Cannot reparent projects

[Adrian Turjak]

For a variety of reasons Keystone needs the ability to 'safely' reparent a project (and children).

This should be able to be done via and API, and should be able to be done on an enabled project.

It should invalidate any tokens related to that project (and children) as well.

[Adam Young (ayoung)]

This is a non trivial request with severe security ramifications. Please expand on the rationale before continueing.

[Launchpad Janitor (janitor)]

[Expired for OpenStack Identity (keystone) because there has been no activity for 60 days.]

[Colleen Murphy (krinkle)]

This is still a valid request, we just need to discuss whether there is a way forward on it.

[Yang Youseok (ileixe)]

Is there any progress on this issue? I found this from the past discussion (https://etherpad.openstack.org/p/PVG-Change-ownership-of-resources)

I think it's one of the most valuable (and missing) feature in openstack, and personally willing to take actions if there is some guidance.

[Adrian Turjak (adriant-y)]

ayoung proposed a spec for this which I rewrote:
https://review.opendev.org/#/c/618144/

^ that covers the implementation I was suggesting. I've sadly been out of the loop but if pinged on IRC or via email will respond and am happy to work on this feature or at the very least want to review/test it.