How to setup domains in Train

asked 2019-11-05 11:41:51 -0600

harpinder gravatar image

Hi,

I am trying to set up domains in keystone so that I can create Domain Admins and they can manage users/projects in their domains only. Looks like policy.json is depreciated, does anyone have instructions or example policy.yaml file that I can refer to setup domains? I tried it right out of the box but it looks like if I give admin role to domain admin, he can modify all system-wide roles etc. Any help to get the ball rolling for us will be appreciated. Thanks

edit retag flag offensive close merge delete

Comments

policy.json is not obsolete, as far as I know. However, policy.v3cloudsample.json has been removed; its rules are supposed to be implemented in Keystone's default policy now. See release notes.

A user with admin role in the domain scope should do the trick. How do you create your domain admin?

Bernd Bausch gravatar imageBernd Bausch ( 2019-11-05 17:27:59 -0600 )edit

I created a new domain and user under that domain, gave that user global admin role. Do I need to create domain-specific roles every time I create a new domain? If yes, how a domain admin will assign swiftoperator role (or any other role that's defined in the swift config file) to its domain user?

harpinder gravatar imageharpinder ( 2019-11-06 09:06:27 -0600 )edit

To make a user domain admin, give it the admin role in the domain scope. I guess you gave it the admin role in a project scope, which results in the user being global admin. To confirm that my suspicion is correct, I asked you how you created the domain admin. Your answer is too vague.

Bernd Bausch gravatar imageBernd Bausch ( 2019-11-06 17:47:30 -0600 )edit

Try this:

openstack role add --user YOURDOMAINADMIN --domain YOURDOMAIN admin
Bernd Bausch gravatar imageBernd Bausch ( 2019-11-06 18:16:03 -0600 )edit

Apologies for late reply, ask site was down last month than I was away after that. I tried as suggested but getting error: # openstack domain create --description "test domain" testdomain# openstack user create --domain testdomain --password-prompt testdomainadmin

harpinder gravatar imageharpinder ( 2019-12-04 10:48:22 -0600 )edit