# Finally relaxing unneccessary permission requirements

**URL:** <https://forum.ansible.com/t/finally-relaxing-unneccessary-permission-requirements/19862>\
**Category:** Ansible Developer\
**Created:** [November 26, 2015, 11:08am UTC](https://forum.ansible.com/t/finally-relaxing-unneccessary-permission-requirements/19862 "2015-11-26T11:08:10Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Markus\_Suonto](https://avatars.discourse-cdn.com/v4/letter/m/7feea3/32.png) [@Markus\_Suonto](https://forum.ansible.com/u/Markus_Suonto)\
**Post date:** [November 26, 2015, 11:08am UTC](https://forum.ansible.com/t/finally-relaxing-unneccessary-permission-requirements/19862/1 "2015-11-26T11:08:10Z")

</div>

I took a look at this PR:

[https://github.com/ansible/ansible/commit/c0c56c723a98de43d060a3034aa7bde10ac6b59f](https://github.com/ansible/ansible/commit/c0c56c723a98de43d060a3034aa7bde10ac6b59f)

And I completely agree that the \_set\_tenant\_id function in core module quantum\_network should be rewritten into this form:

def \_set\_tenant\_id(module):  
global \_os\_tenant\_id  
if not module.params[‘tenant\_name’]:  
\_os\_tenant\_id = \_os\_keystone.tenant\_id  
else:  
tenant\_name = module.params[‘tenant\_name’]  
for tenant in \_os\_keystone.tenants.list():  
if tenant.name == tenant\_name:  
\_os\_tenant\_id = tenant.id  
break  
if not \_os\_tenant\_id:  
module.fail\_json(msg = “The tenant id cannot be found, please check the parameters”)

The advantage of this is that it removes the need to have tenant-listing permissions if the target tenant is not different from the one whose id is already known by keystone. In other words, you should only need to have tenant-listing permissions when you explicitly define parameter ‘tenant\_name’. This is the case when using os\_network module on ansible 2.0.