened when filtered through the openstack client interface (but it still makes sense, the Domain ID cannot be changed).

[Morgan Fainberg (mdrnstm)]

Aha, Just re-read this. This is a bug in openstack client. updating to show details.

[Morgan Fainberg (mdrnstm)]

Added openstackclient to the bug. This is working as intended in Keystone. I am marking this as invalid in keystone.

[Steve Martinelli (stevemar)]

refer to patch: https://review.openstack.org/#/c/153922/

[Steve Martinelli (stevemar)]

also refer to: https://review.openstack.org/#/c/153923/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/153922
Committed: https://git.openstack.org/cgit/openstack/python-openstackclient/commit/?id=dca99782052da052aebea653bfbfc3dfc9a96a0e
Submitter: Jenkins
Branch: master

commit dca99782052da052aebea653bfbfc3dfc9a96a0e
Author: Steve Martinelli <email address hidden>
Date: Sun Feb 8 23:45:32 2015 -0500

    Do not allow user to change domain of a project

    Keystone Server already surfaces an error for this operation, but
    we should restrict the user, and not offer --domain to be changed
    for a project.

    Change-Id: I48317e8accfea3c285e6ad213e75b783de8070ac
    Closes-Bug: #1418384

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/153923
Committed: https://git.openstack.org/cgit/openstack/python-openstackclient/commit/?id=07c4fa9d4bde6f3d0a38bc4d7eb3df275e0b89cc
Submitter: Jenkins
Branch: master

commit 07c4fa9d4bde6f3d0a38bc4d7eb3df275e0b89cc
Author: Steve Martinelli <email address hidden>
Date: Sun Feb 8 23:52:56 2015 -0500

    Restrict groups and users from changing domains

    Similar to projects, we shouldn't allow users and groups to
    change domains. The server side tosses up an error but osc
    should restrict that behaviour in the first place.

    Related-Bug: #1418384

    Change-Id: I860291a5859c576021b18e35d1a12c32abfb6ca5