6.10. 授予外部用户对 Red Hat OpenStack Platform 项目的访问权限

流程

1. 从 OpenStack Identity 域中检索用户列表：

   # openstack user list --domain LAB
    +------------------------------------------------------------------+----------------+
   | ID                                                               | Name           |
   +------------------------------------------------------------------+----------------+
   | 1f24ec1f11aeb90520079c29f70afa060d22e2ce92b2eba7784c841ac418091e | user1          |
   | 12c062faddc5f8b065434d9ff6fce03eb9259537c93b411224588686e9a38bf1 | user2          |
   | afaf48031eb54c3e44e4cb0353f5b612084033ff70f63c22873d181fdae2e73c | user3          |
   | e47fc21dcf0d9716d2663766023e2d8dc15a6d9b01453854a898cabb2396826e | user4          |
   +------------------------------------------------------------------+----------------+

2. 检索角色列表：

   # openstack role list

   命令输出取决于您与之集成的外部用户管理服务：

   • Active Directory 域服务(AD DS)：

     +----------------------------------+-----------------+
     | ID                               | Name            |
     +----------------------------------+-----------------+
     | 01d92614cd224a589bdf3b171afc5488 | admin           |
     | 034e4620ed3d45969dfe8992af001514 | member          |
     | 0aa377a807df4149b0a8c69b9560b106 | ResellerAdmin   |
     | 9369f2bf754443f199c6d6b96479b1fa | heat_stack_user |
     | cfea5760d9c948e7b362abc1d06e557f | reader          |
     | d5cb454559e44b47aaa8821df4e11af1 | swiftoperator   |
     | ef3d3f510a474d6c860b4098ad658a29 | service         |
     +----------------------------------+-----------------+

   • Red Hat Identity Manager (IdM):

     +----------------------------------+---------------+
     | ID                               | Name          |
     +----------------------------------+---------------+
     | 0969957bce5e4f678ca6cef00e1abf8a | ResellerAdmin |
     | 1fcb3c9b50aa46ee8196aaaecc2b76b7 | admin         |
     | 9fe2ff9ee4384b1894a90878d3e92bab | _member_      |
     | d3570730eb4b4780a7fed97eba197e1b | SwiftOperator |
     +----------------------------------+---------------+

3. 通过将用户添加到一个或多个这些角色，授予用户对 RHOSP 项目的访问权限。例如，如果您希望 user1 是 demo 项目的一个一般用户，您可以将它们添加到member 或 _member_ 角色中（具体取决于您集成的外部服务）。

   • Active Directory 域服务(AD DS)：

     # openstack role add --project demo --user 1f24ec1f11aeb90520079c29f70afa060d22e2ce92b2eba7784c841ac418091e member

   • Red Hat Identity Manager (IdM):

     # openstack role add --project demo --user 1f24ec1f11aeb90520079c29f70afa060d22e2ce92b2eba7784c841ac418091e _member_

4. 如果您希望 user1 成为 demo 项目的管理员用户，请将该用户添加到 admin 角色：

   # openstack role add --project demo --user 1f24ec1f11aeb90520079c29f70afa060d22e2ce92b2eba7784c841ac418091e admin