<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 12/01/2015 01:23 AM, 1021710773
wrote:<br>
</div>
<blockquote cite="mid:tencent_14DBB7354F61A6AC1833F4A1@qq.com"
type="cite">
<div>
<div style="font-family: 'Microsoft YaHei UI'; font-size:
medium; line-height: normal;">Every Developers,</div>
<div style="font-family: 'Microsoft YaHei UI'; font-size:
medium; line-height: normal;"><br>
</div>
<div style="font-family: 'Microsoft YaHei UI'; font-size:
medium; line-height: normal;"> Hello. I here would like to
ask some questions about policy rules.</div>
<div style="font-family: 'Microsoft YaHei UI'; font-size:
medium; line-height: normal;"> Now the policy rules of
openstack in keystone and other projects are set in
policy.json, in other words, the policy rules are equal</div>
<div style="font-family: 'Microsoft YaHei UI'; font-size:
medium; line-height: normal;">to each projects. And the common
ways to enforce are in decorative function<font face="Tahoma,
Arial" color="#434343"> like protected(). And in keystone
project, it manage the users, </font><span
style="line-height: 1.5; color: rgb(67, 67, 67);
font-family: Tahoma, Arial;">projects, roles and other
resources. Now, some particular projects(tenants) may have
its own enforce rules, not just like the policy.json, and in
that ways, could we update the </span><span
style="line-height: 1.5; color: rgb(67, 67, 67);
font-family: Tahoma, Arial;">usual decorative function of
enforce to realize the authentification of projects? And
now, the policy model appears in keystone project. Could we
use it to create </span><span style="line-height: 1.5;
color: rgb(67, 67, 67); font-family: Tahoma, Arial;">association
between projects and policy? <br>
</span></div>
</div>
</blockquote>
<br>
<br>
That request has come up in the past. At this point, I don't think
we have a path to "Tenant specific policy" but we have a couple
features in Mitaka that might be close: Implied Roles and Domain
specific roles.<br>
<br>
See the specs:<br>
<br>
Implied roles has merged:<br>
<br>
<a class="moz-txt-link-freetext" href="http://git.openstack.org/cgit/openstack/keystone-specs/tree/specs/mitaka/implied-roles.rst">http://git.openstack.org/cgit/openstack/keystone-specs/tree/specs/mitaka/implied-roles.rst</a><br>
<br>
Domain specific roles was just given the thumbs up and will likely
merge soon.<br>
<br>
<br>
<br>
<blockquote cite="mid:tencent_14DBB7354F61A6AC1833F4A1@qq.com"
type="cite">
<div>
<div style="font-family: 'Microsoft YaHei UI'; font-size:
medium; line-height: normal;"><font face="Tahoma, Arial"
color="#434343"> Hope to hear from you. Thanks!</font></div>
<div style="font-family: 'Microsoft YaHei UI'; font-size:
medium; line-height: normal;"><br>
</div>
<div style="font-family: 'Microsoft YaHei UI'; font-size:
medium; line-height: normal;"><br>
</div>
<div style="font-family: 'Microsoft YaHei UI'; font-size:
medium; line-height: normal;">Weiwei Yang</div>
<hr style="box-sizing: border-box; font-family: 'Microsoft YaHei
UI'; font-size: medium; line-height: normal; width: 210px;
height: 1px;" size="1" color="#b5c4df" align="left">
<div style="font-family: 'Microsoft YaHei UI'; font-size:
medium; line-height: normal;">
<div style="position: static !important; margin: 10px;
font-family: verdana; font-size: 10pt;">
<div style="position: static !important;"><a class="moz-txt-link-abbreviated" href="mailto:yangweiwei@cmss.chinamobile.com">yangweiwei@cmss.chinamobile.com</a></div>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">__________________________________________________________________________
OpenStack Development Mailing List (not for usage questions)
Unsubscribe: <a class="moz-txt-link-abbreviated" href="mailto:OpenStack-dev-request@lists.openstack.org?subject:unsubscribe">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a>
<a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a>
</pre>
</blockquote>
<br>
</body>
</html>