Versions Compared

Old Version 111

changes.mady.by.user Prachi Damle

Saved on

compared with

New Version 112

changes.mady.by.user Prachi Damle

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • Find all groups the user belongs too.
  • Find all 'effective' policies the groups are associated to. Effective includes all :
    1. All policy associations in the DB for the given account Id
    2. All policy associations in the DB

...

    1. for the groups that the given account Id is associated to
    2. All 'recursive= true' policy associations in the DB for the parent groups of the groups the  given account Id is associated to. Parent group is found out form the 'path' property of a group.
  • If any policy has a permission attached that 'Allows' the API, grant permission to make this call
  • Else, if no Allow entry is found for any policy for this API, deny the permission

What is 'recursive = true' permission?

  • This flag indicates a permission to an entity which is accessible in a group hierarchy downwards upto the 'leaf' group. The hierarchy is defined using the 'path' property of the group.
  • This design is used to map the 'domain' hierarchy of CloudStack and facilitate access check for entities that span the domain tree like Network, AffinityGroup.
  • This property 'recursive' is not exposed in IAM APIs, but only used by CloudStack orchestration when such domain-wide resources are created in the system through normal CS APIs.

IAM Interface to check API Access

...