Support for multiple tenants in token scope in JSON

Hey Ziad - a couple questions about this. How would a user create a multi-scoped token? The apis I'm aware of allow for either unscoped or singular scoping of tokens. Also, can you explain your use case that motivates this?

Changing the response from tenant to tenants would break all existing clients.

I'd really rather see functionality like this go into the "F" release instead of breaking existing clients again during Essex.

OK. I'll create a separate big or bp to track that for F.

Anthony (sleepsonthefloor) - this is not a use case that the Keystone implementation currently supports. Keep in mind that Keystone is only one possible implementation of the spec.

The spec does not constrain the number of tenants that a token is scoped to on initial auth.

One implementation is Rackspace auth where a token is by default scoped to two tenants.

In the spec:

{
"auth":{
        "passwordCredentials":{
            "username":"test_user",
            "password":"mypass"
},
        "tenantName":"customer-x"
    }
}

and:

{
"auth": {
    "passwordCredentials": {
      "username": "test_user",
      "password": "mypass"
},
    "tenantId": "1234"
  }
}

That looks like it is scoping to a single tenant. It sounds like rackspace has an extension that allows scoping to multiple?

@anotherjesse: not really. There is no extension. The token you get back when you make an auth call without scoping to a tenant has access to two tenants by default (similar to how default tenant works in Keystone).
We did not add support for scope to more than one tenant when authenticating in the spec, which is fine for this version. That is not changing.

Fix proposed to branch: master
Review: https://review.openstack.org/2875

Reviewed: https://review.openstack.org/2875
Committed: http://github.com/openstack/keystone/commit/3f70358bc3c893c6e85e9a0ee87d835fb54619ef
Submitter: Jenkins
Branch: master

commit 3f70358bc3c893c6e85e9a0ee87d835fb54619ef
Author: Ziad Sawalha <email address hidden>
Date: Fri Jan 6 11:18:06 2012 -0600

    Add 'tenants' to Auth & Validate Response

    - Addresses bug 906442
    - Preserves compatibility (keeps 'tenant')
    - No changes in XML (this is a json-only gap)

    Change-Id: Ia6f373d0c7e40b05892c6cdffeed8d1e4b6f65ca