Please note: This schedule is for OpenStack Active Technical Contributors participating in the Icehouse Design Summit sessions in Hong Kong. These are working sessions to determine the roadmap of the Icehouse release and make decisions across the project. To see the full OpenStack Summit schedule, including presentations, panels and workshops, go to http://openstacksummitnovember2013.sched.org.
The current Identity API and implementation of role assignments is a mess. I'd like to discuss:
1) A more logical API by extending the GET /role-assignment API into a full set of crud operations with "role-assignment" becoming a first class entity. We would deprecate (but still support for a while the existing GET /user/role/project...style)
2) Implementation of a single assignments table/structure in the backend
3) Removal of cross-identity-manager calls from the assignments manager/driver - i.e. assignment is just a mapper...and shouldn't know how to validate the objects it is mapping between (this will be required for federation). However, is there a security risk for that?
