Access Control Lists (ACLs)¶

Common ACL Elements¶

The following table describes elements of an ACL that are supported by both Keystone auth and TempAuth. These elements should only be used with X-Container-Read (with the exception of .rlistings, an error will occur if used with X-Container-Write):

Keystone Auth ACL Elements¶

The following table describes elements of an ACL that are supported only by Keystone auth. Keystone auth also supports the elements described in Common ACL Elements.

A token must be included in the request for any of these ACL elements to take effect.

TempAuth ACL Elements¶

The following table describes elements of an ACL that are supported only by TempAuth. TempAuth auth also supports the elements described in Common ACL Elements.

Example: Public Container¶

The following allows anybody to list objects in the www container and download objects. The users do not need to include a token in their request. This ACL is commonly referred to as making the container “public”. It is useful when used with StaticWeb:

swift post www --read-acl ".r:*,.rlistings"

Example: Shared Writable Container¶

The following allows anybody to upload or download objects. However, to download an object, the exact name of the object must be known since users cannot list the objects in the container. The users must include a Keystone token in the upload request. However, it does not need to be scoped to the project associated with the container:

swift post www --read-acl ".r:*" --write-acl "*:*"

Example: Sharing a Container with Project Members¶

The following allows any member of the 77b8f82565f14814bece56e50c4c240f project to upload and download objects or to list the contents of the www container. A token scoped to the 77b8f82565f14814bece56e50c4c240f project must be included in the request:

swift post www --read-acl "77b8f82565f14814bece56e50c4c240f:*" \
               --write-acl "77b8f82565f14814bece56e50c4c240f:*"

Example: Sharing a Container with Users having a specified Role¶

The following allows any user that has been assigned the my_read_access_role on the project within which the www container is stored to download objects or to list the contents of the www container. A user token scoped to the project must be included in the download or list request:

swift post www --read-acl "my_read_access_role"

Example: Allowing a Referrer Domain to Download Objects¶

The following allows any request from the example.com domain to access an object in the container:

swift post www --read-acl ".r:.example.com"

However, the request from the user must contain the appropriate Referer header as shown in this example request:

curl -i $publicURL/www/document --head -H "Referer: http://www.example.com/index.html"

Example: Sharing a Container with Another User¶

Sharing a Container with another user requires the knowledge of few parameters regarding the users.

The sharing user must know:

• the OpenStack user id of the other user

The sharing user must communicate to the other user:

• the name of the shared container
• the OS_STORAGE_URL

Usually the OS_STORAGE_URL is not exposed directly to the user because the swift client by default automatically construct the OS_STORAGE_URL based on the User credential.

We assume that in the current directory there are the two client environment script for the two users sharing.openrc and other.openrc.

The sharing.openrc should be similar to the following:

export OS_USERNAME=sharing
# WARNING: Save the password in clear text only for testing purposes
export OS_PASSWORD=password
export OS_TENANT_NAME=projectName
export OS_AUTH_URL=https://identityHost:portNumber/v2.0
# The following lines can be omitted
export OS_TENANT_ID=tenantIDString
export OS_REGION_NAME=regionName
export OS_CACERT=/path/to/cacertFile

The other.openrc should be similar to the following:

export OS_USERNAME=other
# WARNING: Save the password in clear text only for testing purposes
export OS_PASSWORD=otherPassword
export OS_TENANT_NAME=otherProjectName
export OS_AUTH_URL=https://identityHost:portNumber/v2.0
# The following lines can be omitted
export OS_TENANT_ID=tenantIDString
export OS_REGION_NAME=regionName
export OS_CACERT=/path/to/cacertFile

For more information see using the OpenStack RC file

First we figure out the other user id:

. other.openrc
OUID="$(openstack user show --format json "${OS_USERNAME}" | jq -r .id)"

or alternatively:

. other.openrc
OUID="$(openstack token issue -f json | jq -r .user_id)"

Then we figure out the storage url of the sharing user:

sharing.openrc
SURL="$(swift auth | awk -F = '/OS_STORAGE_URL/ {print $2}')"

Running as the sharing user create a shared container named shared in read-only mode with the other user using the proper acl:

sharing.openrc
swift post --read-acl "*:${OUID}" shared

Running as the sharing user create and upload a test file:

touch void
swift upload shared void

Running as the other user list the files in the shared container:

other.openrc
swift --os-storage-url="${SURL}" list shared

Running as the other user download the shared container in the /tmp directory:

cd /tmp
swift --os-storage-url="${SURL}" download shared