2.9. 授予外部组对 Red Hat OpenStack Platform 项目的访问权限

流程

1. 从 OpenStack 身份域检索用户组列表：

   # openstack group list --domain LAB

   Copy to Clipboard Toggle word wrap

   命令输出取决于您集成的外部用户管理服务：

   • Active Directory Domain Service (AD DS)：

     +------------------------------------------------------------------+---------------------+
     | ID                                                               | Name                |
     +------------------------------------------------------------------+---------------------+
     | 185277be62ae17e498a69f98a59b66934fb1d6b7f745f14f5f68953a665b8851 | grp-openstack       |
     | a8d17f19f464c4548c18b97e4aa331820f9d3be52654aa8094e698a9182cbb88 | grp-openstack-admin |
     | d971bb3bd5e64a454cbd0cc7af4c0773e78d61b5f81321809f8323216938cae8 | grp-openstack-demo  |
     +------------------------------------------------------------------+---------------------+

     Copy to Clipboard Toggle word wrap

   • Red Hat Identity Manager (IdM):

     +------------------------------------------------------------------+---------------------+
     | ID                                                               | Name                |
     +------------------------------------------------------------------+---------------------+
     | 185277be62ae17e498a69f98a59b66934fb1d6b7f745f14f5f68953a665b8851 | grp-openstack       |
     | a8d17f19f464c4548c18b97e4aa331820f9d3be52654aa8094e698a9182cbb88 | grp-openstack-admin |
     | d971bb3bd5e64a454cbd0cc7af4c0773e78d61b5f81321809f8323216938cae8 | grp-openstack-demo  |
     +------------------------------------------------------------------+---------------------+

     Copy to Clipboard Toggle word wrap

2. 检索角色列表：

   # openstack role list

   Copy to Clipboard Toggle word wrap

   命令输出取决于您集成的外部用户管理服务：

   • Active Directory Domain Service (AD DS)：

     +----------------------------------+-----------------+
     | ID                               | Name            |
     +----------------------------------+-----------------+
     | 01d92614cd224a589bdf3b171afc5488 | admin           |
     | 034e4620ed3d45969dfe8992af001514 | member          |
     | 0aa377a807df4149b0a8c69b9560b106 | ResellerAdmin   |
     | 9369f2bf754443f199c6d6b96479b1fa | heat_stack_user |
     | cfea5760d9c948e7b362abc1d06e557f | reader          |
     | d5cb454559e44b47aaa8821df4e11af1 | swiftoperator   |
     | ef3d3f510a474d6c860b4098ad658a29 | service         |
     +----------------------------------+-----------------+

     Copy to Clipboard Toggle word wrap

   • Red Hat Identity Manager (IdM):

     +----------------------------------+---------------+
     | ID                               | Name          |
     +----------------------------------+---------------+
     | 0969957bce5e4f678ca6cef00e1abf8a | ResellerAdmin |
     | 1fcb3c9b50aa46ee8196aaaecc2b76b7 | admin         |
     | 9fe2ff9ee4384b1894a90878d3e92bab | _member_      |
     | d3570730eb4b4780a7fed97eba197e1b | SwiftOperator |
     +----------------------------------+---------------+

     Copy to Clipboard Toggle word wrap

3. 通过将用户组添加到一个或多个这些角色，来授予用户对 RHOSP 项目的访问权限。例如，如果您希望 grp-openstack-demo 组中的用户是 demo 项目的普通用户，您必须将该组添加到 member 或 _member_ 角色中，具体取决于您要集成的外部服务：

   • Active Directory Domain Service (AD DS)：

     # openstack role add --project demo --group d971bb3bd5e64a454cbd0cc7af4c0773e78d61b5f81321809f8323216938cae8  member

     Copy to Clipboard Toggle word wrap

   • Red Hat Identity Manager (IdM):

     $ openstack role add --project demo --group d971bb3bd5e64a454cbd0cc7af4c0773e78d61b5f81321809f8323216938cae8  _member_

     Copy to Clipboard Toggle word wrap