How to setup domains in Train

asked 2019-11-05 11:41:51 -0500

harpinder gravatar image


I am trying to set up domains in keystone so that I can create Domain Admins and they can manage users/projects in their domains only. Looks like policy.json is depreciated, does anyone have instructions or example policy.yaml file that I can refer to setup domains? I tried it right out of the box but it looks like if I give admin role to domain admin, he can modify all system-wide roles etc. Any help to get the ball rolling for us will be appreciated. Thanks

edit retag flag offensive close merge delete


policy.json is not obsolete, as far as I know. However, policy.v3cloudsample.json has been removed; its rules are supposed to be implemented in Keystone's default policy now. See release notes.

A user with admin role in the domain scope should do the trick. How do you create your domain admin?

Bernd Bausch gravatar imageBernd Bausch ( 2019-11-05 17:27:59 -0500 )edit

I created a new domain and user under that domain, gave that user global admin role. Do I need to create domain-specific roles every time I create a new domain? If yes, how a domain admin will assign swiftoperator role (or any other role that's defined in the swift config file) to its domain user?

harpinder gravatar imageharpinder ( 2019-11-06 09:06:27 -0500 )edit

To make a user domain admin, give it the admin role in the domain scope. I guess you gave it the admin role in a project scope, which results in the user being global admin. To confirm that my suspicion is correct, I asked you how you created the domain admin. Your answer is too vague.

Bernd Bausch gravatar imageBernd Bausch ( 2019-11-06 17:47:30 -0500 )edit

Try this:

openstack role add --user YOURDOMAINADMIN --domain YOURDOMAIN admin
Bernd Bausch gravatar imageBernd Bausch ( 2019-11-06 18:16:03 -0500 )edit

Apologies for late reply, ask site was down last month than I was away after that. I tried as suggested but getting error: # openstack domain create --description "test domain" testdomain# openstack user create --domain testdomain --password-prompt testdomainadmin

harpinder gravatar imageharpinder ( 2019-12-04 10:48:22 -0500 )edit