system scope doesn't work for the service which use project specified endpoint

[wangxiyuan]

For some project, such as Cinder, the endpoint is project specified, the format is like:
http://ip/volume/v3/{project_id}/os-services

There are two problem:
1. For this kind of endpoint, system-scoped token doesn't work because that there is no project_id in the token.

2. When issue a system-scoped token, the Cinder's endpoint in the token catalog is empty. It means the Cinder service will not be discoverable when use system-scoped token.

[Lance Bragstad (lbragstad)]

This is certainly going to be a discussion we'll need to have with other projects that rely on endpoint formats like this. Ideally, it would be good to generalize the policy enforcement code for that service to work with the new system scope format. After that, it might be possible for operators to remove the project IDs from their endpoint definitions. Eventually, projects should be able to remove code that parses the URL for a project ID.

This will be a long running initiative, but it should make policy enforcement easier across services.

[Lance Bragstad (lbragstad)]

Since keystone does everything for services to consume this today, we might be able to fix this with documentation that describes how services convert project IDs from URL to consuming scope from tokens.

[Nautik (nautik)]

For the record, a good explanation on where this topic is at this time in cinder: http://lists.openstack.org/pipermail/openstack-discuss/2020-November/019122.html

Thank you Brian!

[Alvaro Lopez (aloga)]

This still an issue, specially when using system scoped tokens. Is there any progress?

[Brian Rosmaita (brian-rosmaita)]

There was a change in direction with the "Consistent and Secure RBAC" community goal and system scope will not be implemented across OpenStack services. See

https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#direction-change

for details.