volume create failed when using trust-scoped token by barbicanclient

[jun923.gu]

When we create volume that encrypt it with barbican using trust-scoped token, it failed. The log raise "Flow 'volume_create_api': Forbidden: You are not authorized to perform the requested action: Using trust-scoped token to create another token. Create a new trust-scoped token instead. (HTTP 403)". The keystone declare that "do not allow tokens used for delegation to create another token, or perform any changes of state in Keystone. To do so is to invite elevation of privilege attacks". So I think we should avoid the operation that using a trust-scoped token to create another token.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/690812

[Vishakha Agarwal (vishakha.agarwal)]

Could you help me with the keystone version you are facing this issue? What roles your user had on the openstack environment?

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Gage Hugo <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/keystoneauth/+/690812
Reason: Abandoning since there hasn't been any recent activity, if anyone wants to continue this work, please feel free to restore this or create a new change.