Scoping to project which is not on authentication domain is not working as expected

[Evgeny Fedoruk]

Having user "U" on domain "X" which has admin role on domain "X" and domain "Y"
domain "X" and domain "Y" have projects "X1" and "Y1" respectively.

Authenticating with user "U" on domain "X" and scoping to domain "X"
OK.

Authenticating with user "U" on domain "X" and scoping to domain "Y"
OK.

Authenticating with user "U" on domain "X" and scoping to project "X1" belonging to domain "X"
OK.

Authenticating with user "U" on domain "X" and scoping to project "Y1" belonging to domain "Y"
FAILS.

I expect the last authentication to succeed, since user has admin role on the domain of the project.

This kind of authentication will succeed if admin role on project "Y" will be granted to the user.

[wangxiyuan (wangxiyuan)]

I think it's a little confuse for the case:
Having user "U" on domain "X" which has admin role on domain "X" and domain "Y"
domain "X" and domain "Y" have projects "X1" and "Y1" respectively.

like this or not:
DomainX contains ProjectX and UserU
DomainY contains PojrectY
UserU has the admin role both in DomainX and DomainY(domain scoped), but doesn't has the role in ProjectX or ProjectY

I think my understanding is wrong. Can you see more here. Thanks.

[Lance Bragstad (lbragstad)]

Currently, authorization in keystone is explicit in that you must grant users roles on projects or domains in order for them to get tokens scoped to those targets. Another option that might be available to you is to use role inheritance [0]. This API let's you grant roles to users and groups but let's them be inherited to children projects in the hierarchy.

[0] https://developer.openstack.org/api-ref/identity/v3/index.html#os-inherit-api