list_user_projects() can't get filtered by 'domain_id'.

[DWang]

Here is our use case, we want our tenant domain admin(e.g., Bob) to have this capability: Bob(domain-scoped) can list the projects that one user has roles on, and the projects Bob get should only belong to Bob's scoping domain.

When we read the rule in policy.v3cloudsample.json for "identity:list_user_projects", we are happy it's the same as what we want:
{...
"admin_and_matching_domain_id": "rule:admin_required and domain_id:%(domain_id)s",
"identity:list_user_projects": "rule:owner or rule:admin_and_matching_domain_id",
...}

I thought we could use this API with query string 'domain_id', thus Bob can and only can query projects in his scoping domain, but it doesn't work, since the @controller.filterprotected('enabled', 'name') for list_user_projects() exclude the possibility of taking 'domain_id' as a query string even it's useful to us and recorded in the policy file.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/182569

[Dolph Mathews (dolph)]

The list of query parameters should also be revised here:

  https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3.rst#list-user-projects

[DWang (darren-wang)]

Thanks Dolph, I'll work on it.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/182915

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/182915
Committed: https://git.openstack.org/cgit/openstack/keystone-specs/commit/?id=5667c86d57d1408dcba018583677b3de30e94b01
Submitter: Jenkins
Branch: master

commit 5667c86d57d1408dcba018583677b3de30e94b01
Author: darren-wang <email address hidden>
Date: Thu May 14 09:51:34 2015 +0800

    Adding 'domain_id' filter to list_user_projects().

    Change-Id: I12aef27f7de6e695aa7bb882f68935649e1e360b
    Closes-Bug: #1454531

[Dave Chen (wei-d-chen)]

actually, this bug is not fixed yet, the patch that is merged is just a change in API spec, the patch to implement this is here.
https://review.openstack.org/#/c/182569/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/182569
Committed: https://git.openstack.org/cgit/openstack/keystone/commit/?id=3425c1fffe9cb40c759ccec516483e06225d65cd
Submitter: Jenkins
Branch: master

commit 3425c1fffe9cb40c759ccec516483e06225d65cd
Author: darren-wang <email address hidden>
Date: Wed May 13 16:28:52 2015 +0800

    Adding 'domain_id' filter to list_user_projects()

    Closes-Bug: #1454531
    Change-Id: I01af5376505f49c3c7c1906b7bc9511adb114632

[Doug Hellmann (doug-hellmann)]

This issue was fixed in the openstack/keystone 9.0.0.0rc1 release candidate.