Page History
...
This policy should allow all API operations on all types of resources for all domains and accounts. We can represent this policy in following fashion in the db schema:
Accountaccount
id | account_name | uuid | domain_id |
|---|---|---|---|
2 | admin | 1c5afd64-482b-11e3-86f3-8118f47f9f9f | 1 |
3 | domainAdmin | 929d172c-b95e-4b86-9474-9789072c9bdb | 2 |
4 | domainUserA | f96ddb47-d3c0-4360-a9cd-613d631c8333 | 2 |
acl_group
id | name | description | uuid | domain_id | removed | created |
|---|---|---|---|---|---|---|
1 | NORMAL | Domain user group | d283d4f0-31f0-11e3-ad37-80f85ce25918 | 1 | NULL | 2013-10-10 14:13:34 |
2 | ADMIN | Root admin group | d283de28-31f0-11e3-ad37-80f85ce25918 | 1 | NULL | 2013-10-10 14:13:34 |
3 | DOMAIN_ADMIN | Domain admin group | d283e6e8-31f0-11e3-ad37-80f85ce25918 | 1 | NULL | 2013-10-10 14:13:34 |
acl_policy
id | name | description | uuid | domain_id | removed | created | rol |
|---|---|---|---|---|---|---|---|
1 | NORMAL | Domain user role | d2838dce-31f0-11e3-ad37-80f85ce25918 | 1 | NULL | 2013-10-10 14:13:34 | Sta |
2 | ADMIN | Root admin role | d2839c56-31f0-11e3-ad37-80f85ce25918 | 1 | NULL | 2013-10-10 14:13:34 | Sta |
3 | DOMAIN_ADMIN | Domain admin role | d283a7f0-31f0-11e3-ad37-80f85ce25918 | 1 | NULL | 2013-10-10 14:13:34 | Sta |
4 | RESOURCE_DOMAIN_ADMIN | Resource domain admin role | d283b574-31f0-11e3-ad37-80f85ce25918 | 1 | NULL | 2013-10-10 14:13:34 | Sta |
5 | READ_ONLY_ADMIN | Read only admin role | d283beac-31f0-11e3-ad37-80f85ce25918 | 1 | NULL | 2013-10-10 14:13:34 | Sta |
6 | RESOURCE_OWNER | Resource owner role | d283c794-31f0-11e3-ad37-80f85ce25918 | 1 | NULL | 2013-10-10 14:13:34 | Dyn |
----------------------------------------------------------------------------------------------------------------------------
-------+
Access Check Flow
Lets consider the StartVM API is being called by a user and run through the access control usecases for various out-of-box policies.
Overview
Content Tools
Apps