OpenStack Identity (keystone)

  1. Bug #1590578
  2. Comment #2

Comment 2 for bug 1590578

Revision history for this message
Guang Yee (guang-yee) wrote :

Steve, I think you may have it in reversed. DSR should be able to imply global roles, but not the other way around.

1. DSR should only be visible within its domain.
2. Its useless to have a global rule imply a DSR as DSR does not appear in the token.