Adding a user to a project is not enough to allow them to create instances. Users must also be in a "sysadmin" role as well.

Project roles are created underneath projects. So, if a project exists named "tesla", the project/role should look like this:

cn=tesla,<projectbasedn>

cn=sysadmin,cn=tesla,<projectbasedn>

Also, as of right now, Nova requires that users be in the global sysadmin group, and the project group to create instances; see bug:

https://bugs.launchpad.net/nova/+bug/697936

So, for now at least, we'll also need to add users to this group when they are created.

Also, if we are adding users to these roles, when we remove users from projects, they should also be removed from the roles as well.

When the listed Nova bug is fixed, we'll need to stop using the global group (this should preferably be a configuration option), and we'll need to remove all users from the group.

Version: unspecified
Severity: enhancement