...
Ticket to track the feature implementation: https://issues.apache.org/jira/browse/CLOUDSTACK-5920
Note: IAM feature cannot be put in to current 4.5 codebase due to API gap and limitations found and documented here: https://cwiki.apache.org/confluence/display/CLOUDSTACK/API+changes
...
Code Block |
---|
/** * QuerySelector returns granted domain, or account or resources for caller. */ public interface QuerySelector extends Adapter { ... /** * List granted domains for the caller, given a specific entity type. * * @param caller account to check against. * @param entityType entity type * @param accessType access type * @return list of domain Ids granted to the caller account. */ List<Long> getAuthorizedDomains(Account caller, String entityType, AccessType accessType); /** * List granted accounts for the caller, given a specific entity type. * * @param caller account to check against. * @param entityType entity type * @param accessType access type * @return list of account Ids granted to the caller account. */ List<Long> getAuthorizedAccounts(Account caller, String entityType, AccessType accessType); /** * List granted resources for the caller, given a specific entity type. * * @param caller account to check against. * @param entityType entity type * @param accessType access type * @return list of resource Ids granted to the caller account. */ List<Long> getAuthorizedResources(Account caller, String entityType, AccessType accessType); /** * Check if this account is associated with a policy with scope of ALL * @param caller account to check * @param action action. action. * @param accessType access type * @return true if this account is attached with a policy for the given action of ALL scope. */ boolean isGrantedAll(Account caller, String action, AccessType accessType); /** * List of IAM group the given account belongs to * @param accountId account id. * @return IAM group names */ List<String> listIAMGroupsByAccount(long accountId); |
...
id | name | description | uuid | path | removed | created | policy_type | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1 | REGULAR_USER | Domain user role | d2838dce-31f0-11e3-ad37-80f85ce25918 | / | NULL | 2013-10-10 14:13:34 | Static | ||||||||
2 | ADMIN | Root admin role | d2839c56-31f0-11e3-ad37-80f85ce25918 | / | NULL | 2013-10-10 14:13:34 | Static | ||||||||
3 | DOMAIN_ADMIN | Domain admin role | d283a7f0-31f0-11e3-ad37-80f85ce25918 | / | NULL | 2013-10-10 14:13:34 | Static | 6 | RESOURCE_OWNER | Resource owner role | d283c794-31f0-11e3-ad37-80f85ce25918 | / | NULL | 2013-10-10 14:13:34 | Dynamic |
iam_group_policy_map
id | group_id | policy_id | removed | created |
---|---|---|---|---|
1 | 1 | 1 | NULL | 2013-10-10 14:13:34 |
2 | 2 | 2 | NULL | 2013-10-10 14:13:34 |
3 | 3 | 3 | NULL | 2013-10-10 14:13:34 |
...
id | policy_id | permission_id | removed | created |
---|---|---|---|---|
1 | 61 | 3 | NULL | 2013-10-10 14:13:34 |
2 | 2 | 1 | NULL | 2013-10-10 14:13:34 |
3 | 3 | 2 | NULL | 2013-10-10 14:13:34 |
...
A Domain Admin 'domainAdmin' calls this command for a VM in his domain:
...
...
For this release, creating a custom policy/group is supported through API only. For further releases, we can provide either a UI or a config file + policy language mechanism to facilitate the custom policy/group creation.