Re: [Openstack-operators] Dynamic Policy

2015-08-05 Thread Fox, Kevin M
As an Op, I've ran into this problem and keep running into it. I would very much like a solution. Its also quite related to the nova instance user issue I've been working on, that's needed by the App Catalog project. So, yes, please keep fighting the good fight. Thanks, Kevin

Re: [Openstack-operators] Dynamic Policy

2015-08-05 Thread Kris G. Lindgren
We ran into this as well. What we did is create an external to keystone api, that we expose to our end users via a UI. The api will let user create projects (with a specific defined quota) and also add users with the project admins role to the project. Those admins can add/remove users from

Re: [Openstack-operators] Dynamic Policy

2015-08-05 Thread Adam Young
On 08/05/2015 12:01 PM, Kris G. Lindgren wrote: We ran into this as well. What we did is create an external to keystone api, that we expose to our end users via a UI. The api will let user create projects (with a specific defined quota) and also add users with the project admins role to the

Re: [Openstack-operators] Dynamic Policy

2015-08-05 Thread Marc Heckmann
Echoing what others have said, we too have an abstraction layer in the form of a custom UI to allow project owners to create/delete users. As for your questions Adam, having policy in the Keystone database as data seems like a no brainer. As you suggest it enables us to do so much more. For

Re: [Openstack-operators] Dynamic Policy

2015-08-05 Thread Matt Fischer
Jumping in with another us too here. We have some custom Horizon extensions that allow project owners to manage some of this stuff. On Wed, Aug 5, 2015 at 4:14 PM, Marc Heckmann marc.heckm...@ubisoft.com wrote: Echoing what others have said, we too have an abstraction layer in the form of a

Re: [Openstack-operators] Dynamic Policy

2015-08-05 Thread Xav Paice
On 06/08/15 04:01, Kris G. Lindgren wrote: We ran into this as well. What we did is create an external to keystone api, that we expose to our end users via a UI. The api will let user create projects (with a specific defined quota) and also add users with the project admins role to the

Re: [Openstack-operators] Dynamic Policy for Access Control

2015-04-10 Thread Adam Young
On 04/07/2015 11:36 AM, Marc Heckmann wrote: My apologies for not seeing this sooner as the topic is of great interest. My comments below inline.. On Mon, 2015-02-23 at 16:41 +, Tim Bell wrote: -Original Message- From: Adam Young [mailto:ayo...@redhat.com] Sent: 23 February 2015

Re: [Openstack-operators] Dynamic Policy for Access Control

2015-04-07 Thread Marc Heckmann
My apologies for not seeing this sooner as the topic is of great interest. My comments below inline.. On Mon, 2015-02-23 at 16:41 +, Tim Bell wrote: -Original Message- From: Adam Young [mailto:ayo...@redhat.com] Sent: 23 February 2015 16:45 To: