Adding a User in a Project is not Possible

[Dave Halter]

https://developer.openstack.org/api-ref/identity/v3/?expanded=assign-role-to-user-on-project-detail#assign-role-to-user-on-project

Assigning a user to project is currently not possible with the openstacksdk (identity v3). I think this should be a priority, because not being able to add users to a project seems to restrict the client in a lot of use cases. The API might should either be restrictive and project only or allow all the different use cases (projects, groups, domains and users).

IMO a Python 3 api that looks like:

def create_role_assignment(self, role, *, project=None, user=None, group=None, domain=None):
    ...

would do the job. Obviously this is a bit more complicated than the usual create_* methods. You need to use different urls (depending on the objects you have) and you also need to throw errors if a combination is not possible (which is true for a lot of the combos). You can also add different methods for all these use cases, but you will end up with a lot of combinations and that is not likely to decrease, rather the opposite.

Note that it's also not possible with the keystoneclient:

https://github.com/openstack/python-keystoneclient/blob/bca112c8ba5636becd6951fbfb8cb8f2474279fe/keystoneclient/v3/role_assignments.py#L107

~ Dave

[Brian Curtin (brian.curtin)]

Yeah we just went through a change to be able to list existing role assignments and it was quite involved. I'll try to take a look at this soon.

[Dave Halter (davidhalter)]

I have just also realized that some of the code already exists. In identity/v3/projects.py you can find methods like `Project.assign_role_to_user` which probably does the job but is not available in _proxy.py. I would maybe use/refactor these functions to implement what I wrote about above.

I think using those methods the problem gets rather trivial.

BTW: The same functions exist on `identity.v3.domains.Domain`.

[feyman (feyman)]

Hi, @Dave, I have met the same issue as you, and the Project.assign_role_to_user method need also a `session` parameter ,did you solve this by using this function or refactoring ?

[Dave Halter (davidhalter)]

@feyman I actually ended up using the keystone client instead for this example. In general my approach at the moment is mixing the client (which is only the case because I'm missing certain functionality from the openstacksdk).

[feyman (feyman)]

@Dave , do you mean that you use the RESTful API for the missing functions? As far as I can see, it actually the only way if using python. Now maybe I should consider to use the java client openstack4j~

[Dave Halter (davidhalter)]

No, I'm using the keystone client. It's deprecated, but still functional https://pypi.python.org/pypi/python-keystoneclient/3.6.0

[feyman (feyman)]

Thanks,@Dave ,I'm gonna give it a shot, :)