3dbaa356b9
Fixes bug 1039591 This patch will enable regular users to list subnets on a shared network by exposing the subnet's "shared" attribute to the policy engine, and letting it applying different rules if the subnet is shared or private. Change-Id: If204f1e352c114e16251586c743f5b7fe2d1ad7d
43 lines
1.7 KiB
JSON
43 lines
1.7 KiB
JSON
{
|
|
"admin_or_owner": [["role:admin"], ["tenant_id:%(tenant_id)s"]],
|
|
"admin_or_network_owner": [["role:admin"], ["tenant_id:%(network_tenant_id)s"]],
|
|
"admin_only": [["role:admin"]],
|
|
"regular_user": [],
|
|
"default": [["rule:admin_or_owner"]],
|
|
|
|
"extension:provider_network:view": [["rule:admin_only"]],
|
|
"extension:provider_network:set": [["rule:admin_only"]],
|
|
|
|
"networks:private:read": [["rule:admin_or_owner"]],
|
|
"networks:private:write": [["rule:admin_or_owner"]],
|
|
"networks:shared:read": [["rule:regular_user"]],
|
|
"networks:shared:write": [["rule:admin_only"]],
|
|
|
|
"subnets:private:read": [["rule:admin_or_owner"]],
|
|
"subnets:private:write": [["rule:admin_or_owner"]],
|
|
"subnets:shared:read": [["rule:regular_user"]],
|
|
"subnets:shared:write": [["rule:admin_only"]],
|
|
|
|
"create_subnet": [["rule:admin_or_network_owner"]],
|
|
"get_subnet": [],
|
|
"update_subnet": [["rule:admin_or_network_owner"]],
|
|
"delete_subnet": [["rule:admin_or_network_owner"]],
|
|
|
|
"create_network": [],
|
|
"get_network": [],
|
|
"create_network:shared": [["rule:admin_only"]],
|
|
"update_network": [],
|
|
"update_network:shared": [["rule:admin_only"]],
|
|
"delete_network": [],
|
|
|
|
"create_port": [],
|
|
"create_port:mac_address": [["rule:admin_or_network_owner"]],
|
|
"create_port:host_routes": [["rule:admin_or_network_owner"]],
|
|
"create_port:fixed_ips": [["rule:admin_or_network_owner"]],
|
|
"get_port": [["rule:admin_or_owner"]],
|
|
"update_port": [["rule:admin_or_owner"]],
|
|
"update_port:host_routes": [["rule:admin_or_network_owner"]],
|
|
"update_port:fixed_ips": [["rule:admin_or_network_owner"]],
|
|
"delete_port": [["rule:admin_or_owner"]]
|
|
}
|