第 4 章 管理组
您可以使用 Identity Service (keystone)组为多个用户帐户分配一致的权限。
4.1. 使用 CLI 配置组 复制链接链接已复制到粘贴板!
复制链接链接已复制到粘贴板!
创建组并为组分配权限。组成员继承分配给组的相同权限:
创建组
grp-Auditors:$ openstack group create grp-Auditors +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | description | | | domain_id | default | | id | 2a4856fc242142a4aa7c02d28edfdfff | | name | grp-Auditors | +-------------+----------------------------------+查看 keystone 组列表:
$ openstack group list --long +----------------------------------+--------------+-----------+-------------+ | ID | Name | Domain ID | Description | +----------------------------------+--------------+-----------+-------------+ | 2a4856fc242142a4aa7c02d28edfdfff | grp-Auditors | default | | +----------------------------------+--------------+-----------+-------------+授予
grp-Auditors组权限来访问demo项目,同时使用member角色:$ openstack role add member --group grp-Auditors --project demo将现有用户
user1添加到grp-Auditors组中:$ openstack group add user grp-Auditors user1 user1 added to group grp-Auditors确认
user1是grp-Auditors的成员:$ openstack group contains user grp-Auditors user1 user1 in group grp-Auditors查看已分配给
user1的有效权限:$ openstack role assignment list --effective --user user1 +----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+ | Role | User | Group | Project | Domain | Inherited | +----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+ | 9fe2ff9ee4384b1894a90878d3e92bab | 3fefe5b4f6c948e6959d1feaef4822f2 | | 0ce36252e2fb4ea8983bed2a568fa832 | | False | +----------------------------------+----------------------------------+-------+----------------------------------+--------+-----------+