cloudstack-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF subversion and git services (JIRA)" <>
Subject [jira] [Commented] (CLOUDSTACK-8562) User Definable Roles
Date Wed, 11 May 2016 06:05:13 GMT


ASF subversion and git services commented on CLOUDSTACK-8562:

Commit bee2bdc299844e081ef30ccc5de0c2e01b2a0581 in cloudstack's branch refs/heads/master from
[;h=bee2bdc ]

Merge pull request #1489 from shapeblue/dynamicroles-master

CLOUDSTACK-8562: Dynamic Role-Based API Checker for CloudStack### CLOUDSTACK-8562: DB-Backed
Dynamic Role Based API Access Checker

This feature allows root administrators to define new roles and associate API
permissions to them.

A limited form of role-based access control for the CloudStack management server
API is provided through a properties file,, embedded in the
WAR distribution. Therefore, customizing API permissions requires unpacking the
distribution and modifying this file consistently on all servers. The old system
also does not permit the specification of additional roles.


DB-Backed Dynamic Role Based API Access Checker for CloudStack brings following
changes, features and use-cases:
- Moves the API access definitions from to the mgmt server DB
- Allows defining custom roles (such as a read-only ROOT admin) beyond the
  current set of four (4) roles
- All roles will resolve to one of the four known roles types (Admin, Resource
  Admin, Domain Admin and User) which maintains this association by requiring
  all new defined roles to specify a role type.
- Allows changes to roles and API permissions per role at runtime including additions or
  removal of roles and/or modifications of permissions, without the need
  of restarting management server(s)

Upgrade/installation notes:
- The feature will be enabled by default for new installations, existing
  deployments will continue to use the older static role based api access checker
  with an option to enable this feature
- During fresh installation or upgrade, the upgrade paths will add four default
  roles based on the four default role types
- For ease of migration, at the time of upgrade will be used
  to add existing set of permissions to the default roles. cloud.account
  will have a new role_id column which will be populated based on default roles
  as well

Dynamic-roles migration tool: scripts/util/
- Allows admins to migrate to the dynamic role based checker at a future date
- Performs a harder one-way migrate and update
- Migrates rules from existing file into db and deprecates it
- Enables an internal hidden switch to enable dynamic role based checker feature

* pr/1489:
  maven: Fix jstl version usage
  CLOUDSTACK-8562: Deprecate
  CLOUDSTACK-8562: DB-Backed Dynamic Role Based API Access Checker
  CLOUDSTACK-9361: Centrally handle API validations

Signed-off-by: Will Stevens <>

> User Definable Roles
> --------------------
>                 Key: CLOUDSTACK-8562
>                 URL:
>             Project: CloudStack
>          Issue Type: New Feature
>      Security Level: Public(Anyone can view this level - this is the default.) 
>          Components: Management Server
>            Reporter: Paul Angus
>            Assignee: Rohit Yadav
> Static moved to database and made user definable

This message was sent by Atlassian JIRA

View raw message