The following is a sample request for obtaining a token for
user A. The login password of the user is
********** and the domain name is
domain A. The scope of the token is
domain.
Token information stored in the response header:
X-Subject-Token:MIIDkgYJKoZIhvcNAQcCoIIDgzCCA38CAQExDTALBglghkgBZQMEAgEwgXXXXX...
Token information stored in the response body:
diff --git a/docs/iam/api-ref/en-us_topic_0057845597.html b/docs/iam/api-ref/en-us_topic_0057845597.html
index e57b9853..7087500b 100644
--- a/docs/iam/api-ref/en-us_topic_0057845597.html
+++ b/docs/iam/api-ref/en-us_topic_0057845597.html
@@ -21,7 +21,10 @@
String
|
-Project ID.
+ | Project ID. For details about how to obtain the project ID, see Obtaining User, Account, User Group, Project, and Agency Information.
+Ensure that the project is the IAM project that IAM users in the group will be authorized to access and use.
+
|
group_id
@@ -30,7 +33,7 @@
|
String
|
-ID of a user group.
+ | ID of a user group. For details about how to obtain the group ID, see Obtaining User, Account, User Group, Project, and Agency Information.
|
role_id
@@ -39,7 +42,7 @@
|
String
|
-ID of a role.
+ | ID of a role. For details about how to obtain the role ID, see Querying a Role List.
|
@@ -50,7 +53,7 @@
Request Parameters
- Parameters in the request header
Parameter
|
-Mandatory
+ | Mandatory
|
Type
|
diff --git a/docs/iam/api-ref/en-us_topic_0057845623.html b/docs/iam/api-ref/en-us_topic_0057845623.html
index 4b88b9be..6986123d 100644
--- a/docs/iam/api-ref/en-us_topic_0057845623.html
+++ b/docs/iam/api-ref/en-us_topic_0057845623.html
@@ -21,7 +21,7 @@
String
|
-ID of the domain to which a user group belongs.
+ | ID of the domain which a user group belongs to. For details about how to obtain the domain ID, see Obtaining User, Account, User Group, Project, and Agency Information.
|
|---|
group_id
@@ -30,7 +30,7 @@
|
String
|
-ID of a user group.
+ | ID of a user group. For details about how to obtain the group ID, see Obtaining User, Account, User Group, Project, and Agency Information.
|
role_id
@@ -39,7 +39,9 @@
|
String
|
-ID of a role.
+ | ID of a role. For details about how to obtain the role ID, see Querying a Role List.
+ NOTE: To assign a custom policy that contains OBS operations to a user group, create two custom policies with the scope being set to global services and region-specific projects respectively and other parameters being the same, and then attach the two policies to the user group.
+
|
@@ -50,7 +52,7 @@
Request Parameters
- Parameters in the request header
Parameter
|
-Mandatory
+ | Mandatory
|
Type
|
diff --git a/docs/iam/api-ref/en-us_topic_0057845624.html b/docs/iam/api-ref/en-us_topic_0057845624.html
index 56a78034..ed0da521 100644
--- a/docs/iam/api-ref/en-us_topic_0057845624.html
+++ b/docs/iam/api-ref/en-us_topic_0057845624.html
@@ -1,7 +1,7 @@
Obtaining User, Account, User Group, Project, and Agency Information
-Obtaining User, Account, and Project Information
Your username, user ID, account name, account ID, project name, and project ID need to be specified in the URL and request body for calling certain APIs. Obtain these parameters on the My Credentials page.
+
Obtaining User, Account, and Project Information
Your username, user ID, account name, account ID, project name, and project ID need to be specified in the URI and request body for calling certain APIs. Obtain these parameters on the My Credentials page.
- Log in to management console.
- Click the username in the upper right corner, and choose My Credentials.
- On the My Credentials page, view the username, user ID, account name, account ID, project name, and project ID.
Obtaining User Group Information
- Log in to the IAM console, and choose User Groups in the navigation pane.
- Expand the details page of a user group and view the group name and ID.
diff --git a/docs/iam/api-ref/en-us_topic_0057845638.html b/docs/iam/api-ref/en-us_topic_0057845638.html
index c56525e5..19310b25 100644
--- a/docs/iam/api-ref/en-us_topic_0057845638.html
+++ b/docs/iam/api-ref/en-us_topic_0057845638.html
@@ -51,7 +51,7 @@
Password expiration time. The format is password_expires_at=operator:timestamp.
Example:
password_expires_at=lt:2016-12-08T22:02:00Z
-- The value of operator can be lt, lte, gt, gte, eq, or neq.
- lt: The expiration time is earlier than timestamp.
- lte: The expiration time is earlier than or equal to timestamp.
- gt: The expiration time is later than timestamp.
- gte: The expiration time is equal to or later than timestamp.
- eq: The expiration time is equal to timestamp.
- neq: The expiration time is not equal to timestamp.
+- The value of operator can be lt, lte, gt, gte, eq, or neq.
- lt: The expiration time is earlier than timestamp.
- lte: The expiration time is earlier than or equal to timestamp.
- gt: The expiration time is later than timestamp.
- gte: The expiration time is equal to or later than timestamp.
- eq: The expiration time is equal to timestamp.
- neq: The expiration time is not equal to timestamp.
- The timestamp format is YYYY-MM-DDTHH:mm:ssZ.
|
|---|
@@ -130,9 +130,9 @@
- Description for the user format
Parameter
|
-Mandatory
+ | Mandatory
|
-Type
+ | Type
|
Description
|
@@ -210,15 +210,6 @@
Password status. true means that the password needs to be changed, and false means that the password is normal.
|
|---|
-pwd_strength
- |
-No
- |
-String
- |
-Password strength. The value can be high, mid, or low.
- |
-
default_project_id
|
No
@@ -264,7 +255,7 @@
"default_project_id": "263fd9",
"password_expires_at": "2016-12-07T00:00:00.000000Z",
"pwd_status": true,
- "pwd_strength": "high",
+
"last_project_id": ""
}],
"links": {
diff --git a/docs/iam/api-ref/en-us_topic_0064274720.html b/docs/iam/api-ref/en-us_topic_0064274720.html
index 1b13fad1..c919a78d 100644
--- a/docs/iam/api-ref/en-us_topic_0064274720.html
+++ b/docs/iam/api-ref/en-us_topic_0064274720.html
@@ -211,7 +211,7 @@
"id": "domainid"
}
}
-- user.name: Username of the delegating party.
- user.id: User ID of the delegating party.
- domain.name: Name of the domain to which the delegating party belongs.
- domain.id: ID of the domain.
- password_expires_at: Time when the password will expire. null indicates that the password will not expire. This parameter is optional.
+- user.name: Username of the delegating party.
- user.id: User ID of the delegating party.
- domain.name: Name of the domain which the delegating party belongs to.
- domain.id: ID of the domain which the delegating party belongs to.
- password_expires_at: Time when the password will expire. null indicates that the password will not expire. This parameter is optional.
|
domain
@@ -226,7 +226,7 @@
"name" : "domain A",
"id" : "domainid"
}
-- domain.name: Name of the domain to which the delegating party belongs.
- domain.id: ID of the domain.
+- domain.name: Name of the domain which the delegating party belongs to.
- domain.id: ID of the domain which the delegating party belongs to.
|
project
@@ -302,7 +302,7 @@
"id": "ff5ea657f1dd45c4b8f398cab..."
}
}
-- domain.name: Name of the domain to which the delegated party belongs.
- user.name: Username of the delegated party.
+- domain.name: Name of the domain which the delegated party belongs to.
- user.name: Username of the delegated party.
|
diff --git a/docs/iam/api-ref/en-us_topic_0066154565.html b/docs/iam/api-ref/en-us_topic_0066154565.html
index 15a36168..ccb3b2a4 100644
--- a/docs/iam/api-ref/en-us_topic_0066154565.html
+++ b/docs/iam/api-ref/en-us_topic_0066154565.html
@@ -65,7 +65,7 @@
String
|
-Parent project ID to which a project belongs.
+ | Parent project ID which a project belongs to.
|
domain_id
diff --git a/docs/iam/api-ref/en-us_topic_0097949518.html b/docs/iam/api-ref/en-us_topic_0097949518.html
index 5f884164..524db0c3 100644
--- a/docs/iam/api-ref/en-us_topic_0097949518.html
+++ b/docs/iam/api-ref/en-us_topic_0097949518.html
@@ -106,7 +106,7 @@
|
String
|
-domain.name: Name of the domain to which the delegating party belongs.
+ | domain.name: Name of the domain which the delegating party belongs to.
|
duration_seconds
diff --git a/docs/iam/api-ref/iam_01_0007.html b/docs/iam/api-ref/iam_01_0007.html
index 29b52622..e97cbd3d 100644
--- a/docs/iam/api-ref/iam_01_0007.html
+++ b/docs/iam/api-ref/iam_01_0007.html
@@ -9,7 +9,7 @@
- Region
A region contains a physical data center, which is completely isolated to improve fault tolerance and stability. The region that is selected during resource creation cannot be changed after the resource is created. Regions are classified into universal regions and dedicated regions. A universal region provides universal cloud services for common tenants. A dedicated region provides specific services for specific tenants.
- AZ
An AZ is a physical location where resources use independent power supplies and networks. A region contains one or more AZs that are physically isolated but interconnected through internal networks. Because AZs are isolated from each other, any fault that occurs in an AZ will not affect other AZs.
- Project
Projects group and isolate resources (including compute, storage, and network resources) across physical regions. A default project is provided for each region, and subprojects can be created under each default project. Users can be granted permissions to access all resources in a specific project. For more refined access control, create subprojects under a project and create resources in the subprojects. Users can then be assigned permissions to access only specific resources in the subprojects.
-Figure 1 Project isolating model
+Figure 1 Project isolating model
@@ -18,10 +18,3 @@
-
-
\ No newline at end of file
diff --git a/docs/iam/api-ref/iam_01_0008.html b/docs/iam/api-ref/iam_01_0008.html
index e292a8c4..19a2c848 100644
--- a/docs/iam/api-ref/iam_01_0008.html
+++ b/docs/iam/api-ref/iam_01_0008.html
@@ -215,7 +215,7 @@
|
Querying the User Group to Which a User Belongs
|
-Query the information about the groups to which a specified user belongs.
+ | Query the information about the groups which a specified user belongs to.
|
Querying Users in a User Group
@@ -325,6 +325,11 @@
| Provided for the administrator to query permission information.
|
+Querying Permission Assignment Records
+ |
+Query permission assignment records of a specified account.
+ |
+
Querying Role Assignments (Discarded)
|
Query the user groups to which a specified role has been assigned.
diff --git a/docs/iam/api-ref/iam_02_0006.html b/docs/iam/api-ref/iam_02_0006.html
index 65dbbc5c..73a908e0 100644
--- a/docs/iam/api-ref/iam_02_0006.html
+++ b/docs/iam/api-ref/iam_02_0006.html
@@ -966,7 +966,7 @@
|
Login protection has been bound to mfa, the unbinding operation cannot be performed.
|
-Login protection has been enabled and requires virtual MFA device based verification. You cannot unbind the virtual MFA device.
+ | Login protection has been enabled and requires virtual MFA authentication. You cannot unbind the virtual MFA device.
|
Check the request or contact technical support.
|
diff --git a/docs/iam/api-ref/iam_02_0008.html b/docs/iam/api-ref/iam_02_0008.html
index c78f13fd..6e840abd 100644
--- a/docs/iam/api-ref/iam_02_0008.html
+++ b/docs/iam/api-ref/iam_02_0008.html
@@ -53,7 +53,7 @@ POST https://www.example.com/v3/auth/tokens
For details, see "AK/SK-based Authentication" in Authentication.
-The API used to obtain a user token (Obtaining a User Token) does not require authentication. Therefore, only the Content-Type field needs to be added to requests for calling the API. An example of such requests is as follows:
+The API used to obtain a user token (Obtaining a User Token) does not require authentication. Only the Content-Type field needs to be added to requests for calling the API. An example of such requests is as follows:
POST https://www.example.com/v3/auth/tokens
diff --git a/docs/iam/api-ref/iam_02_0011.html b/docs/iam/api-ref/iam_02_0011.html
index 3b92322e..5fee4c6c 100644
--- a/docs/iam/api-ref/iam_02_0011.html
+++ b/docs/iam/api-ref/iam_02_0011.html
@@ -150,7 +150,7 @@
String
|
-ID of the domain to which the custom policy belongs.
+ | ID of the domain which the custom policy belongs to.
|
references
diff --git a/docs/iam/api-ref/iam_02_0020.html b/docs/iam/api-ref/iam_02_0020.html
index 365905b9..8d9a8333 100644
--- a/docs/iam/api-ref/iam_02_0020.html
+++ b/docs/iam/api-ref/iam_02_0020.html
@@ -16,6 +16,14 @@
- Modifying the Login Authentication Policy
+- Querying the ACL for Console Access
+
+- Modifying the ACL for Console Access
+
+- Querying the ACL for API Access
+
+- Modifying the ACL for API Access
+
- Querying MFA Device Information of Users
- Querying the MFA Device Information of a User
diff --git a/docs/iam/api-ref/iam_02_0025.html b/docs/iam/api-ref/iam_02_0025.html
index 019d1fd1..30d6385c 100644
--- a/docs/iam/api-ref/iam_02_0025.html
+++ b/docs/iam/api-ref/iam_02_0025.html
@@ -219,7 +219,7 @@
|
Integer
|
-Session timeout (minutes) that will apply if you or users created using your account do not perform any operations within a specific period.
+ | Session timeout that will apply if you or users created using your account do not perform any operations within a specific period.
|
show_recent_login_info
diff --git a/docs/iam/api-ref/iam_02_0027.html b/docs/iam/api-ref/iam_02_0027.html
new file mode 100644
index 00000000..ad39ccf3
--- /dev/null
+++ b/docs/iam/api-ref/iam_02_0027.html
@@ -0,0 +1,374 @@
+
+
+Modifying the ACL for Console Access
+FunctionThis API is provided for the administrator to modify the ACL for console access.
+
+ URIPUT /v3.0/OS-SECURITYPOLICY/domains/{domain_id}/console-acl-policy
+
+ Table 1 URI parametersParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+domain_id
+ |
+Yes
+ |
+String
+ |
+Domain ID.
+ |
+
+
+
+
+
+ Request Parameters
+ Table 2 Parameters in the request headerParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+X-Auth-Token
+ |
+Yes
+ |
+String
+ |
+Token with Security Administrator permissions.
+ |
+
+
+
+
+
+ Table 3 Parameters in the request bodyParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+console_acl_policy
+ |
+Yes
+ |
+object
+ |
+ACL for console access.
+ |
+
+
+
+
+
+ Table 4 console_acl_policyParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+allow_address_netmasks
+ |
+Yes
+ |
+Array of objects
+ |
+IPv4 CIDR blocks from which console access is allowed.
+ |
+
+allow_ip_ranges
+ |
+Yes
+ |
+Array of objects
+ |
+IP address ranges from which console access is allowed.
+ |
+
+
+
+
+
+ Table 5 allow_address_netmasksParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+address_netmask
+ |
+Yes
+ |
+String
+ |
+IPv4 CIDR block, for example, 192.168.0.1/24.
+ |
+
+description
+ |
+No
+ |
+String
+ |
+Description about the IPv4 CIDR block.
+ |
+
+
+
+
+
+ Table 6 allow_ip_rangesParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+description
+ |
+No
+ |
+String
+ |
+Description about an IP address range.
+ |
+
+ip_range
+ |
+Yes
+ |
+String
+ |
+IP address range, for example, 0.0.0.0-255.255.255.255.
+ |
+
+
+
+
+
+ Response Parameters
+ Table 7 Parameters in the response bodyParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+console_acl_policy
+ |
+object
+ |
+ACL for console access.
+ |
+
+
+
+
+
+ Table 8 console_acl_policyParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+allow_address_netmasks
+ |
+Array of objects
+ |
+IPv4 CIDR blocks from which console access is allowed.
+ |
+
+allow_ip_ranges
+ |
+Array of objects
+ |
+IP address ranges from which console access is allowed.
+ |
+
+
+
+
+
+ Table 9 allow_address_netmasksParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+address_netmask
+ |
+String
+ |
+IPv4 CIDR block, for example, 192.168.0.1/24.
+ |
+
+description
+ |
+String
+ |
+Description about the IPv4 CIDR block.
+ |
+
+
+
+
+
+ Table 10 allow_ip_rangesParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+description
+ |
+String
+ |
+Description about an IP address range.
+ |
+
+ip_range
+ |
+String
+ |
+IP address range, for example, 0.0.0.0-255.255.255.255.
+ |
+
+
+
+
+
+ Example RequestPUT https://sample.domain.com/v3.0/OS-SECURITYPOLICY/domains/{domain_id}/console-acl-policy
+
+{
+ "console_acl_policy" : {
+ "allow_ip_ranges" : [ {
+ "ip_range" : "0.0.0.0-255.255.255.255",
+ "description" : "1"
+ }, {
+ "ip_range" : "0.0.0.0-255.255.255.253",
+ "description" : "12"
+ } ],
+ "allow_address_netmasks" : [ {
+ "address_netmask" : "192.168.0.1/24",
+ "description" : "3"
+ }, {
+ "address_netmask" : "192.168.0.2/23",
+ "description" : "4"
+ } ]
+ }
+}
+
+ Example ResponseStatus code: 200
+ The request is successful.
+ {
+ "console_acl_policy" : {
+ "allow_ip_ranges" : [ {
+ "ip_range" : "0.0.0.0-255.255.255.255",
+ "description" : ""
+ }, {
+ "ip_range" : "0.0.0.0-255.255.255.255",
+ "description" : ""
+ } ],
+ "allow_address_netmasks" : [ {
+ "address_netmask" : "192.168.0.1/24",
+ "description" : ""
+ }, {
+ "address_netmask" : "192.168.0.1/24",
+ "description" : ""
+ } ]
+ }
+}
+
+ Status code: 400
+ The request body is abnormal.
+
+ {
+ "error_msg" : "'%(key)s' is a required property.",
+ "error_code" : "IAM.0072"
+ }
+
+ {
+ "error_msg" : "Invalid input for field '%(key)s'. The value is '%(value)s'.",
+ "error_code" : "IAM.0073"
+ }
+ Status code: 500
+ The system is abnormal.
+ {
+ "error_msg" : "An unexpected error prevented the server from fulfilling your request.",
+ "error_code" : "IAM.0006"
+}
+ Status Codes
+ Status Code
+ |
+Description
+ |
+
|---|
+
+200
+ |
+The request is successful.
+ |
+
+400
+ |
+The request body is abnormal.
+ |
+
+401
+ |
+Authentication failed.
+ |
+
+403
+ |
+Access denied.
+ |
+
+500
+ |
+The system is abnormal.
+ |
+
+
+
+
+
+ Querying the ACL for Console Access
+FunctionThis API is used to query the ACL for console access.
+
+ URIGET /v3.0/OS-SECURITYPOLICY/domains/{domain_id}/console-acl-policy
+
+ Table 1 URI parametersParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+domain_id
+ |
+Yes
+ |
+String
+ |
+Domain ID.
+ |
+
+
+
+
+
+ Request Parameters
+ Table 2 Parameters in the request headerParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+X-Auth-Token
+ |
+Yes
+ |
+String
+ |
+Token with Security Administrator permissions.
+ |
+
+
+
+
+
+ Response Parameters
+ Table 3 Parameters in the response bodyParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+console_acl_policy
+ |
+object
+ |
+ACL for console access.
+ |
+
+
+
+
+
+ Table 4 console_acl_policyParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+allow_address_netmasks
+ |
+Array of objects
+ |
+IPv4 CIDR blocks from which console access is allowed.
+ |
+
+allow_ip_ranges
+ |
+Array of objects
+ |
+IP address ranges from which console access is allowed.
+ |
+
+
+
+
+
+ Table 5 allow_address_netmasksParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+address_netmask
+ |
+String
+ |
+IPv4 CIDR block, for example, 192.168.0.1/24.
+ |
+
+description
+ |
+String
+ |
+Description about the IPv4 CIDR block.
+ |
+
+
+
+
+
+ Table 6 allow_ip_rangesParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+description
+ |
+String
+ |
+Description about an IP address range.
+ |
+
+ip_range
+ |
+String
+ |
+IP address range, for example, 0.0.0.0-255.255.255.255.
+ |
+
+
+
+
+
+ Example RequestGET https://sample.domain.com/v3.0/OS-SECURITYPOLICY/domains/{domain_id}/console-acl-policy
+
+ Example ResponseStatus code: 200
+ The request is successful.
+ {
+ "console_acl_policy" : {
+ "allow_ip_ranges" : [ {
+ "ip_range" : "0.0.0.0-255.255.255.255",
+ "description" : ""
+ }, {
+ "ip_range" : "0.0.0.0-255.255.255.255",
+ "description" : ""
+ } ],
+ "allow_address_netmasks" : [ {
+ "address_netmask" : "192.168.0.1/24",
+ "description" : ""
+ }, {
+ "address_netmask" : "192.168.0.1/24",
+ "description" : ""
+ } ]
+ }
+}
+
+ Status code: 403
+ Access denied.
+
+ {
+ "error_msg" : "You are not authorized to perform the requested action.",
+ "error_code" : "IAM.0002"
+ }
+
+ {
+ "error_msg" : "Policy doesn't allow %(actions)s to be performed.",
+ "error_code" : "IAM.0003"
+ }
+ Status code: 404
+ The requested resource cannot be found.
+ {
+ "error_msg" : "Could not find %(target)s: %(target_id)s.",
+ "error_code" : "IAM.0004"
+}
+ Status code: 500
+ Internal server error.
+ {
+ "error_msg" : "An unexpected error prevented the server from fulfilling your request.",
+ "error_code" : "IAM.0006"
+}
+ Status Codes
+ Status Code
+ |
+Description
+ |
+
|---|
+
+200
+ |
+The request is successful.
+ |
+
+401
+ |
+Authentication failed.
+ |
+
+403
+ |
+Access denied.
+ |
+
+404
+ |
+The requested resource cannot be found.
+ |
+
+500
+ |
+Internal server error.
+ |
+
+
+
+
+
+ Modifying the ACL for API Access
+FunctionThis API is provided for the administrator to modify the ACL for API access.
+
+ URIPUT /v3.0/OS-SECURITYPOLICY/domains/{domain_id}/api-acl-policy
+
+ Table 1 URI parametersParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+domain_id
+ |
+Yes
+ |
+String
+ |
+Domain ID.
+ |
+
+
+
+
+
+ Request Parameters
+ Table 2 Parameters in the request headerParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+X-Auth-Token
+ |
+Yes
+ |
+String
+ |
+Token with Security Administrator permissions.
+ |
+
+
+
+
+
+ Table 3 Parameters in the request bodyParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+api_acl_policy
+ |
+Yes
+ |
+object
+ |
+ACL for API access.
+ |
+
+
+
+
+
+ Table 4 api_acl_policyParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+allow_address_netmasks
+ |
+Yes
+ |
+Array of objects
+ |
+IPv4 CIDR blocks from which API access is allowed.
+ |
+
+allow_ip_ranges
+ |
+Yes
+ |
+Array of objects
+ |
+IP address ranges from which API access is allowed.
+ |
+
+
+
+
+
+ Table 5 allow_address_netmasksParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+address_netmask
+ |
+Yes
+ |
+String
+ |
+IPv4 CIDR block, for example, 192.168.0.1/24.
+ |
+
+description
+ |
+No
+ |
+String
+ |
+Description about the IPv4 CIDR block.
+ |
+
+
+
+
+
+ Table 6 allow_ip_rangesParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+description
+ |
+No
+ |
+String
+ |
+Description about an IP address range.
+ |
+
+ip_range
+ |
+Yes
+ |
+String
+ |
+IP address range, for example, 0.0.0.0-255.255.255.255.
+ |
+
+
+
+
+
+ Response Parameters
+ Table 7 Parameters in the response bodyParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+api_acl_policy
+ |
+object
+ |
+ACL for API access.
+ |
+
+
+
+
+
+ Table 8 api_acl_policyParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+allow_address_netmasks
+ |
+objects
+ |
+IPv4 CIDR blocks from which API access is allowed.
+ |
+
+allow_ip_ranges
+ |
+objects
+ |
+IP address ranges from which API access is allowed.
+ |
+
+
+
+
+
+ Table 9 allow_address_netmasksParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+address_netmask
+ |
+String
+ |
+IPv4 CIDR block, for example, 192.168.0.1/24.
+ |
+
+description
+ |
+String
+ |
+Description about the IPv4 CIDR block.
+ |
+
+
+
+
+
+ Table 10 allow_ip_rangesParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+description
+ |
+String
+ |
+Description about an IP address range.
+ |
+
+ip_range
+ |
+String
+ |
+IP address range, for example, 0.0.0.0-255.255.255.255.
+ |
+
+
+
+
+
+ Example RequestPUT https://sample.domain.com/v3.0/OS-SECURITYPOLICY/domains/{domain_id}/api-acl-policy
+
+{
+ "api_acl_policy" : {
+ "allow_ip_ranges" : [ {
+ "ip_range" : "0.0.0.0-255.255.255.255",
+ "description" : "1"
+ }, {
+ "ip_range" : "0.0.0.0-255.255.255.253",
+ "description" : "12"
+ } ],
+ "allow_address_netmasks" : [ {
+ "address_netmask" : "192.168.0.1/24",
+ "description" : "3"
+ }, {
+ "address_netmask" : "192.168.0.2/23",
+ "description" : "4"
+ } ]
+ }
+}
+
+ Example ResponseStatus code: 200
+ The request is successful.
+ {
+ "api_acl_policy" : {
+ "allow_ip_ranges" : [ {
+ "ip_range" : "0.0.0.0-255.255.255.255",
+ "description" : ""
+ }, {
+ "ip_range" : "0.0.0.0-255.255.255.255",
+ "description" : ""
+ } ],
+ "allow_address_netmasks" : [ {
+ "address_netmask" : "192.168.0.1/24",
+ "description" : ""
+ }, {
+ "address_netmask" : "192.168.0.1/24",
+ "description" : ""
+ } ]
+ }
+}
+
+ Status code: 400
+ The request body is abnormal.
+
+ {
+ "error_msg" : "'%(key)s' is a required property.",
+ "error_code" : "IAM.0072"
+ }
+
+ {
+ "error_msg" : "Invalid input for field '%(key)s'. The value is '%(value)s'.",
+ "error_code" : "IAM.0073"
+ }
+ Status code: 500
+ The system is abnormal.
+ {
+ "error_msg" : "An unexpected error prevented the server from fulfilling your request.",
+ "error_code" : "IAM.0006"
+}
+ Status Codes
+ Status Code
+ |
+Description
+ |
+
|---|
+
+200
+ |
+The request is successful.
+ |
+
+400
+ |
+The request body is abnormal.
+ |
+
+401
+ |
+Authentication failed.
+ |
+
+403
+ |
+Access denied.
+ |
+
+500
+ |
+The system is abnormal.
+ |
+
+
+
+
+
+ Querying the ACL for API Access
+FunctionThis API is used to query the ACL for API access.
+
+ URIGET /v3.0/OS-SECURITYPOLICY/domains/{domain_id}/api-acl-policy
+
+ Table 1 URI parametersParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+domain_id
+ |
+Yes
+ |
+String
+ |
+Domain ID.
+ |
+
+
+
+
+
+ Request Parameters
+ Table 2 Parameters in the request headerParameter
+ |
+Mandatory
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+X-Auth-Token
+ |
+Yes
+ |
+String
+ |
+Token with Security Administrator permissions.
+ |
+
+
+
+
+
+ Response Parameters
+ Table 3 Parameters in the response bodyParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+api_acl_policy
+ |
+object
+ |
+ACL for API access.
+ |
+
+
+
+
+
+ Table 4 api_acl_policyParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+allow_address_netmasks
+ |
+Array of objects
+ |
+IPv4 CIDR blocks from which API access is allowed.
+ |
+
+allow_ip_ranges
+ |
+Array of objects
+ |
+IP address ranges from which API access is allowed.
+ |
+
+
+
+
+
+ Table 5 allow_address_netmasksParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+address_netmask
+ |
+String
+ |
+IPv4 CIDR block, for example, 192.168.0.1/24.
+ |
+
+description
+ |
+String
+ |
+Description about the IPv4 CIDR block.
+ |
+
+
+
+
+
+ Table 6 allow_ip_rangesParameter
+ |
+Type
+ |
+Description
+ |
+
|---|
+
+description
+ |
+String
+ |
+Description about an IP address range.
+ |
+
+ip_range
+ |
+String
+ |
+IP address range, for example, 0.0.0.0-255.255.255.255.
+ |
+
+
+
+
+
+ Example RequestGET https://sample.domain.com/v3.0/OS-SECURITYPOLICY/domains/{domain_id}/api-acl-policy
+
+ Example ResponseStatus code: 200
+ The request is successful.
+ {
+ "api_acl_policy" : {
+ "allow_ip_ranges" : [ {
+ "ip_range" : "0.0.0.0-255.255.255.255",
+ "description" : ""
+ }, {
+ "ip_range" : "0.0.0.0-255.255.255.255",
+ "description" : ""
+ } ],
+ "allow_address_netmasks" : [ {
+ "address_netmask" : "192.168.0.1/24",
+ "description" : ""
+ }, {
+ "address_netmask" : "192.168.0.1/24",
+ "description" : ""
+ } ]
+ }
+}
+
+ Status code: 403
+ Access denied.
+
+ {
+ "error_msg" : "You are not authorized to perform the requested action.",
+ "error_code" : "IAM.0002"
+ }
+
+ {
+ "error_msg" : "Policy doesn't allow %(actions)s to be performed.",
+ "error_code" : "IAM.0003"
+ }
+ Status code: 404
+ The requested resource cannot be found.
+ {
+ "error_msg" : "Could not find %(target)s: %(target_id)s.",
+ "error_code" : "IAM.0004"
+}
+ Status code: 500
+ Internal server error.
+ {
+ "error_msg" : "An unexpected error prevented the server from fulfilling your request.",
+ "error_code" : "IAM.0006"
+}
+ Status Codes
+ Status Code
+ |
+Description
+ |
+
|---|
+
+200
+ |
+The request is successful.
+ |
+
+401
+ |
+Authentication failed.
+ |
+
+403
+ |
+Access denied.
+ |
+
+404
+ |
+The requested resource cannot be found.
+ |
+
+500
+ |
+Internal server error.
+ |
+
+
+
+
+
+ | iam:users:getUser
|
-Querying the User Group to Which a User Belongs
+ |
Querying the User Group Which a User Belongs to
|
GET /v3/users/{user_id}/groups
|
@@ -393,7 +393,7 @@
Permissions Management
+
Permissions Management
Permission
|
API
diff --git a/docs/iam/api-ref/iam_08_0004.html b/docs/iam/api-ref/iam_08_0004.html
index a8b5b9ab..73a7a68a 100644
--- a/docs/iam/api-ref/iam_08_0004.html
+++ b/docs/iam/api-ref/iam_08_0004.html
@@ -99,7 +99,7 @@
| String
|
-ID of the account to which the user belongs.
+ | ID of the account which the user belongs to.
|
|---|
name
diff --git a/docs/iam/api-ref/iam_08_0011.html b/docs/iam/api-ref/iam_08_0011.html
index a16d0d48..ec1c92c7 100644
--- a/docs/iam/api-ref/iam_08_0011.html
+++ b/docs/iam/api-ref/iam_08_0011.html
@@ -109,7 +109,7 @@
|
String
|
-Password of the user. The password must meet the following requirements:
+ | New password of the user. The password must meet the following requirements:
- Can contain 6 to 32 characters. The default minimum password length is 6 characters.
- Must contain at least two of the following character types: uppercase letters, lowercase letters, digits, and special characters.
- Must meet the requirements of the password policy configured on the account settings page.
- Must be different from the old password.
|
@@ -281,7 +281,7 @@
String
|
-ID of the account to which the user belongs.
+ | ID of the account which the user belongs to.
|
enabled
diff --git a/docs/iam/api-ref/iam_08_0015.html b/docs/iam/api-ref/iam_08_0015.html
index 2f258aca..6a5ee16e 100644
--- a/docs/iam/api-ref/iam_08_0015.html
+++ b/docs/iam/api-ref/iam_08_0015.html
@@ -78,7 +78,7 @@
|
String
|
-IAM user name, which consists of 1 to 32 characters. It can contain letters, digits, spaces, hyphens (-), underscores (_), and periods (.) and cannot start with a digit or space.
+ | IAM username, which consists of 1 to 64 characters. It can contain letters (case-sensitive), digits, spaces, hyphens (-), underscores (_), and periods (.), and cannot start with a digit or space.
|
domain_id
@@ -150,7 +150,7 @@
|
String
|
-Type of the IAM user in the external system. The user type can contain a maximum of 64 characters. xuser_type must be used together with xuser_id and will be verified based on xaccount_type and xdomain_type of the same account.
+ | Type of the IAM user in the external system. The user type can contain a maximum of 64 characters. xuser_type must be used together with xuser_id and will be verified based on xaccount_type and xdomain_type of the same account. Currently, the parameter value can only be TenantIdp.
NOTE: An external system refers to an enterprise management system connected to the cloud platform. Parameters xaccount_type, xaccount_id, xdomain_type, xdomain_id, xuser_type, and xuser_id cannot be obtained from the cloud platform. Please contact your enterprise administrator.
|
@@ -161,7 +161,7 @@
String
|
-ID of the IAM user in the external system. The user ID can contain a maximum of 128 characters, and must be used together with xuser_type.
+ | ID of the IAM user in the external system. The user ID can contain a maximum of 128 characters, and must be used together with xuser_type. Due to the latency, the IAM console may not be able to display the external identity ID you have set in real time. Refresh the page later.
NOTE: An external system refers to an enterprise management system connected to the cloud platform. Parameters xaccount_type, xaccount_id, xdomain_type, xdomain_id, xuser_type, and xuser_id cannot be obtained from the cloud platform. Please contact your enterprise administrator.
|
@@ -250,7 +250,7 @@
String
|
-IAM user name, which consists of 1 to 32 characters. It can contain letters, digits, spaces, hyphens (-), underscores (_), and periods (.) and cannot start with a digit or space.
+ | IAM username, which consists of 1 to 32 characters. It can contain letters (case-sensitive), digits, spaces, hyphens (-), underscores (_), and periods (.), and cannot start with a digit or space.
|
phone
@@ -264,14 +264,14 @@
|
Boolean
|
-Whether the IAM user is an administrator.
+ | Indicates whether the IAM user is an administrator.
|
domain_id
|
String
|
-ID of the account to which the IAM user belongs.
+ | ID of the account used to create the IAM user.
|
enabled
@@ -352,6 +352,7 @@
"pwd_status": false,
"xuser_type": "",
"xuser_id": "",
+
"description": "IAMDescription"
}
}
@@ -363,6 +364,7 @@
"pwd_status": false,
"xuser_id": "",
"xuser_type": "",
+
"description": "IAMDescription",
"name": "IAMUser",
"phone": "12345678910",
diff --git a/docs/iam/api-ref/iam_10_0011.html b/docs/iam/api-ref/iam_10_0011.html
index e6f8169f..95d93ffe 100644
--- a/docs/iam/api-ref/iam_10_0011.html
+++ b/docs/iam/api-ref/iam_10_0011.html
@@ -108,7 +108,7 @@
|
String
|
-ID of the domain to which the permission belongs.
+ | ID of the domain which the permission belongs to.
|
flag
|
