Hi,<div><br></div><div>The complete reference for the ACL permissions required by each command is here [1].</div><div><br></div><div>You should also take into account the individual permission of each resource [2]. I'm referring specifically to:</div>
<div><br></div><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">Groups A and B should only be able to execute resources on their own group.</blockquote>
<div><br></div><div>This can be done with an ACL rule, but it makes more sense to change the 'group use' permissions (chmod 040)</div><div> </div><div>About the chown / chgrp buttons missing from Sunstone, I believe the reason is that somewhere the code checks if the user logged-in is not in the oneadmin group, and hides these administrative buttons. Sunstone is going to be renewed for 4.0, and I'm sure this will be changed too.</div>
</div><div><br></div><div>Regards.</div><div><br></div><div>[1] <a href="http://opennebula.org/documentation:rel3.8:api">http://opennebula.org/documentation:rel3.8:api</a></div><div>[2] <a href="http://opennebula.org/documentation:rel3.8:chmod">http://opennebula.org/documentation:rel3.8:chmod</a><br clear="all">
<div>--<br>Carlos Martín, MSc<br>Project Engineer<br>OpenNebula - The Open-source Solution for Data Center Virtualization<div><span style="border-collapse:collapse;color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px"><a href="http://www.OpenNebula.org" target="_blank">www.OpenNebula.org</a> | <a href="mailto:cmartin@opennebula.org" target="_blank">cmartin@opennebula.org</a> | <a href="http://twitter.com/opennebula" target="_blank">@OpenNebula</a></span><span style="border-collapse:collapse;color:rgb(136,136,136);font-family:arial,sans-serif;font-size:13px"><a href="mailto:cmartin@opennebula.org" style="color:rgb(42,93,176)" target="_blank"></a></span></div>
</div><br>
<br><br><div class="gmail_quote">On Fri, Nov 30, 2012 at 12:47 PM, Andreas Calvo Gómez <span dir="ltr"><<a href="mailto:andreas.calvo@scytl.com" target="_blank">andreas.calvo@scytl.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
Hi,<br>
Following the example in the documentation for managing ACLs (
<a href="http://opennebula.org/documentation:rel3.8:manage_acl" target="_blank">http://opennebula.org/documentation:rel3.8:manage_acl</a>),
how should be implemented if we have two groups of users which
should be able to execute VMs, but one set of users (say,
administrators), which should be able to create any resource and
assign it to the corresponding group?<br>
<br>
Imagine a scenario where we have to groups, A and B; and a group of
admins, Admin.<br>
Groups A and B should only be able to execute resources on their own
group.<br>
Admin group should be able to create resources and assign them to a
specific group.<br>
The only thing that is missing is the chgrp/chown commands under the
sunstone webui, which is the reference tool to use.<br>
<pre cols="72">--
Andreas Calvo Gómez
Systems Engineer
Scytl Secure Electronic Voting
Plaça Gal·la Placidia, 1-3, 1st floor · 08006 Barcelona
Phone: <a href="tel:%2B%2034%20934%20230%20324" value="+34934230324" target="_blank">+ 34 934 230 324</a>
Fax: <a href="tel:%2B%2034%20933%20251%20028" value="+34933251028" target="_blank">+ 34 933 251 028</a>
<a href="http://www.scytl.com" target="_blank">http://www.scytl.com</a>
NOTICE: The information in this e-mail and in any of its attachments is
confidential and intended solely for the attention and use of the named
addressee(s). If you are not the intended recipient, any disclosure,
copying,
distribution or retaining of this message or any part of it, without the
prior
written consent of Scytl Secure Electronic Voting, SA is prohibited and
may be
unlawful. If you have received this in error, please contact the sender
and
delete the material from any computer. </pre>
</div>
<br>_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opennebula.org">Users@lists.opennebula.org</a><br>
<a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a><br>
<br></blockquote></div><br></div>