openstack/oslo.policy
Code Issues Proposed changes

Link to the Keystone role documentation

Browse Source 
The oslo.policy docs on writing custom policy checks use things like
the admin role without explaining where it comes from. This change
adds a link to the Keystone docs that explain which roles are created
by default and what they provide access to.

Change-Id: I70c01ad88344edd2db384da8b24ba0238764a8ec
This commit is contained in:
Ben Nemec
2020-01-15 18:02:35 +00:00
parent e49b2ae612
commit 30f5df1b8c
2 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
doc/source/admin/policy-json-file.rst
View File

@@ -76,6 +76,10 @@ administrators can create new users in the Identity database:
"identity:create_user" : "role:admin" "identity:create_user" : "role:admin"
.. note:: ``admin`` is a built-in default role in Keystone. For more
details and other roles that may be available, see the
`Keystone documentation on default roles. <https://docs.openstack.org/keystone/latest/admin/service-api-protection.html>`_
You can limit APIs to any role. For example, the Orchestration service You can limit APIs to any role. For example, the Orchestration service
defines a role named ``heat_stack_user``. Whoever has this role is not defines a role named ``heat_stack_user``. Whoever has this role is not
allowed to create stacks: allowed to create stacks:

4
doc/source/admin/policy-yaml-file.rst
View File

@@ -71,6 +71,10 @@ administrators can create new users in the Identity database:
"identity:create_user" : "role:admin" "identity:create_user" : "role:admin"
.. note:: ``admin`` is a built-in default role in Keystone. For more
details and other roles that may be available, see the
`Keystone documentation on default roles. <https://docs.openstack.org/keystone/latest/admin/service-api-protection.html>`_
You can limit APIs to any role. For example, the Orchestration service You can limit APIs to any role. For example, the Orchestration service
defines a role named ``heat_stack_user``. Whoever has this role is not defines a role named ``heat_stack_user``. Whoever has this role is not
allowed to create stacks: allowed to create stacks: