<div>That will provided by Identity API v3, currently in draft: <a href="https://github.com/openstack/identity-api/blob/master/openstack-identity-api/src/markdown/identity-api-v3.md">https://github.com/openstack/identity-api/blob/master/openstack-identity-api/src/markdown/identity-api-v3.md</a></div>
<div><br></div>The "when" is first dependent on:<div><br></div><div>1) <span style="color:rgb(34,34,34);font-family:Tahoma;font-size:13px;background-color:rgb(255,255,255)">Identity API v3 support in keystone</span><span style="color:rgb(34,34,34);font-family:Tahoma;font-size:13px;background-color:rgb(255,255,255)"> </span><a href="https://review.openstack.org/#/c/12106/">https://review.openstack.org/#/c/12106/</a></div>
<div><span style="color:rgb(34,34,34);font-family:Tahoma;font-size:13px;background-color:rgb(255,255,255)">2) Identity API v3 support in keystoneclient </span><a href="https://review.openstack.org/#/c/12806/">https://review.openstack.org/#/c/12806/</a></div>
<div><span style="background-color:rgb(255,255,255);color:rgb(34,34,34);font-family:Tahoma;font-size:13px">3) services need to consume the centralized policy info, probably through common middleware</span></div><div><span style="background-color:rgb(255,255,255);color:rgb(34,34,34);font-family:Tahoma;font-size:13px">4) adding UI support in horizon</span></div>
<div></div><div><br></div><div>An open question: are you looking to modify policy per service or do you need policy granularity per endpoint?</div><div><br></div>-Dolph<br>
<br><br><div class="gmail_quote">On Wed, Oct 3, 2012 at 7:29 PM, Shake Chen <span dir="ltr"><<a href="mailto:shake.chen@gmail.com" target="_blank">shake.chen@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi<br><br>I also have question about RBAC.<br><br>when we can setting the roles permission in Horizon?<br><br><br><div class="gmail_quote"><div><div class="h5">On Thu, Oct 4, 2012 at 2:56 AM, Dolph Mathews <span dir="ltr"><<a href="mailto:dolph.mathews@rackspace.com" target="_blank">dolph.mathews@rackspace.com</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
<div>
<div style="direction:ltr;font-size:10pt;font-family:Tahoma">(replying on list)
<div><br>
</div>
<div>RBAC policy enforce is already implemented on consuming services and default policies are provided by policy.json files (e.g. <a href="https://github.com/openstack/nova/blob/master/etc/nova/policy.json" target="_blank">https://github.com/openstack/nova/blob/master/etc/nova/policy.json</a> ).</div>
<div><br>
</div>
<div>We haven't yet implemented a method for services to consume policy blobs from Identity API v3, /v3/policies (which itself is still in development), rather than loading policy.json files.</div>
<div><br>
</div>
<div>For an example of scoping RBAC per project, see the admin_or_owner rule in nova's policy.json above.</div>
<div><br>
</div>
<div>As for the efficiency of policy storage, I'm not clear on what your concerns are?</div>
<div>
<div><br>
<div><font><span style="font-size:10pt">
<div>-Dolph</div>
</span></font></div>
</div>
<div style="font-size:16px;font-family:Times New Roman">
<hr>
<div style="direction:ltr"><font color="#000000" face="Tahoma"><b>From:</b> MS. Faraji [<a href="mailto:ms.faraji@utoronto.ca" target="_blank">ms.faraji@utoronto.ca</a>]<br>
<b>Sent:</b> Wednesday, October 03, 2012 1:34 PM<br>
<b>To:</b> Dolph Mathews<br>
<b>Subject:</b> Question about Keystone RBAC<br>
</font><br>
</div>
<div></div>
<div>
<div dir="ltr">Hi,<br>
<br>
I sent an email to inquire about RBAC implementation in Keystone before, and you generously shared your information. However, there are a couple of questions that I have in mind.<br>
I searched the Internet and documents; however, I did not find useful information about them. I hope you can help me to find it out.<br>
<br>
1) Consider the enforce API is implemented, which side should use it? Service or Keystone itself. If Keystone uses this function, how does it know about the action that a user<br>
wants to perform on a resource. If service call it as an API, what is the endpoint? How services use authorization in Keystone?<br>
<br>
2) Can roles and associated actions be defined in the scope of project or domain? For example demo can do release in project 1 but not in project 2.<br>
<br>
3) Is the plain storage of capabilities ( no data structure) efficient? In terms of required storage space and later lookups.<br>
<br>
Thanks in advance for your help and assistance,<br>
I look forward to your response.<br>
<br>
<br>
Moh,<br>
<br>
</div>
</div>
</div>
<div>
</div>
<div>
</div>
</div>
</div>
</div>
<br></div></div>_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
<br></blockquote></div><span class="HOEnZb"><font color="#888888"><br><br clear="all"><br>-- <br>Shake Chen<br><br><br>
</font></span><br>_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
<br></blockquote></div><br>