5eb7e626b1
A role entity can now be specified as domain specific. Closes-bug: #1606105 Change-Id: I564cf3da1d61f5bfcf85be591480d2f5c8d694a0
6.4 KiB
role
Identity v2, v3
role add
Add role assignment to a user or group in a project or domain
role add
os role add
--domain <domain> | --project <project> [--project-domain <project-domain>]
--user <user> [--user-domain <user-domain>] | --group <group> [--group-domain <group-domain>]
--role-domain <role-domain>
--inherited
<role>--domain <domain>
Include <domain> (name or ID)
3
--project <project>
Include <project> (name or ID)
--user <user>
Include <user> (name or ID)
--group <group>
Include <group> (name or ID)
3
--user-domain <user-domain>
Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.
3
--group-domain <group-domain>
Domain the group belongs to (name or ID). This can be used in case collisions between group names exist.
3
--project-domain <project-domain>
Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.
3
--inherited
Specifies if the role grant is inheritable to the sub projects.
3
--role-domain <role-domain>
Domain the role belongs to (name or ID). This must be specified when the name of a domain specific role is used.
3
<role>
Role to add to <project>:<user> (name or ID)
role create
Create new role
role create
os role create
[--or-show]
[--domain <domain>]
<name>--domain <domain>
Domain the role belongs to (name or ID).
3
--or-show
Return existing role
If the role already exists return the existing role data and do not fail.
<name>
New role name
role delete
Delete role(s)
role delete
os role delete
<role> [<role> ...]
[--domain <domain>]<role>
Role to delete (name or ID)
--domain <domain>
Domain the role belongs to (name or ID).
3
role list
List roles
role list
os role list
--domain <domain> | --project <project> [--project-domain <project-domain>]
--user <user> [--user-domain <user-domain>] | --group <group> [--group-domain <group-domain>]
--inherited--domain <domain>
Filter roles by <domain> (name or ID)
(Deprecated if being used to list assignments in conjunction with the
--user <user>, option, please use
role assignment list instead)
--project <project>
Filter roles by <project> (name or ID)
(Deprecated, please use role assignment list
instead)
--user <user>
Filter roles by <user> (name or ID)
(Deprecated, please use role assignment list
instead)
--group <group>
Filter roles by <group> (name or ID)
(Deprecated, please use role assignment list
instead)
--user-domain <user-domain>
Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.
(Deprecated, please use role assignment list
instead)
3
--group-domain <group-domain>
Domain the group belongs to (name or ID). This can be used in case collisions between group names exist.
(Deprecated, please use role assignment list
instead)
3
--project-domain <project-domain>
Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.
(Deprecated, please use role assignment list
instead)
3
--inherited
Specifies if the role grant is inheritable to the sub projects.
(Deprecated, please use role assignment list
instead)
3
role remove
Remove role assignment from domain/project : user/group
role remove
os role remove
--domain <domain> | --project <project> [--project-domain <project-domain>]
--user <user> [--user-domain <user-domain>] | --group <group> [--group-domain <group-domain>]
--role-domain <role-domain>
--inherited
<role>--domain <domain>
Include <domain> (name or ID)
3
--project <project>
Include <project> (name or ID)
--user <user>
Include <user> (name or ID)
--group <group>
Include <group> (name or ID)
3
--user-domain <user-domain>
Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.
3
--group-domain <group-domain>
Domain the group belongs to (name or ID). This can be used in case collisions between group names exist.
3
--project-domain <project-domain>
Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.
3
--inherited
Specifies if the role grant is inheritable to the sub projects.
3
--role-domain <role-domain>
Domain the role belongs to (name or ID). This must be specified when the name of a domain specific role is used.
3
<role>
Role to remove (name or ID)
role set
Set role properties
3
role set
os role set
[--name <name>]
[--domain <domain>]
<role>--name <name>
Set role name
--domain <domain>
Domain the role belongs to (name or ID).
3
<role>
Role to modify (name or ID)
role show
Display role details
role show
os role show
[--domain <domain>]
<role>--domain <domain>
Domain the role belongs to (name or ID).
3
<role>
Role to display (name or ID)