Comment 0 for bug 1783659

Environment
Deployed using Kolla-ansible version 7.0.0.0b2 in VMs on ESXi 5.5 (same problem occurs on Queens release)
3 controllers and various other VMs for other roles (22 in total)

Parameters:
Default policy.json configuration - no override files, such as policy.v3cloudsample.json, however using this policy file on the Keystone nodes makes no difference, after changing the "admin_domain_id" to "default".

Commands run:
(export variables set for admin user)
domain create TestDomain
project create --domain TestDomain TestDomainProject
user create --domain TestDomain --password test TestDomainAdmin
role add --project-domain TestDomain --project TestDomainProject --user TestDomainAdmin admin

(export variables set to TestDomainAdmin user's domain and project - openstack client run again)
(openstack) domain list
+----------------------------------+------------------+---------+-------------------------------------------+
| ID | Name | Enabled | Description |
+----------------------------------+------------------+---------+-------------------------------------------+
| 7a44fa16d42443c1b531af2447d7cd3f | TestDomain | True | |
| c4ce448b93a949b78a8feea567f210b4 | heat_user_domain | True | |
| default | Default | True | The default domain |
| e082d7aefb314041b89bb3311836d721 | magnum | True | Owns users and projects created by magnum |
+----------------------------------+------------------+---------+-------------------------------------------+
(openstack) project list
+----------------------------------+-------------------+
| ID | Name |
+----------------------------------+-------------------+
| 371b28700a06462b8fd52fa95e733a0a | admin |
| 3a526ae9a3874ab4a645cc24ad7beff2 | TestDomainProject |
| 5abb3ac26dae4d25830b43afd62b74ff | service |
+----------------------------------+-------------------+

Issue:
Horizon interface properly shows only the TestDomainProject project and no Domains tab, which is correct. The API that the openstack client uses is returning root-level information as shown above, such as other domain's projects as well as every domain.

Am I missing something, or is this a bug?

Thanks!

Eric