[Horizon][policy][keystone][yoga] allow __member__ role to create user
Hi all, I have deploy openstack in yoga version using kolla-ansible. I noticed that only admin role can create a new user. Would it be possible to also allow user with __member__ role to create user in the respective project. Best, James
I would suggest domain admin [1] to create another users rather then granting any regular user to create another ones. As you would need not only create the user, but also be able to assign appropriate role to it, which should not be granted for members for sure. I'm not actually sure about your usecase, but what regular _member_ can do, is to create application credentials [2], that can be used for authentication in keystone by clients (including usage of openrc/clouds.yaml files), but that will basically shadow user that has created these credentials. Though they can't be used to auth in Horizon if I'm not mistaken. [1] https://docs.openstack.org/keystone/latest/admin/service-api-protection.html... [2] https://docs.openstack.org/keystone/latest/user/application_credentials.html вс, 2 апр. 2023 г., 01:33 James Leong <jamesleong123098@gmail.com>:
Hi all, I have deploy openstack in yoga version using kolla-ansible. I noticed that only admin role can create a new user. Would it be possible to also allow user with __member__ role to create user in the respective project.
Best, James
Hi, Thanks for the reply on creating domains for users. Our use-case is as follows: We want to have a *project_admin* role for a project. The user with *project_admin* role can only create/delete new users for the project with *member *role. Thanks James On Sat, Apr 1, 2023 at 6:28 PM James Leong <jamesleong123098@gmail.com> wrote:
Hi all, I have deploy openstack in yoga version using kolla-ansible. I noticed that only admin role can create a new user. Would it be possible to also allow user with __member__ role to create user in the respective project.
Best, James
How do I enable domain tab on horizon dashboard. After enabling the option "openstack_keystone_multidomain_support," I am still not being able to see the domain tab on my dashboard. I am using kolla-ansible deployment tools to deploy the openstack. Best, James On Sun, 2 Apr 2023, 4:18 pm James Leong, <jamesleong123098@gmail.com> wrote:
Hi,
Thanks for the reply on creating domains for users. Our use-case is as follows: We want to have a *project_admin* role for a project. The user with *project_admin* role can only create/delete new users for the project with *member *role.
Thanks James
On Sat, Apr 1, 2023 at 6:28 PM James Leong <jamesleong123098@gmail.com> wrote:
Hi all, I have deploy openstack in yoga version using kolla-ansible. I noticed that only admin role can create a new user. Would it be possible to also allow user with __member__ role to create user in the respective project.
Best, James
participants (2)
-
Dmitriy Rabotyagov
-
James Leong