Page Not Found
We could not find what you were looking for.
Please contact the owner of the site that linked you to the original URL and let them know their link is broken.
is_domain_managed_role"",id:"specifying-manageable-roles-via-is_domain_managed_role",level:4},{value:"Example: permitting multiple roles",id:"example-permitting-multiple-roles",level:5},{value:"Impact",id:"impact",level:3},{value:"Security implications",id:"security-implications",level:4}];function m(e){const a={a:"a",admonition:"admonition",blockquote:"blockquote",code:"code",h2:"h2",h3:"h3",h4:"h4",h5:"h5",li:"li",ol:"ol",p:"p",pre:"pre",section:"section",strong:"strong",sup:"sup",ul:"ul",...(0,o.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(a.h2,{id:"implementation-notes",children:"Implementation notes"}),"\n",(0,r.jsx)(a.admonition,{type:"caution",children:(0,r.jsxs)(a.p,{children:["If a Keystone release of OpenStack 2024.2 or later is used, ",(0,r.jsx)(a.strong,{children:"the policy configuration described in this document MUST be removed again"})," in case it was applied in the past prior to the upgrade."]})}),"\n",(0,r.jsxs)(a.admonition,{type:"info",children:[(0,r.jsx)(a.p,{children:'The implementation described in this document only applies to Keystone releases prior to the OpenStack release 2024.2 ("Dalmatian").\nThis document describes a transitional solution to offer the Domain Manager functionality for SCS clouds based on an OpenStack release earlier than 2024.2.'}),(0,r.jsx)(a.p,{children:"Beginning with the 2024.2 release of OpenStack, the Domain Manager persona is integrated natively into Keystone and the implementation described below is unnecessary and might conflict with the native implementation."})]}),"\n",(0,r.jsx)(a.h3,{id:"policy-adjustments",children:"Policy adjustments"}),"\n",(0,r.jsx)(a.p,{children:'The following policy can be applied to Keystone releases older than 2024.2 ("Dalmatian").\nIt mimics the Domain Manager persona implemented by Keystone starting with version 2024.2 and makes the functionality available for earlier releases of Keystone.'}),"\n",(0,r.jsx)(a.p,{children:"The only parts of the policy definitions below that may be changed are:"}),"\n",(0,r.jsxs)(a.ol,{children:["\n",(0,r.jsxs)(a.li,{children:['The "',(0,r.jsx)(a.code,{children:"base_*"}),'" definitions to align them to the correct OpenStack defaults matching the OpenStack release of the environment in case those differ from this template.']}),"\n",(0,r.jsxs)(a.li,{children:['The "',(0,r.jsx)(a.code,{children:"is_domain_managed_role"}),'" definition (see next section below).']}),"\n"]}),"\n",(0,r.jsx)(a.pre,{children:(0,r.jsx)(a.code,{className:"language-yaml",children:'# SCS Domain Manager policy configuration\n\n# Section A: OpenStack base definitions\n# The entries beginning with "base_