role¶
Identity v2, v3
role add¶
Add role assignment to a user or group in a project or domain
os role add
--domain <domain> | --project <project> [--project-domain <project-domain>]
--user <user> [--user-domain <user-domain>] | --group <group> [--group-domain <group-domain>]
--role-domain <role-domain>
--inherited
<role>
-
--domain
<domain>
¶ Include <domain> (name or ID)
New in version 3.
-
--project
<project>
¶ Include <project> (name or ID)
-
--user
<user>
¶ Include <user> (name or ID)
-
--group
<group>
¶ Include <group> (name or ID)
New in version 3.
-
--user-domain
<user-domain>
¶ Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.
New in version 3.
-
--group-domain
<group-domain>
¶ Domain the group belongs to (name or ID). This can be used in case collisions between group names exist.
New in version 3.
-
--project-domain
<project-domain>
¶ Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.
New in version 3.
-
--inherited
¶
Specifies if the role grant is inheritable to the sub projects.
New in version 3.
-
--role-domain
<role-domain>
¶ Domain the role belongs to (name or ID). This must be specified when the name of a domain specific role is used.
New in version 3.
-
<role>
Role to add to <project>:<user> (name or ID)
role create¶
Create new role
os role create
[--or-show]
[--domain <domain>]
<name>
-
--domain
<domain>
¶ Domain the role belongs to (name or ID).
New in version 3.
-
--or-show
¶
Return existing role
If the role already exists return the existing role data and do not fail.
-
<name>
New role name
role delete¶
Delete role(s)
os role delete
<role> [<role> ...]
[--domain <domain>]
-
<role>
Role to delete (name or ID)
-
--domain
<domain>
¶ Domain the role belongs to (name or ID).
New in version 3.
role list¶
List roles
os role list
--domain <domain> | --project <project> [--project-domain <project-domain>]
--user <user> [--user-domain <user-domain>] | --group <group> [--group-domain <group-domain>]
--inherited
-
--domain
<domain>
¶ Filter roles by <domain> (name or ID)
(Deprecated if being used to list assignments in conjunction with the
--user <user>
, option, please userole assignment list
instead)
-
--project
<project>
¶ Filter roles by <project> (name or ID)
(Deprecated, please use
role assignment list
instead)
-
--user
<user>
¶ Filter roles by <user> (name or ID)
(Deprecated, please use
role assignment list
instead)
-
--group
<group>
¶ Filter roles by <group> (name or ID)
(Deprecated, please use
role assignment list
instead)
-
--user-domain
<user-domain>
¶ Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.
(Deprecated, please use
role assignment list
instead)New in version 3.
-
--group-domain
<group-domain>
¶ Domain the group belongs to (name or ID). This can be used in case collisions between group names exist.
(Deprecated, please use
role assignment list
instead)New in version 3.
-
--project-domain
<project-domain>
¶ Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.
(Deprecated, please use
role assignment list
instead)New in version 3.
-
--inherited
¶
Specifies if the role grant is inheritable to the sub projects.
(Deprecated, please use
role assignment list
instead)New in version 3.
role remove¶
Remove role assignment from domain/project : user/group
os role remove
--domain <domain> | --project <project> [--project-domain <project-domain>]
--user <user> [--user-domain <user-domain>] | --group <group> [--group-domain <group-domain>]
--role-domain <role-domain>
--inherited
<role>
-
--domain
<domain>
¶ Include <domain> (name or ID)
New in version 3.
-
--project
<project>
¶ Include <project> (name or ID)
-
--user
<user>
¶ Include <user> (name or ID)
-
--group
<group>
¶ Include <group> (name or ID)
New in version 3.
-
--user-domain
<user-domain>
¶ Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.
New in version 3.
-
--group-domain
<group-domain>
¶ Domain the group belongs to (name or ID). This can be used in case collisions between group names exist.
New in version 3.
-
--project-domain
<project-domain>
¶ Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.
New in version 3.
-
--inherited
¶
Specifies if the role grant is inheritable to the sub projects.
New in version 3.
-
--role-domain
<role-domain>
¶ Domain the role belongs to (name or ID). This must be specified when the name of a domain specific role is used.
New in version 3.
-
<role>
Role to remove (name or ID)