keystone trust auth issues

python_repl.out

>>> from keystoneclient.v3 import client
>>> trustor = client.Client(auth_url='http://192.168.122.2:5000/v3', username='demo', password='openstack', project_name='demo', user_domain_name='Default', project_domain_name='Default')
>>> trustee = client.Client(auth_url='http://192.168.122.2:5000/v3', username='admin', password='openstack', project_name='admin', user_domain_name='Default', project_domain_name='Default')
>>> trustor.trusts.create(trustor_user=trustor.user_id, trustee_user=trustee.user_id, project=trustor.project_id, role_names=['Member'], impersonation=True, expires_at=None)
<Trust deleted_at=None, expires_at=None, id=ac0d8f3b9e7443c2bdb0f855c2a3b9b5, impersonation=True, links={u'self': u'http://192.168.122.2:35357/v3/OS-TRUST/trusts/ac0d8f3b9e7443c2bdb0f855c2a3b9b5'}, project_id=416290f342e04a34acccafe79bb399c7, redelegation_count=0, remaining_uses=None, roles=[{u'id': u'433c86b705ef4656b90514ea5401469e', u'links': {u'self': u'http://192.168.122.2:35357/v3/roles/433c86b705ef4656b90514ea5401469e'}, u'name': u'Member'}], roles_links={u'self': u'http://192.168.122.2:35357/v3/OS-TRUST/trusts/ac0d8f3b9e7443c2bdb0f855c2a3b9b5/roles', u'next': None, u'previous': None}, trustee_user_id=cf45da134c76460e89b5837e07cc4b82, trustor_user_id=863b972dbbfd44b7bbde1b988e2b5098>

>>> from keystoneclient.auth.identity import v3
>>> from keystoneclient import session
>>> sess = session.Session()
>>> trustor_auth = v3.Password(auth_url='http://192.168.122.2:5000/v3', username='demo', password='openstack', project_name='demo', user_domain_name='Default', project_domain_name='Default')
>>> trustee_auth = v3.Password(auth_url='http://192.168.122.2:5000/v3', username='admin', password='openstack', project_name='admin', user_domain_name='Default', project_domain_name='Default')                                                                                                                                                                            
>>> trustor = client.Client(session=sess, auth=trustor_auth)
>>> trustee = client.Client(session=sess, auth=trustee_auth)
>>> trustor.trusts.create(trustor_user=trustor.user_id, trustee_user=trustee.user_id, project=trustor.project_id, role_names=['Member'], impersonation=True, expires_at=None)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/v3/contrib/trusts.py", line 76, in create
    **kwargs)
  File "/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/base.py", line 73, in func
    return f(*args, **new_kwargs)
  File "/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/base.py", line 333, in create
    self.key)
  File "/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/base.py", line 151, in _create
    return self._post(url, body, response_key, return_raw, **kwargs)
  File "/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/base.py", line 165, in _post
    resp, body = self.client.post(url, body=body, **kwargs)
  File "/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/adapter.py", line 176, in post
    return self.request(url, 'POST', **kwargs)
  File "/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/adapter.py", line 206, in request
    resp = super(LegacyJsonAdapter, self).request(*args, **kwargs)
  File "/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/adapter.py", line 95, in request
    return self.session.request(url, method, **kwargs)
  File "/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/utils.py", line 336, in inner
    return func(*args, **kwargs)
  File "/home/mike/.venvs/openstack/lib/python2.7/site-packages/keystoneclient/session.py", line 397, in request
    raise exceptions.from_response(resp, method, url)
keystoneclient.openstack.common.apiclient.exceptions.Forbidden: You are not authorized to perform the requested action: identity:create_trust (Disable debug mode to suppress these details.) (HTTP 403) (Request-ID: req-c67aee46-2baf-4bc3-9bd5-b82ff31057a7)
>>>