Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 2. Role Management

2.1. Role Management

OpenStack uses a role-based access control (RBAC) mechanism to manage access to its resources. Roles define which actions users can perform. By default, there are two predefined roles: a member role that gets attached to a tenant, and an administrative role to enable non-admin users to administer the environment. Note that there are abstract levels of permission, and it is possible to create the roles the administrator needs, and configure services adequately.

2.1.1. View Roles

Use the following command to list the available predefined roles.

Copy to Clipboard Toggle word wrap 
$ keystone role-list
+----------------------------------+---------------+
|                id                |      name     |
+----------------------------------+---------------+
| 71ccc37d41c8491c975ae72676db687f |     Member    |
| 149f50a1fe684bfa88dae76a48d26ef7 | ResellerAdmin |
| 9fe2ff9ee4384b1894a90878d3e92bab |    _member_   |
| 6ecf391421604da985db2f141e46a7c8 |     admin     |
+----------------------------------+---------------+

To get details for a specified role, run:

Copy to Clipboard Toggle word wrap 
$ keystone role-get [ROLE]

Example

Copy to Clipboard Toggle word wrap 
$ keystone role-get admin
+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|    id    | 6ecf391421604da985db2f141e46a7c8 |
|   name   |             admin                |
+----------+----------------------------------+

2.1.2. Create and Assign a Role

As a cloud administrator, you can create and manage roles on the Keystone client using the following set of commands. Each OpenStack deployment must include at least one project, one user, and one role, linked together. However, users can be members of multiple projects. To assign users to multiple projects, create a role and assign that role to a user-project pair. Note that you can create a user and assign a primary project and default role in the dashboard.

Note

Either the name or ID can be used to specify users, roles, or projects.

  1. Create the new-role role:

    Copy to Clipboard Toggle word wrap 
    $ keystone role-create --name [ROLE_NAME]

    Example

    Copy to Clipboard Toggle word wrap 
    $ keystone role-create --name new-role
+----------+----------------------------------+
| Property |              Value               |
+----------+----------------------------------+
|    id    | 61013e7aa4ba4e00a0a1ab4b14bc6b2a |
|   name   |             new-role             |
+----------+----------------------------------+

  2. To assign a user to a project, you must assign the role to a user-project pair. To do this, obtain the user, role, and project names or IDs:

    1. List users:

      Copy to Clipboard Toggle word wrap 
      $ keystone user-list

    2. List roles:

      Copy to Clipboard Toggle word wrap 
      $ keystone role-list

    3. List projects:

      Copy to Clipboard Toggle word wrap 
      $ keystone tenant-list

  3. Assign a role to a user-project pair.

    Copy to Clipboard Toggle word wrap 
    $ keystone user-role-add --user [USER_NAME] --role [ROLE_NAME] --tenant [TENANT_NAME]

    Example

    In this example, you assign the new-role role to the demo-demo pair:

    Copy to Clipboard Toggle word wrap 
    $ keystone user-role-add --user demo --role new-role --tenant demo

  4. Verify the role assignment for the user demo:

    Copy to Clipboard Toggle word wrap 
    $ keystone user-role-list --user [USER_NAME] --tenant [TENANT_NAME]

    Example

    Copy to Clipboard Toggle word wrap 
    $ keystone user-role-list --user demo --tenant demo

2.1.3. Delete a Role

  1. Use the following command to delete a role from a user-project pair. Deleting a role ensures the associated user-project pairing is lost.

    Copy to Clipboard Toggle word wrap 
    $ keystone user-role-remove --user [USER_NAME] --role [ROLE] --tenant [TENANT_NAME]

  2. Verify the role removal:

    Copy to Clipboard Toggle word wrap 
    $ keystone user-role-list --user [USER_NAME] --tenant [TENANT_NAME]

    If the role was removed, the command output omits the removed role.

Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat, Inc.