nova/api-guide/source/users.rst
Rajesh Tailor e35c2e1d51 Correct wrong reference in docs
This change fixes the wrong url in nova compute admin doc [1]
in projects-users-and-roles section.

[1] https://docs.openstack.org/api-guide/compute/users.html

Closes-Bug: #1992139
Change-Id: Iee3546845bb37ad08f394ec710f7302d37ffd99b
2022-10-11 15:53:45 +05:30

2.5 KiB

Users

The Compute API includes all end user and administrator API calls.

Role based access control

Keystone middleware is used to authenticate users and identify their roles.

The Compute API uses these roles, along with oslo.policy, to decide what the user is authorized to do.

Refer to the to compute admin guide </admin/architecture#projects-users-and-roles> for details.

Personas used in this guide

While the policy can be configured in many ways, to make it easy to understand the most common use cases the API have been designed for, we should standardize on the following types of user:

  • application deployer: creates/deletes servers, directly or indirectly via API
  • application developer: creates images and applications that run on the cloud
  • cloud administrator: deploys, operates and maintains the cloud

Now in reality the picture is much more complex. Specifically, there are likely to be different roles for observer, creator and administrator roles for the application developer. Similarly, there are likely to be various levels of cloud administrator permissions, such as a read-only role that is able to view a lists of servers for a specific tenant but is not able to perform any actions on any of them.

Note

This is not attempting to be an exhaustive set of personas that consider various facets of the different users but instead aims to be a minimal set of users such that we use a consistent terminology throughout this document.

Discovering Policy

An API to discover what actions you are authorized to perform is still a work in progress. Currently this reported by a HTTP 403 error <synchronous_faults>.

Refer to the configuration guide </configuration/policy> for a list of policy rules along with their default values.