Horizon/DomainSupport

(Work In Progress)

Use Cases

- LDAP, AD, MySQL support

Best Practices

Keystone v3 policy files

Horizon should use the same keystone v3 policy file as the keystone API

An new admin domain should be created

Cloud Admin should have an admin role in a domain specifically created for Identity management of the system.

Project Admin should be deprecated

Cloud Admin and Domain Admin are the preferred "admin" personas in the context of domains

Domain Admins and Project Admins should be mutually exclusive.

Domain Admin + Project Admin is not recommended

Only Cloud Admin(s) should have a role on an admin domain

Non-Cloud Admin users should not have a role on the default admin domain

Definitions

User Types / Personas

Cloud Admin

domain-scoped token, scoped to the ‘default’ domain. This is assuming that user have the ‘admin’ role assigned to him for the ‘default’ domain.

Domain Admin

domain-scoped token, scoped to the given domain. This is assuming that user have the ‘admin’ role assigned to him for the given domain. Cloud Admin is also the Domain Admin for the ‘default’ domain.

Project Admin

project-scoped token, scoped to the given project. This is assuming that user have the ‘admin’ role assigned to him for the given project.

Project User

project-scoped token, scoped to the given project. This is assuming that user have at least one role assigned to him for the given project. Project User is also Project Admin only if user also have the ‘admin’ role assigned to him for the given project.

Note:

Domain-scoped token should NOT have access to Nova. Only project-scoped token have access to the services. Cloud Admin and Domain Admin are Keystone-specific personas and therefore only have access to Keystone APIs.

Known Issues

- User with Domain Admins and Project Member
- Creating Members in the Default Admin domain
- Project Admin, hide Admin Dash on purpose

Horizon Bugs

- list_role_assignments (pure domain admin)
- Group manage members (pure domain admin)
- Project details (pure project admin, member)
- checkboxes and actions when no actions available (member)

Next Steps =

- DOA patch
- Keystone patch
- Fix Horzon Bugs
- UX/UI - project picker, set domain context changes 

Future

- angular goodness
- persona driven workflows
- keystone changes
- quota management