Comment 5 for bug 1783659

Thank you Lance! That bug (https://bugs.launchpad.net/keystone/+bug/968696) is definitely a "long" bug report. :)

We thankfully have a workaround as I described - when a user is assigned the "admin" role for a domain, the user is scoped to only perform actions within this domain - specifically without defining a default project for this user:

domain create TestDomain
user create --domain TestDomain --password test TestDomainAdmin
role add --domain TestDomain --user TestDomainAdmin admin

The issue we have, at this point, is the lack of domain quotas. Maybe this will be solved with Unified Limits (I think this might be what you were referring to with regards to some changes in Stein?).

I'll review the Stein specs and bugs you linked and will keep track of this process so we can test here.

Thanks again!

Eric