<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 07/02/2015 03:10 AM, masoom alam
wrote:<br>
</div>
<blockquote
cite="mid:CABk5PjJfNmByxed6e=crAmQ44Y+OhMX5gu59Ts14fpcAwieEwg@mail.gmail.com"
type="cite">
<div dir="ltr">Hi every one,
<div><br>
</div>
<div>The glance policy.json allows specific users/roles to
download an image. If we apply a policy on a specific role,
only that role can download and/or boot an image. </div>
<div><br>
</div>
<div>What if we want to restrict downloading an image, but at
the same time allowing the user to boot it via nova boot. The
catch is that we will have to restrict the user from taking
the snapshot right? Can glance can differentiate between user
downloading an image and nova doing the same on the behalf of
a user. <br>
</div>
</div>
</blockquote>
No, as it is done with a token. The token is passed to nova, and
nova passes it to glance to perform the action.<br>
<br>
<br>
If snapshot is a different API call than download, then you apply a
different role for each, and make sure that tokens passed ot Nova do
not have the "snapshot" role in it.<br>
<br>
It is issues like this that are making me try to drive the Dynamic
Policy effort in Keystone.<br>
<br>
My initial write up is here:<br>
<br>
<br>
<a class="moz-txt-link-freetext" href="https://adam.younglogic.com/2014/11/dynamic-policy-in-keystone/">https://adam.younglogic.com/2014/11/dynamic-policy-in-keystone/</a><br>
<br>
And the wiki is here:<br>
<br>
<a class="moz-txt-link-freetext" href="https://wiki.openstack.org/wiki/DynamicPolicies">https://wiki.openstack.org/wiki/DynamicPolicies</a><br>
<br>
<br>
I'd love to have your input on the process.<br>
<br>
<br>
<blockquote
cite="mid:CABk5PjJfNmByxed6e=crAmQ44Y+OhMX5gu59Ts14fpcAwieEwg@mail.gmail.com"
type="cite">
<div dir="ltr">
<div><br>
</div>
<div>OR how to solve the puzzle, please guide. </div>
<div><br>
</div>
<div>Thanks</div>
<div><br>
</div>
<div><br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">__________________________________________________________________________
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: <a class="moz-txt-link-abbreviated" href="mailto:OpenStack-dev-request@lists.openstack.org?subject:unsubscribe">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a>
<a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a>
</pre>
</blockquote>
<br>
</body>
</html>