Hi, This doesn't works. As I am not able to restrict the content to be user_id based. Need to do some code changes in get_all function. Regards, Vaibhav <blockquote> ---------- Original message ---------- From:"Eoghan Glynn"< eglynn@redhat.com > Date: 26 Mar 13 20:29:46 Subject: Re: [rhos-list] Control Access to instance termination To: Kumar Vaibhav <vaibhav.k.agarwal@in.com> Cc: rhos-list <rhos-list@redhat.com> > > Hi, > > > > Thanks for the help. > > This seems to solve one part of my problem of changing the state of > > the instance. > > A user cannot delete the other users' instance. > > Great. > > > However the listing problem still continues to exist. I checked the > > logs and found that get_all access control is possible by using the > > policy.json. But get_all function itself uses t he filter of > > 'project_id' from the context. So other part seems to be difficult. > > I'm sure I see the problem here, as nova.compute.api.API.get_all s/I'm sure/I'm not sure/ > bases its policy enforcement check on a target that includes both > the project_id *and* user_id: > > <a href="https://github.com/openstack/nova/blob/stable/folsom/nova/compute/api.py#L1116" target="_blank">https://github.com/openstack/nova/blob/stable/folsom/nova/compute/api.py#L1116</a> > > So it seems to me that a rule based on user_id would be applicable > in this case also. Again I've just done a quick test against master, > please let me know if the behavior you're seeing with your version > of RHOS is different. > > Cheers, > Eoghan > > > > Regards, > > Vaibhav > > > > ---------- Original message ---------- > > > > > > From:"Eoghan Glynn"< eglynn@redhat.com > > > Date: 25 Mar 13 22:08:26 > > Subject: Re: [rhos-list] Control Access to instance termination > > To: Kumar Vaibhav <vaibhav.k.agarwal@in.com> > > Cc: rhos-list <rhos-list@redhat.com> > > > > > > > > > or using the older syntax: > > > > > > [["role:admin"], ["role:project_admin", > > > "project_id:%(project_id)s"]], ["user_id:%(user_id)s"]] > > > > Typo: > > > > [["role:admin"], ["role :project_admin", > > "project_id:%(project_id)s"], ["user_id:%(user_id)s"]] > > > > > > > > > > Get Yourself a cool, short @in.com Email ID now! > > _______________________________________________ > rhos-list mailing list > rhos-list@redhat.com > <a href="https:// www.redhat.com/mailman/listinfo/rhos-list" target="_blank">https://www.redhat.com/mailman/listinfo/rhos-list</a> > </blockquote> <div style="border-top:1px dashed #ccc; border-bottom:1px dashed #ccc; padding:5px;"><a href="http://www3.in.com/sso/commonregister.php?ref=IN&utm_source=invite&utm_medium=outgoing" style="font:13px arial; color:#1E56A1; text-decoration:none;">Get Yourself a cool, short @in.com Email ID now!</a></div>