Skip to content

Commit c5289d3

Browse files
markus-hentschfkr
authored andcommitted
Update Domain Manager instructions to reflect latest changes
Signed-off-by: Markus Hentsch <[email protected]>
1 parent 961de1b commit c5289d3

File tree

1 file changed

+2
-27
lines changed

1 file changed

+2
-27
lines changed

docs/05-iam/domain-manager-setup-and-usage.md

+2-27
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,5 @@
11
# Domain Manager setup and usage
22

3-
:::info
4-
5-
The following documentation refers to a SCS standard that is still in draft state.
6-
It is not meant for productive use yet but CSPs are encouraged to test-drive and provide feedback!
7-
8-
:::
9-
103
## Preface
114

125
SCS defines the **Domain Manager** standard, introducing a special persona to the OpenStack Keystone identity manager.
@@ -15,19 +8,10 @@ Its intended use case is to offer extensive identity management self-service cap
158

169
This guide will explain setup, configuration and usage of the SCS Domain Manager standard.
1710

18-
### Warning regarding the exposure of domain names
19-
20-
Due to architectural limitations currently existing in OpenStack Keystone, assigning the `manager` role to users while the configuration of the SCS Domain Manager standard has been applied will **enable them to see the IDs and names of all existing domains**.
21-
This includes domains other than their own, meaning that other tenant's identities might be exposed depending on the relation between them and the name of their domain.
22-
CSPs aiming to appoint Domain Manager users must be aware of this limitation and should exclusively **use pseudonymized domain names across the whole infrastructure**.
23-
If CSPs strictly follow the [SCS naming conventions](https://github.com/SovereignCloudStack/standards/blob/main/Standards/scs-0301-v1-naming-conventions.md) for domains this is already addressed.
24-
If this is not feasible for the CSP, they may opt to refrain from making use of the Domain Manager functionality at all, i.e. never assign the `manager` role to tenant users.
25-
2611
:::info
2712

28-
This architectural limitation will be fixed in upcoming OpenStack and SCS releases.
29-
30-
See [https://bugs.launchpad.net/keystone/+bug/2041611](https://bugs.launchpad.net/keystone/+bug/2041611)
13+
The Domain Manager functionality, formerly exclusive to the corresponding SCS standard, will be natively integrated into OpenStack starting with release 2024.2 ("Dalmatian").
14+
When using an OpenStack release equal to 2024.2 or later, you can omit the instructions for Keystone API policy adjustments.
3115

3216
:::
3317

@@ -89,15 +73,6 @@ Refer to the SCS Domain Manager standard for more information.
8973
9074
The following sections describe actions available to CSP operators that possess the `admin` role.
9175

92-
### Creating domains
93-
94-
:::caution
95-
96-
It is highly recommended to use pseudonymized domain names when creating domains, since Domain Managers will currently be able to see the names of all existing domains.
97-
See [Warning regarding the exposure of domain names](#warning-regarding-the-exposure-of-domain-names) for more details.
98-
99-
:::
100-
10176
For each tenant for which a self-service area (i.e. a domain) is to be established, a domain should be created before creating any users, projects or groups for this tenant:
10277

10378
```bash

0 commit comments

Comments
 (0)