openstack v3 identity filter fails to get scoped token
Opened this issue · 0 comments
When using V3 auth the token that is returned when a project ID Is not specified is an unscoped token. This token can not be used by repose to validate user tokens as an unscoped token has no associated roles with it. You can have repose get a scoped token by specifying a Project-ID. However, the current implementation requires a numeric project ID which can not be properly applied with automation.
A project name could be used for the project ID, but in order for this to work the domain needs to be included as part of the request.
The body that repose currently sends looks like this: https://gist.github.com/ephur/9ed524cc501317307d18
A working body for v3 when not specifying a project ID, but rather a project name looks like this:
https://gist.github.com/ephur/8bbcd53f6140905d10d4