<html><body><div style="font-family: Arial; font-size: 12pt; color: #000000"><div>Thnak you Adam for this answer.<br></div><div><br></div><div>Another easier (better?) approach would be to have one tenant per user, setting default instances quota for all tenant to 1 (using quota-defaults nova command).<br></div><div>As users and tenants can be managed by LDAP in Havana, binding default tenant to his own tenant for each user could be LDAP driven.<br></div><div><br></div><div><span name="x"></span>Jacques Landru<span name="x"></span><br></div><div><br></div><hr id="zwchr"><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>De: </b>"Adam Young" <ayoung@redhat.com><br><b>À: </b>"Jacques LANDRU" <landru@telecom-lille.fr><br><b>Envoyé: </b>Lundi 13 Janvier 2014 15:59:39<br><b>Objet: </b>Re: [Openstack] per-user quota keystone user database is LDAP based ?<br><div><br></div>
<div class="moz-cite-prefix">On 01/10/2014 12:16 PM, Jacques LANDRU
wrote:<br>
</div>
<blockquote cite="mid:262153449.694629.1389374187269.JavaMail.root@telecom-lille.fr">
<div style="font-family: Arial; font-size: 12pt; color: #000000">
<div>Hi, <br>
<br>
I have some questions about instance quota, and instance
access authorization. <br>
<br>
Openstack version is Havana (nova --version 2.15.0, keystone
--version 0.3.2) <br>
<br>
I plan to use a small openstack project/tenant as an online
virtual computer lab room. <br>
The project/tenant instance quota will be limited to 12 or 24
instances (as in a real lab room, there're 12 or 24
workstations). <br>
Keystone user database will point to our LDAP server where
student posixaccounts are managed. Amount of potential users
is around 800, ( maybe several thousand in the future when
keystone will be saml/shibboleth compatible). <br>
<br>
A user will be restricted to 1 instance at a time, as in a
real lab room a student can use 1 workstation at a time. <br>
<br>
The main idea is : <br>
- each student can access the online lab room.to launch an
instance choosen among a small set of pre-defined images or
flavors, <br>
- when tenant instance quota is reached, lab room is full,
other sutdents will have to wait untill one or more instances
being freed by their owners, <br>
<br>
Two questions : <br>
1) Is there a simple way to set per-user default instance
quota to 1 and tenant instance quota to 12 ? <br>
</div>
</div>
</blockquote>
Quotas are not held in Keystone, so I don't know if you can get
Quoate data from LDAP to Nova without a script.<br>
<br>
<blockquote cite="mid:262153449.694629.1389374187269.JavaMail.root@telecom-lille.fr">
<div style="font-family: Arial; font-size: 12pt; color: #000000">
<div>2) how can I restrict instance access (console, reboot
command,...) only to the owner of that instance ? <br>
</div>
</div>
</blockquote>
You can't, RBAC is at Project/tenant granularity only. So unless
each VM is in separate project, others can reboot.<br>
<br>
<blockquote cite="mid:262153449.694629.1389374187269.JavaMail.root@telecom-lille.fr">
<div style="font-family: Arial; font-size: 12pt; color: #000000">
<div><br>
Some ideas ? <br>
<br>
Regards. <br>
<br>
</div>
<div><br>
</div>
<div><span></span><br>
-----oOo-----<br>
Jacques Landru<br>
mel: landru~hat~telecom-lille.fr<br>
tel: +33 (0)3 2033 5556<br>
fax: +33 (0)3 2033 5598<br>
<div><br>
</div>
Telecom Lille<br>
Cite scientifique, rue G. Marconi, BP20145<br>
59653 VILLENEUVE D'ASCQ Cedex<br>
web: <a class="moz-txt-link-freetext" href="http://www.telecom-lille.fr" target="_blank">http://www.telecom-lille.fr</a><br>
Tel: +33 (0)3 2033 5577 <br>
Fax: +33 (0)3 2033 5599 <br>
-----oOo-----<br>
<div><br>
</div>
<span></span><br>
</div>
<div><br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre>_______________________________________________
Mailing list: <a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a>
Post to : <a class="moz-txt-link-abbreviated" href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a>
Unsubscribe : <a class="moz-txt-link-freetext" href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a>
</pre>
</blockquote>
<br>
</div><div><br></div></div></body></html>