Add support for group creation

[mnasiadka]

No description provided.

[markgoddard]

I feel like we might have this code at a client somewhere.

Anyway. Groups are not really a property of projects, don't they need to be a top level list?

[mnasiadka]

Well, is a user property of a project? It might be created at project level, but you can assign roles in different projects to that user. According to keystone docs - both user and group are owned by a domain - https://docs.openstack.org/keystone/latest/getting-started/architecture.html.
More or less, you can assign roles to a user or group, so I don't think it should be a top level list.
I can move the code to groups.yml if you that feels better, I still need to add tasks to add project roles and domain roles to a group.

[markgoddard]

Well, is a user property of a project? It might be created at project level, but you can assign roles in different projects to that user. According to keystone docs - both user and group are owned by a domain - https://docs.openstack.org/keystone/latest/getting-started/architecture.html.
More or less, you can assign roles to a user or group, so I don't think it should be a top level list.
I can move the code to groups.yml if you that feels better, I still need to add tasks to add project roles and domain roles to a group.

You are right, and in hindsight I should have made users a top level resource too. They do generally have a default project though.

[oneswig]

@markgoddard @mnasiadka Can we either progress this or move it somewhere else? Groups are useful for mapping users to projects in federated authentication like OIDC. They might be separate entities but groups projects and users link together.

[markgoddard]

@markgoddard @mnasiadka Can we either progress this or move it somewhere else? Groups are useful for mapping users to projects in federated authentication like OIDC. They might be separate entities but groups projects and users link together.

IMO groups need to be a separate top level list, outside of projects. I made the mistake of nesting users in projects, but we don't need to repeat it for groups.