<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hi Sudheesh,<div><br></div><div>Using v3/policies is just a way of allowing other keystone projects (nova, glance) etc. a place to centrally store/access their policy files. Keystone does not interpret any of the data you store here - it is simply acting as a central repository (where you can store a big blob of data that is, in effect, your policy file). So the only place you can set policies is in the policy file.</div><div><br></div><div>Henry<br><div><div>On 13 Aug 2013, at 08:22, sudheesh sk wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div><div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-family: 'times new roman', 'new york', times, serif; font-size: 12pt; position: static; z-index: auto; "><div>Hi ,</div><div><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">I am trying to understand Difference between RBAC polices thats stored in policy.json and policies that can be created using openstack/identity/v3/policies.</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div>I got answer from openstack forum that I can use both DB and policy.json based implementation for RBAC policy management.<br><br>Can you please tell me how to use DB based RBAC ? I can elaborate my question<br> 1. In policy.json(keystone) I am able to define rule called - admin_required
<br> 2. Similarly I can define rules line custome_role_required<br> 3. Then I can add this rule against each services (like for eg : identity:list_users = custom_role_required
How can I use this for DB based RBAC policies?
Also there are code like self.policy_api.enforce(context, creds, 'admin_required', {}) in many places (this is in wsgi.py)
<br><br>How can I utilize the same code and at the same time move the policy definition to DB<br><br>Thanks a million,<br>Sudheesh<br><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"></div></div></div>_______________________________________________<br>OpenStack-dev mailing list<br><a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev<br></blockquote></div><br></div></body></html>