How to restrict adding users in projects from different domains/regions ?

[Rajiv Mucheli]

Hi Team,

I able to add users or Technical users in projects from different domains, i dont think this is a default feature ? or is it ? if yes, can we restrict users from being added from different domains/regions ?

The keystone policy.json is present here https://github.com/sapcc/helm-charts/blob/master/openstack/keystone/templates/etc/_policy.json.tpl

The command used to add users from different domain is :

openstack role add --project <project_id> --user <user_id> <role_id>

Do we need to harden the policy wrt :

    "identity:create_role": "rule:cloud_admin",

or

    "identity:update_role": "rule:cloud_admin",

Debug logs show : HTTP PUT is being used:

PUT call to identity for <AUTH_URL>/v3/projects/<project_id>/users/<user_id>/roles/<role_id> used

Regards,
Rajiv

[Rajiv Mucheli (rajiv.mucheli)]

any update here ?