Chapter 2. Role Management
2.1. Role Management
OpenStack uses a role-based access control (RBAC) mechanism to manage access to its resources. Roles define which actions users can perform. By default, there are two predefined roles: a member role that gets attached to a tenant, and an administrative role to enable non-admin users to administer the environment. Note that there are abstract levels of permission, and it is possible to create the roles the administrator needs, and configure services adequately.
2.1.1. View Roles
Use the following command to list the available predefined roles.
$ keystone role-list +----------------------------------+---------------+ | id | name | +----------------------------------+---------------+ | 71ccc37d41c8491c975ae72676db687f | Member | | 149f50a1fe684bfa88dae76a48d26ef7 | ResellerAdmin | | 9fe2ff9ee4384b1894a90878d3e92bab | _member_ | | 6ecf391421604da985db2f141e46a7c8 | admin | +----------------------------------+---------------+
To get details for a specified role, run:
$ keystone role-get [ROLE]
Example
$ keystone role-get admin +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | id | 6ecf391421604da985db2f141e46a7c8 | | name | admin | +----------+----------------------------------+
2.1.2. Create and Assign a Role
As a cloud administrator, you can create and manage roles on the Keystone client using the following set of commands. Each OpenStack deployment must include at least one project, one user, and one role, linked together. However, users can be members of multiple projects. To assign users to multiple projects, create a role and assign that role to a user-project pair. Note that you can create a user and assign a primary project and default role in the dashboard.
Either the name or ID can be used to specify users, roles, or projects.
Create the
new-role
role:$ keystone role-create --name [ROLE_NAME]
Example
$ keystone role-create --name new-role +----------+----------------------------------+ | Property | Value | +----------+----------------------------------+ | id | 61013e7aa4ba4e00a0a1ab4b14bc6b2a | | name | new-role | +----------+----------------------------------+
To assign a user to a project, you must assign the role to a user-project pair. To do this, obtain the user, role, and project names or IDs:
List users:
$ keystone user-list
List roles:
$ keystone role-list
List projects:
$ keystone tenant-list
Assign a role to a user-project pair.
$ keystone user-role-add --user [USER_NAME] --role [ROLE_NAME] --tenant [TENANT_NAME]
Example
In this example, you assign the
new-role
role to thedemo
-demo
pair:$ keystone user-role-add --user demo --role new-role --tenant demo
Verify the role assignment for the user
demo
:$ keystone user-role-list --user [USER_NAME] --tenant [TENANT_NAME]
Example
$ keystone user-role-list --user demo --tenant demo
2.1.3. Delete a Role
Use the following command to delete a role from a user-project pair. Deleting a role ensures the associated user-project pairing is lost.
$ keystone user-role-remove --user [USER_NAME] --role [ROLE] --tenant [TENANT_NAME]
Verify the role removal:
$ keystone user-role-list --user [USER_NAME] --tenant [TENANT_NAME]
If the role was removed, the command output omits the removed role.