Identity v3 Commands¶

access rule¶

Access rules are fine-grained permissions for application credentials. An access rule comprises of a service type, a request path, and a request method. Access rules may only be created as attributes of application credentials, but they may be viewed and deleted independently.

access rule delete¶

Delete access rule(s)

openstack access rule delete <access-rule> [<access-rule> ...]

access-rule¶: Access rule ID(s) to delete

access rule list¶

List access rules

openstack access rule list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--user <user>]
    [--user-domain <user-domain>]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--user <user>¶: User whose access rules to list (name or ID)

--user-domain <user-domain>¶: Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

access rule show¶

Display access rule details

openstack access rule show <access-rule>

access-rule¶: Access rule ID to display

access token¶

An access token is used by the Identity service’s OS-OAUTH1 extension. It is used by the consumer to request new Identity API tokens on behalf of the authorizing user.

access token create¶

Create an access token

openstack access token create
    --consumer-key <consumer-key>
    --consumer-secret <consumer-secret>
    --request-key <request-key>
    --request-secret <request-secret>
    --verifier <verifier>

--consumer-key <consumer-key>¶: Consumer key (required)

--consumer-secret <consumer-secret>¶: Consumer secret (required)

--request-key <request-key>¶: Request token to exchange for access token (required)

--request-secret <request-secret>¶: Secret associated with <request-key> (required)

--verifier <verifier>¶: Verifier associated with <request-key> (required)

application credential¶

With application credentials, a user can grant their applications limited access to their cloud resources. Once created, users can authenticate with an application credential by using the v3applicationcredential auth type.

application credential create¶

Create new application credential

openstack application credential create
    [--secret <secret>]
    [--role <role>]
    [--expiration <expiration>]
    [--description <description>]
    [--unrestricted]
    [--restricted]
    [--access-rules <access-rules>]
    <name>

--secret <secret>¶: Secret to use for authentication (if not provided, one will be generated)

--role <role>¶: Roles to authorize (name or ID) (repeat option to set multiple values)

--expiration <expiration>¶: Sets an expiration date for the application credential, format of YYYY-mm-ddTHH:MM:SS (if not provided, the application credential will not expire)

--description <description>¶: Application credential description

--unrestricted¶: Enable application credential to create and delete other application credentials and trusts (this is potentially dangerous behavior and is disabled by default)

--restricted¶: Prohibit application credential from creating and deleting other application credentials and trusts (this is the default behavior)

--access-rules <access-rules>¶: Either a string or file path containing a JSON-formatted list of access rules, each containing a request method, path, and service, for example ‘[{“method”: “GET”, “path”: “/v2.1/servers”, “service”: “compute”}]’

name¶: Name of the application credential

application credential delete¶

Delete application credentials(s)

openstack application credential delete
    <application-credential>
    [<application-credential> ...]

application-credential¶: Application credentials(s) to delete (name or ID)

application credential list¶

List application credentials

openstack application credential list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--user <user>]
    [--user-domain <user-domain>]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--user <user>¶: User whose application credentials to list (name or ID)

--user-domain <user-domain>¶: Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

application credential show¶

Display application credential details

openstack application credential show <application-credential>

application-credential¶: Application credential to display (name or ID)

catalog¶

A catalog lists OpenStack services that are available on the cloud.

catalog list¶

List services in the service catalog

openstack catalog list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

catalog show¶

Display service catalog details

openstack catalog show <service>

service¶: Service to display (type or name)

consumer¶

An consumer is used by the Identity service’s OS-OAUTH1 extension. It is used to create a request token and access token.

consumer create¶

Create new consumer

openstack consumer create [--description <description>]

--description <description>¶: New consumer description

consumer delete¶

Delete consumer(s)

openstack consumer delete <consumer> [<consumer> ...]

consumer¶: Consumer(s) to delete

consumer list¶

List consumers

openstack consumer list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

consumer set¶

Set consumer properties

openstack consumer set [--description <description>] <consumer>

--description <description>¶: New consumer description

consumer¶: Consumer to modify

consumer show¶

Display consumer details

openstack consumer show <consumer>

consumer¶: Consumer to display

credential¶

credential create¶

Create new credential

openstack credential create
    [--type <type>]
    [--project <project>]
    <user>
    <data>

--type <type>¶: New credential type: cert, ec2, totp and so on

--project <project>¶: Project which limits the scope of the credential (name or ID)

user¶: user that owns the credential (name or ID)

data¶: New credential data

credential delete¶

Delete credential(s)

openstack credential delete <credential-id> [<credential-id> ...]

credential-id¶: ID of credential(s) to delete

credential list¶

List credentials

openstack credential list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--user <user>]
    [--user-domain <user-domain>]
    [--type <type>]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--user <user>¶: Filter credentials by <user> (name or ID)

--user-domain <user-domain>¶: Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

--type <type>¶: Filter credentials by type: cert, ec2, totp and so on

credential set¶

Set credential properties

openstack credential set
    --user <user>
    --type <type>
    --data <data>
    [--project <project>]
    <credential-id>

--user <user>¶: User that owns the credential (name or ID)

--type <type>¶: New credential type: cert, ec2, totp and so on

--data <data>¶: New credential data

--project <project>¶: Project which limits the scope of the credential (name or ID)

credential-id¶: ID of credential to change

credential show¶

Display credential details

openstack credential show <credential-id>

credential-id¶: ID of credential to display

domain¶

A domain is a collection of users, groups, and projects. Each group and project is owned by exactly one domain.

domain create¶

Create new domain

openstack domain create
    [--description <description>]
    [--enable | --disable]
    [--or-show]
    [--immutable | --no-immutable]
    <domain-name>

--description <description>¶: New domain description

--enable¶: Enable domain (default)

--disable¶: Disable domain

--or-show¶: Return existing domain

--immutable¶: Make resource immutable. An immutable project may not be deleted or modified except to remove the immutable flag

--no-immutable¶: Make resource mutable (default)

domain-name¶: New domain name

domain delete¶

Delete domain(s)

openstack domain delete <domain> [<domain> ...]

domain¶: Domain(s) to delete (name or ID)

domain list¶

List domains

openstack domain list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--name <name>]
    [--enabled]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--name <name>¶: The domain name

--enabled¶: The domains that are enabled will be returned

domain set¶

Set domain properties

openstack domain set
    [--name <name>]
    [--description <description>]
    [--enable | --disable]
    [--immutable | --no-immutable]
    <domain>

--name <name>¶: New domain name

--description <description>¶: New domain description

--enable¶: Enable domain

--disable¶: Disable domain

--immutable¶: Make resource immutable. An immutable project may not be deleted or modified except to remove the immutable flag

--no-immutable¶: Make resource mutable (default)

domain¶: Domain to modify (name or ID)

domain show¶

Display domain details

openstack domain show <domain>

domain¶: Domain to display (name or ID)

ec2 credentials (Identity v3)¶

ec2 credentials create¶

Create EC2 credentials

openstack ec2 credentials create
    [--project <project>]
    [--user <user>]
    [--user-domain <user-domain>]
    [--project-domain <project-domain>]

--project <project>¶: Create credentials in project (name or ID; default: current authenticated project)

--user <user>¶: Create credentials for user (name or ID; default: current authenticated user)

--user-domain <user-domain>¶: Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

--project-domain <project-domain>¶: Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

ec2 credentials delete¶

Delete EC2 credentials

openstack ec2 credentials delete
    [--user <user>]
    [--user-domain <user-domain>]
    <access-key>
    [<access-key> ...]

--user <user>¶: Delete credentials for user (name or ID)

--user-domain <user-domain>¶: Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

access-key¶: Credentials access key(s)

ec2 credentials list¶

List EC2 credentials

openstack ec2 credentials list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--user <user>]
    [--user-domain <user-domain>]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--user <user>¶: Filter list by user (name or ID)

--user-domain <user-domain>¶: Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

ec2 credentials show¶

Display EC2 credentials details

openstack ec2 credentials show
    [--user <user>]
    [--user-domain <user-domain>]
    <access-key>

--user <user>¶: Show credentials for user (name or ID)

--user-domain <user-domain>¶: Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

access-key¶: Credentials access key

endpoint group¶

A endpoint group is used to create groups of endpoints that then can be used to filter the endpoints that are available to a project.

endpoint group add project¶

Add a project to an endpoint group

openstack endpoint group add project
    [--project-domain <project-domain>]
    <endpoint-group>
    <project>

--project-domain <project-domain>¶: Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

endpoint-group¶: Endpoint group (name or ID)

project¶: Project to associate (name or ID)

endpoint group create¶

Create new endpoint group

openstack endpoint group create
    [--description DESCRIPTION]
    <name>
    <filename>

--description <DESCRIPTION>¶: Description of the endpoint group

name¶: Name of the endpoint group

filename¶: Filename that contains a new set of filters

endpoint group delete¶

Delete endpoint group(s)

openstack endpoint group delete <endpoint-group> [<endpoint-group> ...]

endpoint-group¶: Endpoint group(s) to delete (name or ID)

endpoint group list¶

List endpoint groups

openstack endpoint group list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--endpointgroup <endpoint-group> | --project <project>]
    [--domain <domain>]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--endpointgroup <endpoint-group>¶: Endpoint Group (name or ID)

--project <project>¶: Project (name or ID)

--domain <domain>¶: Domain owning <project> (name or ID)

endpoint group remove project¶

Remove project from endpoint group

openstack endpoint group remove project
    [--project-domain <project-domain>]
    <endpoint-group>
    <project>

--project-domain <project-domain>¶: Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

endpoint-group¶: Endpoint group (name or ID)

project¶: Project to remove (name or ID)

endpoint group set¶

Set endpoint group properties

openstack endpoint group set
    [--name <name>]
    [--filters <filename>]
    [--description <description>]
    <endpoint-group>

--name <name>¶: New endpoint group name

--filters <filename>¶: Filename that contains a new set of filters

--description <description>¶: New endpoint group description

endpoint-group¶: Endpoint Group to modify (name or ID)

endpoint group show¶

Display endpoint group details

openstack endpoint group show <endpointgroup>

endpointgroup¶: Endpoint group (name or ID)

endpoint (Identity v3)¶

endpoint add project¶

Associate a project to an endpoint

openstack endpoint add project
    [--project-domain <project-domain>]
    <endpoint>
    <project>

--project-domain <project-domain>¶: Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

endpoint¶: Endpoint to associate with specified project (name or ID)

project¶: Project to associate with specified endpoint name or ID)

endpoint create¶

Create new endpoint

openstack endpoint create
    [--region <region-id>]
    [--enable | --disable]
    <service>
    <interface>
    <url>

--region <region-id>¶: New endpoint region ID

--enable¶: Enable endpoint (default)

--disable¶: Disable endpoint

service¶: Service to be associated with new endpoint (name or ID)

interface¶: New endpoint interface type (admin, public or internal)

url¶: New endpoint URL

endpoint delete¶

Delete endpoint(s)

openstack endpoint delete <endpoint-id> [<endpoint-id> ...]

endpoint-id¶: Endpoint(s) to delete (ID only)

endpoint list¶

List endpoints

openstack endpoint list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--service <service>]
    [--interface <interface>]
    [--region <region-id>]
    [--endpoint <endpoint-group> | --project <project>]
    [--project-domain <project-domain>]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--service <service>¶: Filter by service (type, name or ID)

--interface <interface>¶: Filter by interface type (admin, public or internal)

--region <region-id>¶: Filter by region ID

--endpoint <endpoint-group>¶: Endpoint to list filters

--project <project>¶: Project to list filters (name or ID)

--project-domain <project-domain>¶: Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

endpoint remove project¶

Dissociate a project from an endpoint

openstack endpoint remove project
    [--project-domain <project-domain>]
    <endpoint>
    <project>

--project-domain <project-domain>¶: Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

endpoint¶: Endpoint to dissociate from specified project (name or ID)

project¶: Project to dissociate from specified endpoint name or ID)

endpoint set¶

Set endpoint properties

openstack endpoint set
    [--region <region-id>]
    [--interface <interface>]
    [--url <url>]
    [--service <service>]
    [--enable | --disable]
    <endpoint-id>

--region <region-id>¶: New endpoint region ID

--interface <interface>¶: New endpoint interface type (admin, public or internal)

--url <url>¶: New endpoint URL

--service <service>¶: New endpoint service (name or ID)

--enable¶: Enable endpoint

--disable¶: Disable endpoint

endpoint-id¶: Endpoint to modify (ID only)

endpoint show¶

Display endpoint details

openstack endpoint show <endpoint>

endpoint¶: Endpoint to display (endpoint ID, service ID, service name, service type)

federation domain/project¶

federation domain list¶

List accessible domains

openstack federation domain list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

federation project list¶

List accessible projects

openstack federation project list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

federation protocol¶

A federation protocol is used by the Identity service’s OS-FEDERATION extension. It is used by identity providers and mappings.

federation protocol create¶

Create new federation protocol

openstack federation protocol create
    --identity-provider <identity-provider>
    --mapping <mapping>
    <name>

--identity-provider <identity-provider>¶: Identity provider that will support the new federation protocol (name or ID) (required)

--mapping <mapping>¶: Mapping that is to be used (name or ID) (required)

name¶: New federation protocol name (must be unique per identity provider)

federation protocol delete¶

Delete federation protocol(s)

openstack federation protocol delete
    --identity-provider <identity-provider>
    <federation-protocol>
    [<federation-protocol> ...]

--identity-provider <identity-provider>¶: Identity provider that supports <federation-protocol> (name or ID) (required)

federation-protocol¶: Federation protocol(s) to delete (name or ID)

federation protocol list¶

List federation protocols

openstack federation protocol list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    --identity-provider <identity-provider>

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--identity-provider <identity-provider>¶: Identity provider to list (name or ID) (required)

federation protocol set¶

Set federation protocol properties

openstack federation protocol set
    --identity-provider <identity-provider>
    [--mapping <mapping>]
    <name>

--identity-provider <identity-provider>¶: Identity provider that supports <federation-protocol> (name or ID) (required)

--mapping <mapping>¶: Mapping that is to be used (name or ID)

name¶: Federation protocol to modify (name or ID)

federation protocol show¶

Display federation protocol details

openstack federation protocol show
    --identity-provider <identity-provider>
    <federation-protocol>

--identity-provider <identity-provider>¶: Identity provider that supports <federation-protocol> (name or ID) (required)

federation-protocol¶: Federation protocol to display (name or ID)

group¶

group add user¶

Add user to group

openstack group add user
    [--group-domain <group-domain>]
    [--user-domain <user-domain>]
    <group>
    <user>
    [<user> ...]

--group-domain <group-domain>¶: Domain the group belongs to (name or ID). This can be used in case collisions between group names exist.

--user-domain <user-domain>¶: Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

group¶: Group to contain <user> (name or ID)

user¶: User(s) to add to <group> (name or ID) (repeat option to add multiple users)

group contains user¶

Check user membership in group

openstack group contains user
    [--group-domain <group-domain>]
    [--user-domain <user-domain>]
    <group>
    <user>

--group-domain <group-domain>¶: Domain the group belongs to (name or ID). This can be used in case collisions between group names exist.

--user-domain <user-domain>¶: Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

group¶: Group to check (name or ID)

user¶: User to check (name or ID)

group create¶

Create new group

openstack group create
    [--domain <domain>]
    [--description <description>]
    [--or-show]
    <group-name>

--domain <domain>¶: Domain to contain new group (name or ID)

--description <description>¶: New group description

--or-show¶: Return existing group

group-name¶: New group name

group delete¶

Delete group(s)

openstack group delete [--domain <domain>] <group> [<group> ...]

--domain <domain>¶: Domain containing group(s) (name or ID)

group¶: Group(s) to delete (name or ID)

group list¶

List groups

openstack group list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--domain <domain>]
    [--user <user>]
    [--user-domain <user-domain>]
    [--long]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--domain <domain>¶: Filter group list by <domain> (name or ID)

--user <user>¶: Filter group list by <user> (name or ID)

--user-domain <user-domain>¶: Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

--long¶: List additional fields in output

group remove user¶

Remove user from group

openstack group remove user
    [--group-domain <group-domain>]
    [--user-domain <user-domain>]
    <group>
    <user>
    [<user> ...]

--group-domain <group-domain>¶: Domain the group belongs to (name or ID). This can be used in case collisions between group names exist.

--user-domain <user-domain>¶: Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

group¶: Group containing <user> (name or ID)

user¶: User(s) to remove from <group> (name or ID) (repeat option to remove multiple users)

group set¶

Set group properties

openstack group set
    [--domain <domain>]
    [--name <name>]
    [--description <description>]
    <group>

--domain <domain>¶: Domain containing <group> (name or ID)

--name <name>¶: New group name

--description <description>¶: New group description

group¶: Group to modify (name or ID)

group show¶

Display group details

openstack group show [--domain <domain>] <group>

--domain <domain>¶: Domain containing <group> (name or ID)

group¶: Group to display (name or ID)

identity provider¶

An identity provider is used by the Identity service’s OS-FEDERATION extension. It is used by federation protocols and mappings.

identity provider create¶

Create new identity provider

openstack identity provider create
    [--remote-id <remote-id> | --remote-id-file <file-name>]
    [--description <description>]
    [--domain <domain>]
    [--authorization-ttl <authorization-ttl>]
    [--enable | --disable]
    <name>

--remote-id <remote-id>¶: Remote IDs to associate with the Identity Provider (repeat option to provide multiple values)

--remote-id-file <file-name>¶: Name of a file that contains many remote IDs to associate with the identity provider, one per line

--description <description>¶: New identity provider description

--domain <domain>¶: Domain to associate with the identity provider. If not specified, a domain will be created automatically. (Name or ID)

--authorization-ttl <authorization-ttl>¶: Time to keep the role assignments for users authenticating via this identity provider. When not provided, global default configured in the Identity service will be used. Available since Identity API version 3.14 (Ussuri).

--enable¶: Enable identity provider (default)

--disable¶: Disable the identity provider

name¶: New identity provider name (must be unique)

identity provider delete¶

Delete identity provider(s)

openstack identity provider delete
    <identity-provider>
    [<identity-provider> ...]

identity-provider¶: Identity provider(s) to delete

identity provider list¶

List identity providers

openstack identity provider list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--id <id>]
    [--enabled]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--id <id>¶: Filter identity providers by ID

--enabled¶: List only enabled identity providers

identity provider set¶

Set identity provider properties

openstack identity provider set
    [--description <description>]
    [--remote-id <remote-id> | --remote-id-file <file-name>]
    [--authorization-ttl <authorization-ttl>]
    [--enable | --disable]
    <identity-provider>

--description <description>¶: Set identity provider description

--remote-id <remote-id>¶: Remote IDs to associate with the Identity Provider (repeat option to provide multiple values)

--remote-id-file <file-name>¶: Name of a file that contains many remote IDs to associate with the identity provider, one per line

--authorization-ttl <authorization-ttl>¶: Time to keep the role assignments for users authenticating via this identity provider. Available since Identity API version 3.14 (Ussuri).

--enable¶: Enable the identity provider

--disable¶: Disable the identity provider

identity-provider¶: Identity provider to modify

identity provider show¶

Display identity provider details

openstack identity provider show <identity-provider>

identity-provider¶: Identity provider to display

implied role¶

implied role create¶

Creates an association between prior and implied roles

openstack implied role create --implied-role <role> <role>

--implied-role <role>¶: <role> (name or ID) implied by another role

role¶: Role (name or ID) that implies another role

implied role delete¶

Deletes an association between prior and implied roles

openstack implied role delete --implied-role <role> <role>

--implied-role <role>¶: <role> (name or ID) implied by another role

role¶: Role (name or ID) that implies another role

implied role list¶

List implied roles

openstack implied role list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

limit¶

Limits are used to specify project-specific limits thresholds of resources.

limit create¶

Create a limit

openstack limit create
    [--description <description>]
    [--region <region>]
    --project <project>
    [--project-domain <project-domain>]
    --service <service>
    --resource-limit <resource-limit>
    <resource-name>

--description <description>¶: Description of the limit

--region <region>¶: Region for the limit to affect.

--project <project>¶: Project to associate the resource limit to

--project-domain <project-domain>¶: Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

--service <service>¶: Service responsible for the resource to limit

--resource-limit <resource-limit>¶: The resource limit for the project to assume

resource-name¶: The name of the resource to limit

limit delete¶

Delete a limit

openstack limit delete <limit-id> [<limit-id> ...]

limit-id¶: Limit to delete (ID) (repeat option to remove multiple limits)

limit list¶

List limits

openstack limit list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--service <service>]
    [--resource-name <resource-name>]
    [--region <region>]
    [--project <project>]
    [--project-domain <project-domain>]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--service <service>¶: Service responsible for the resource to limit

--resource-name <resource-name>¶: The name of the resource to limit

--region <region>¶: Region for the registered limit to affect.

--project <project>¶: List resource limits associated with project

--project-domain <project-domain>¶: Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

limit set¶

Update information about a limit

openstack limit set
    [--description <description>]
    [--resource-limit <resource-limit>]
    <limit-id>

--description <description>¶: Description of the limit

--resource-limit <resource-limit>¶: The resource limit for the project to assume

limit-id¶: Limit to update (ID)

limit show¶

Display limit details

openstack limit show <limit-id>

limit-id¶: Limit to display (ID)

mapping¶

A mapping is used by the Identity service’s OS-FEDERATION extension. It is used by federation protocols and identity providers.

mapping create¶

Create new mapping

openstack mapping create
    --rules <filename>
    [--schema-version <schema_version>]
    <name>

--rules <filename>¶: Filename that contains a set of mapping rules (required)

--schema-version <schema_version>¶: The federated attribute mapping schema version. The default value on the client side is ‘None’; however, that will lead the backend to set the default according to ‘attribute_mapping_default_schema_version’ option.

name¶: New mapping name (must be unique)

mapping delete¶

Delete mapping(s)

openstack mapping delete <mapping> [<mapping> ...]

mapping¶: Mapping(s) to delete

mapping list¶

List mappings

openstack mapping list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

mapping set¶

Set mapping properties

openstack mapping set
    [--rules <filename>]
    [--schema-version <schema_version>]
    <name>

--rules <filename>¶: Filename that contains a new set of mapping rules

--schema-version <schema_version>¶: The federated attribute mapping schema version. The default value on the client side is ‘None’; however, that will lead the backend to set the default according to ‘attribute_mapping_default_schema_version’ option.

name¶: Mapping to modify

mapping show¶

Display mapping details

openstack mapping show <mapping>

mapping¶: Mapping to display

policy¶

A policy is an arbitrarily serialized policy engine rule set to be consumed by a remote service.

policy create¶

Create new policy

openstack policy create [--type <type>] <filename>

--type <type>¶: New MIME type of the policy rules file (defaults to application/json)

filename¶: New serialized policy rules file

policy delete¶

Delete policy(s)

openstack policy delete <policy> [<policy> ...]

policy¶: Policy(s) to delete

policy list¶

List policies

openstack policy list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--long]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--long¶: List additional fields in output

policy set¶

Set policy properties

openstack policy set [--type <type>] [--rules <filename>] <policy>

--type <type>¶: New MIME type of the policy rules file

--rules <filename>¶: New serialized policy rules file

policy¶: Policy to modify

policy show¶

Display policy details

openstack policy show <policy>

policy¶: Policy to display

project (Identity v3)¶

project create¶

Create new project

openstack project create
    [--domain <domain>]
    [--parent <project>]
    [--description <description>]
    [--enable | --disable]
    [--property <key=value>]
    [--or-show]
    [--immutable | --no-immutable]
    [--tag <tag>]
    <project-name>

--domain <domain>¶: Domain owning the project (name or ID)

--parent <project>¶: Parent of the project (name or ID)

--description <description>¶: Project description

--enable¶: Enable project

--disable¶: Disable project

--property <key=value>¶: Add a property to <name> (repeat option to set multiple properties)

--or-show¶: Return existing project

--immutable¶: Make resource immutable. An immutable project may not be deleted or modified except to remove the immutable flag

--no-immutable¶: Make resource mutable (default)

--tag <tag>¶: Tag to be added to the project (repeat option to set multiple tags)

project-name¶: New project name

project delete¶

Delete project(s). This command will remove specified existing project(s) if an active user is authorized to do this. If there are resources managed by other services (for example, Nova, Neutron, Cinder) associated with specified project(s), delete operation will proceed regardless.

openstack project delete [--domain <domain>] <project> [<project> ...]

--domain <domain>¶: Domain owning <project> (name or ID)

project¶: Project(s) to delete (name or ID)

project list¶

List projects

openstack project list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--domain <domain>]
    [--parent <parent>]
    [--user <user>]
    [--my-projects]
    [--long]
    [--sort <key>[:<direction>]]
    [--enabled]
    [--disabled]
    [--tags <tag>[,<tag>,...]]
    [--tags-any <tag>[,<tag>,...]]
    [--not-tags <tag>[,<tag>,...]]
    [--not-tags-any <tag>[,<tag>,...]]
    [--limit <limit>]
    [--marker <marker>]
    [--max-items <max-items>]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--domain <domain>¶: Filter projects by <domain> (name or ID)

--parent <parent>¶: Filter projects whose parent is <parent> (name or ID)

--user <user>¶: Filter projects by <user> (name or ID)

--my-projects¶: List projects for the authenticated user. Supersedes other filters.

--long¶: List additional fields in output

--sort <key>[:<direction>]¶: Sort output by selected keys and directions (asc or desc) (default: asc), repeat this option to specify multiple keys and directions.

--enabled¶: List only enabled projects

--disabled¶: List only disabled projects

--tags <tag>[,<tag>,...]¶: List projects which have all given tag(s) (Comma-separated list of tags)

--tags-any <tag>[,<tag>,...]¶: List projects which have any given tag(s) (Comma-separated list of tags)

--not-tags <tag>[,<tag>,...]¶: Exclude projects which have all given tag(s) (Comma-separated list of tags)

--not-tags-any <tag>[,<tag>,...]¶: Exclude projects which have any given tag(s) (Comma-separated list of tags)

--limit <limit>¶: The maximum number of entries to return per page. If the value exceeds the server-defined maximum, then the server-defined value will be used. Note that this controls the page size, not the total number of entries returned. Use –max-items to limit the total number of entries returned.

--marker <marker>¶: The first position in the collection to return results from. This should be a value that was returned in a previous request.

--max-items <max-items>¶: The maximum number of entries to return in total, paging through multiple requests if needed. Use –limit to control the page size.

project set¶

Set project properties

openstack project set
    [--name <name>]
    [--domain <domain>]
    [--description <description>]
    [--enable | --disable]
    [--property <key=value>]
    [--immutable | --no-immutable]
    [--tag <tag>]
    [--clear-tags]
    [--remove-tag <tag>]
    <project>

--name <name>¶: Set project name

--domain <domain>¶: Domain owning <project> (name or ID)

--description <description>¶: Set project description

--enable¶: Enable project

--disable¶: Disable project

--property <key=value>¶: Set a property on <project> (repeat option to set multiple properties)

--immutable¶: Make resource immutable. An immutable project may not be deleted or modified except to remove the immutable flag

--no-immutable¶: Make resource mutable (default)

--tag <tag>¶: Tag to be added to the project (repeat option to set multiple tags)

--clear-tags¶: Clear tags associated with the project. Specify both –tag and –clear-tags to overwrite current tags

--remove-tag <tag>¶: Tag to be deleted from the project (repeat option to delete multiple tags)

project¶: Project to modify (name or ID)

project show¶

Display project details

openstack project show
    [--domain <domain>]
    [--parents]
    [--children]
    <project>

--domain <domain>¶: Domain owning <project> (name or ID)

--parents¶: Show the project’s parents as a list

--children¶: Show project’s subtree (children) as a list

project¶: Project to display (name or ID)

region¶

A region is a general division of an OpenStack deployment. You can associate zero or more sub-regions with a region to create a tree-like structured hierarchy.

region create¶

Create new region

openstack region create
    [--parent-region <region-id>]
    [--description <description>]
    <region-id>

--parent-region <region-id>¶: Parent region ID

--description <description>¶: New region description

region-id¶: New region ID

region delete¶

Delete region(s)

openstack region delete <region-id> [<region-id> ...]

region-id¶: Region ID(s) to delete

region list¶

List regions

openstack region list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--parent-region <region-id>]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--parent-region <region-id>¶: Filter by parent region ID

region set¶

Set region properties

openstack region set
    [--parent-region <region-id>]
    [--description <description>]
    <region-id>

--parent-region <region-id>¶: New parent region ID

--description <description>¶: New region description

region-id¶: Region to modify

region show¶

Display region details

openstack region show <region-id>

region-id¶: Region to display

registered limit¶

Registered limits are used to define default limits for resources within a deployment.

registered limit create¶

Create a registered limit

openstack registered limit create
    [--description <description>]
    [--region <region>]
    --service <service>
    --default-limit <default-limit>
    <resource-name>

--description <description>¶: Description of the registered limit

--region <region>¶: Region for the registered limit to affect

--service <service>¶: Service responsible for the resource to limit (required) (name or ID)

--default-limit <default-limit>¶: The default limit for the resources to assume (required)

resource-name¶: The name of the resource to limit

registered limit delete¶

Delete a registered limit

openstack registered limit delete
    <registered-limits>
    [<registered-limits> ...]

registered-limits¶: Registered limit(s) to delete (ID) (repeat option to remove multiple registered limits)

registered limit list¶

List registered limits

openstack registered limit list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--service <service>]
    [--resource-name <resource-name>]
    [--region <region>]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--service <service>¶: Service responsible for the resource to limit (name or ID)

--resource-name <resource-name>¶: The name of the resource to limit

--region <region>¶: Region for the limit to affect.

registered limit set¶

Update information about a registered limit

openstack registered limit set
    [--service <service>]
    [--resource-name <resource-name>]
    [--default-limit <default-limit>]
    [--description <description>]
    [--region <region>]
    <registered-limit-id>

--service <service>¶: Service to be updated responsible for the resource to limit (name or ID). Either –service, –resource-name or –region must be different than existing value otherwise it will be duplicate entry

--resource-name <resource-name>¶: Resource to be updated responsible for the resource to limit. Either –service, –resource-name or –region must be different than existing value otherwise it will be duplicate entry

--default-limit <default-limit>¶: The default limit for the resources to assume

--description <description>¶: Description to update of the registered limit

--region <region>¶: Region for the registered limit to affect. Either –service, –resource-name or –region must be different than existing value otherwise it will be duplicate entry

registered-limit-id¶: Registered limit to update (ID)

registered limit show¶

Display registered limit details

openstack registered limit show <registered-limit-id>

registered-limit-id¶: Registered limit to display (ID)

request token¶

A request token is used by the Identity service’s OS-OAUTH1 extension. It is used by the consumer to request access tokens.

request token authorize¶

Authorize a request token

openstack request token authorize
    --request-key <request-key>
    --role <role>

--request-key <request-key>¶: Request token to authorize (ID only) (required)

--role <role>¶: Roles to authorize (name or ID) (repeat option to set multiple values) (required)

request token create¶

Create a request token

openstack request token create
    --consumer-key <consumer-key>
    --consumer-secret <consumer-secret>
    --project <project>
    [--domain <domain>]

--consumer-key <consumer-key>¶: Consumer key (required)

--consumer-secret <consumer-secret>¶: Consumer secret (required)

--project <project>¶: Project that consumer wants to access (name or ID) (required)

--domain <domain>¶: Domain owning <project> (name or ID)

role assignment¶

role assignment list¶

List role assignments

openstack role assignment list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--effective]
    [--role <role>]
    [--role-domain <role-domain>]
    [--names]
    [--user <user>]
    [--user-domain <user-domain>]
    [--group <group>]
    [--group-domain <group-domain>]
    [--domain <domain> | --project <project> | --system <system>]
    [--project-domain <project-domain>]
    [--inherited]
    [--auth-user]
    [--auth-project]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--effective¶: Returns only effective role assignments

--role <role>¶: Role to filter (name or ID)

--role-domain <role-domain>¶: Domain the role belongs to (name or ID). This must be specified when the name of a domain specific role is used.

--names¶: Display names instead of IDs

--user <user>¶: User to filter (name or ID)

--user-domain <user-domain>¶: Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

--group <group>¶: Group to filter (name or ID)

--group-domain <group-domain>¶: Domain the group belongs to (name or ID). This can be used in case collisions between group names exist.

--domain <domain>¶: Domain to filter (name or ID)

--project <project>¶: Project to filter (name or ID)

--system <system>¶: Filter based on system role assignments

--project-domain <project-domain>¶: Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

--inherited¶: Specifies if the role grant is inheritable to the sub projects

--auth-user¶: Only list assignments for the authenticated user

--auth-project¶: Only list assignments for the project to which the authenticated user’s token is scoped

role (Identity v3)¶

role add¶

Adds a role assignment to a user or group on the system, a domain, or a project

openstack role add
    [--system <system> | --domain <domain> | --project <project>]
    [--user <user> | --group <group>]
    [--group-domain <group-domain>]
    [--project-domain <project-domain>]
    [--user-domain <user-domain>]
    [--inherited]
    [--role-domain <role-domain>]
    <role>

--system <system>¶: Include <system> (all)

--domain <domain>¶: Include <domain> (name or ID)

--project <project>¶: Include <project> (name or ID)

--user <user>¶: Include <user> (name or ID)

--group <group>¶: Include <group> (name or ID)

--group-domain <group-domain>¶: Domain the group belongs to (name or ID). This can be used in case collisions between group names exist.

--project-domain <project-domain>¶: Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

--user-domain <user-domain>¶: Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

--inherited¶: Specifies if the role grant is inheritable to the sub projects

--role-domain <role-domain>¶: Domain the role belongs to (name or ID). This must be specified when the name of a domain specific role is used.

role¶: Role to add to <user> (name or ID)

role assignment list¶

List role assignments

openstack role assignment list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--effective]
    [--role <role>]
    [--role-domain <role-domain>]
    [--names]
    [--user <user>]
    [--user-domain <user-domain>]
    [--group <group>]
    [--group-domain <group-domain>]
    [--domain <domain> | --project <project> | --system <system>]
    [--project-domain <project-domain>]
    [--inherited]
    [--auth-user]
    [--auth-project]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--effective¶: Returns only effective role assignments

--role <role>¶: Role to filter (name or ID)

--role-domain <role-domain>¶: Domain the role belongs to (name or ID). This must be specified when the name of a domain specific role is used.

--names¶: Display names instead of IDs

--user <user>¶: User to filter (name or ID)

--user-domain <user-domain>¶: Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

--group <group>¶: Group to filter (name or ID)

--group-domain <group-domain>¶: Domain the group belongs to (name or ID). This can be used in case collisions between group names exist.

--domain <domain>¶: Domain to filter (name or ID)

--project <project>¶: Project to filter (name or ID)

--system <system>¶: Filter based on system role assignments

--project-domain <project-domain>¶: Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

--inherited¶: Specifies if the role grant is inheritable to the sub projects

--auth-user¶: Only list assignments for the authenticated user

--auth-project¶: Only list assignments for the project to which the authenticated user’s token is scoped

role create¶

Create new role

openstack role create
    [--description <description>]
    [--domain <domain>]
    [--or-show]
    [--immutable | --no-immutable]
    <role-name>

--description <description>¶: Add description about the role

--domain <domain>¶: Domain the role belongs to (name or ID)

--or-show¶: Return existing role

--immutable¶: Make resource immutable. An immutable project may not be deleted or modified except to remove the immutable flag

--no-immutable¶: Make resource mutable (default)

role-name¶: New role name

role delete¶

Delete role(s)

openstack role delete [--domain <domain>] <role> [<role> ...]

--domain <domain>¶: Domain the role belongs to (name or ID)

role¶: Role(s) to delete (name or ID)

role list¶

List roles

openstack role list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--domain <domain>]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--domain <domain>¶: Include <domain> (name or ID)

role remove¶

Removes a role assignment from system/domain/project : user/group

openstack role remove
    [--system <system> | --domain <domain> | --project <project>]
    [--user <user> | --group <group>]
    [--group-domain <group-domain>]
    [--project-domain <project-domain>]
    [--user-domain <user-domain>]
    [--inherited]
    [--role-domain <role-domain>]
    <role>

--system <system>¶: Include <system> (all)

--domain <domain>¶: Include <domain> (name or ID)

--project <project>¶: Include <project> (name or ID)

--user <user>¶: Include <user> (name or ID)

--group <group>¶: Include <group> (name or ID)

--group-domain <group-domain>¶: Domain the group belongs to (name or ID). This can be used in case collisions between group names exist.

--project-domain <project-domain>¶: Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

--user-domain <user-domain>¶: Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

--inherited¶: Specifies if the role grant is inheritable to the sub projects

--role-domain <role-domain>¶: Domain the role belongs to (name or ID). This must be specified when the name of a domain specific role is used.

role¶: Role to remove (name or ID)

role set¶

Set role properties

openstack role set
    [--description <description>]
    [--domain <domain>]
    [--name <name>]
    [--immutable | --no-immutable]
    <role>

--description <description>¶: Add description about the role

--domain <domain>¶: Domain the role belongs to (name or ID)

--name <name>¶: Set role name

--immutable¶: Make resource immutable. An immutable project may not be deleted or modified except to remove the immutable flag

--no-immutable¶: Make resource mutable (default)

role¶: Role to modify (name or ID)

role show¶

Display role details

openstack role show [--domain <domain>] <role>

--domain <domain>¶: Domain the role belongs to (name or ID)

role¶: Role to display (name or ID)

service provider¶

A service provider is used by the Identity service’s OS-FEDERATION extension. It is used by to register another OpenStack Identity service.

service provider create¶

Create new service provider

openstack service provider create
    --auth-url <auth-url>
    [--description <description>]
    --service-provider-url <sp-url>
    [--enable | --disable]
    <name>

--auth-url <auth-url>¶: Authentication URL of remote federated service provider (required)

--description <description>¶: New service provider description

--service-provider-url <sp-url>¶: A service URL where SAML assertions are being sent (required)

--enable¶: Enable the service provider (default)

--disable¶: Disable the service provider

name¶: New service provider name (must be unique)

service provider delete¶

Delete service provider(s)

openstack service provider delete
    <service-provider>
    [<service-provider> ...]

service-provider¶: Service provider(s) to delete

service provider list¶

List service providers

openstack service provider list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

service provider set¶

Set service provider properties

openstack service provider set
    [--auth-url <auth-url>]
    [--description <description>]
    [--service-provider-url <sp-url>]
    [--enable | --disable]
    <service-provider>

--auth-url <auth-url>¶: New Authentication URL of remote federated service provider

--description <description>¶: New service provider description

--service-provider-url <sp-url>¶: New service provider URL, where SAML assertions are sent

--enable¶: Enable the service provider

--disable¶: Disable the service provider

service-provider¶: Service provider to modify

service provider show¶

Display service provider details

openstack service provider show <service-provider>

service-provider¶: Service provider to display

service (Identity v3)¶

service create¶

Create new service

openstack service create
    [--name <name>]
    [--description <description>]
    [--enable | --disable]
    <type>

--name <name>¶: New service name

--description <description>¶: New service description

--enable¶: Enable service (default)

--disable¶: Disable service

type¶: New service type (compute, image, identity, volume, etc)

service delete¶

Delete service(s)

openstack service delete <service> [<service> ...]

service¶: Service(s) to delete (type, name or ID)

service list¶

List services

openstack service list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--long]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--long¶: List additional fields in output

service show¶

Display service details

openstack service show <service>

service¶: Service to display (type, name or ID)

service set¶

Set service properties

openstack service set
    [--type <type>]
    [--name <service-name>]
    [--description <description>]
    [--enable | --disable]
    <service>

--type <type>¶: New service type (compute, image, identity, volume, etc)

--name <service-name>¶: New service name

--description <description>¶: New service description

--enable¶: Enable service

--disable¶: Disable service

service¶: Service to modify (type, name or ID)

token (Identity v3)¶

token issue¶

Issue new token

openstack token issue

token revoke¶

Revoke existing token

openstack token revoke <token>

token¶: Token to be deleted

trust¶

A trust provide project-specific role delegation between users, with optional impersonation. Requires the OS-TRUST extension.

trust create¶

Create new trust

openstack trust create
    --project <project>
    --role <role>
    [--impersonate]
    [--expiration <expiration>]
    [--project-domain <project-domain>]
    [--trustor-domain <trustor-domain>]
    [--trustee-domain <trustee-domain>]
    <trustor-user>
    <trustee-user>

--project <project>¶: Project being delegated (name or ID) (required)

--role <role>¶: Roles to authorize (name or ID) (repeat option to set multiple values, required)

--impersonate¶: Tokens generated from the trust will represent <trustor> (defaults to False)

--expiration <expiration>¶: Sets an expiration date for the trust (format of YYYY-mm-ddTHH:MM:SS)

--project-domain <project-domain>¶: Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

--trustor-domain <trustor-domain>¶: Domain that contains <trustor> (name or ID)

--trustee-domain <trustee-domain>¶: Domain that contains <trustee> (name or ID)

trustor-user¶: User that is delegating authorization (name or ID)

trustee-user¶: User that is assuming authorization (name or ID)

trust delete¶

Delete trust(s)

openstack trust delete <trust> [<trust> ...]

trust¶: Trust(s) to delete

trust list¶

List trusts

openstack trust list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--trustor <trustor-user>]
    [--trustee <trustee-user>]
    [--trustor-domain <trustor-domain>]
    [--trustee-domain <trustee-domain>]
    [--auth-user]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--trustor <trustor-user>¶: Trustor user to filter (name or ID)

--trustee <trustee-user>¶: Trustee user to filter (name or ID)

--trustor-domain <trustor-domain>¶: Domain that contains <trustor> (name or ID)

--trustee-domain <trustee-domain>¶: Domain that contains <trustee> (name or ID)

--auth-user¶: Only list trusts related to the authenticated user

trust show¶

Display trust details

openstack trust show <trust>

trust¶: Trust to display

user (Identity v3)¶

user create¶

Create new user

openstack user create
    [--domain <domain>]
    [--project <project>]
    [--project-domain <project-domain>]
    [--password <password>]
    [--password-prompt]
    [--email <email-address>]
    [--description <description>]
    [--ignore-lockout-failure-attempts]
    [--no-ignore-lockout-failure-attempts]
    [--ignore-password-expiry]
    [--no-ignore-password-expiry]
    [--ignore-change-password-upon-first-use]
    [--no-ignore-change-password-upon-first-use]
    [--enable-lock-password]
    [--disable-lock-password]
    [--enable-multi-factor-auth]
    [--disable-multi-factor-auth]
    [--multi-factor-auth-rule <rule>]
    [--enable | --disable]
    [--or-show]
    <name>

--domain <domain>¶: Default domain (name or ID)

--project <project>¶: Default project (name or ID)

--project-domain <project-domain>¶: Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

--password <password>¶: Set user password

--password-prompt¶: Prompt interactively for password

--email <email-address>¶: Set user email address

--description <description>¶: User description

--ignore-lockout-failure-attempts¶: Opt into ignoring the number of times a user has authenticated and locking out the user as a result

--no-ignore-lockout-failure-attempts¶: Opt out of ignoring the number of times a user has authenticated and locking out the user as a result

--ignore-password-expiry¶: Opt into allowing user to continue using passwords that may be expired

--no-ignore-password-expiry¶: Opt out of allowing user to continue using passwords that may be expired

--ignore-change-password-upon-first-use¶: Control if a user should be forced to change their password immediately after they log into keystone for the first time. Opt into ignoring the user to change their password during first time login in keystone

--no-ignore-change-password-upon-first-use¶: Control if a user should be forced to change their password immediately after they log into keystone for the first time. Opt out of ignoring the user to change their password during first time login in keystone

--enable-lock-password¶: Disables the ability for a user to change its password through self-service APIs

--disable-lock-password¶: Enables the ability for a user to change its password through self-service APIs

--enable-multi-factor-auth¶: Enables the MFA (Multi Factor Auth)

--disable-multi-factor-auth¶: Disables the MFA (Multi Factor Auth)

--multi-factor-auth-rule <rule>¶: Set multi-factor auth rules. For example, to set a rule requiring the “password” and “totp” auth methods to be provided, use: “–multi-factor-auth-rule password,totp”. May be provided multiple times to set different rule combinations.

--enable¶: Enable user (default)

--disable¶: Disable user

--or-show¶: Return existing user

name¶: New user name

user delete¶

Delete user(s)

openstack user delete [--domain <domain>] <user> [<user> ...]

--domain <domain>¶: Domain owning <user> (name or ID)

user¶: User(s) to delete (name or ID)

user list¶

List users

openstack user list
    [--sort-column SORT_COLUMN]
    [--sort-ascending | --sort-descending]
    [--domain <domain>]
    [--group <group> | --project <project>]
    [--long]
    [--enabled]
    [--disabled]
    [--limit <limit>]
    [--marker <marker>]
    [--max-items <max-items>]

--sort-column SORT_COLUMN¶: specify the column(s) to sort the data (columns specified first have a priority, non-existing columns are ignored), can be repeated

--sort-ascending¶: sort the column(s) in ascending order

--sort-descending¶: sort the column(s) in descending order

--domain <domain>¶: Filter users by <domain> (name or ID)

--group <group>¶: Filter users by <group> membership (name or ID)

--project <project>¶: Filter users by <project> (name or ID)

--long¶: List additional fields in output

--enabled¶: List only enabled users, does nothing with –project and –group

--disabled¶: List only disabled users, does nothing with –project and –group

--limit <limit>¶: The maximum number of entries to return per page. If the value exceeds the server-defined maximum, then the server-defined value will be used. Note that this controls the page size, not the total number of entries returned. Use –max-items to limit the total number of entries returned.

--marker <marker>¶: The first position in the collection to return results from. This should be a value that was returned in a previous request.

--max-items <max-items>¶: The maximum number of entries to return in total, paging through multiple requests if needed. Use –limit to control the page size.

user password set¶

Change current user password

openstack user password set
    [--password <new-password>]
    [--original-password <original-password>]

--password <new-password>¶: New user password

--original-password <original-password>¶: Original user password

user set¶

Set user properties

openstack user set
    [--name <name>]
    [--domain <domain>]
    [--project <project>]
    [--project-domain <project-domain>]
    [--password <password>]
    [--password-prompt]
    [--email <email-address>]
    [--description <description>]
    [--ignore-lockout-failure-attempts]
    [--no-ignore-lockout-failure-attempts]
    [--ignore-password-expiry]
    [--no-ignore-password-expiry]
    [--ignore-change-password-upon-first-use]
    [--no-ignore-change-password-upon-first-use]
    [--enable-lock-password]
    [--disable-lock-password]
    [--enable-multi-factor-auth]
    [--disable-multi-factor-auth]
    [--multi-factor-auth-rule <rule>]
    [--enable | --disable]
    <user>

--name <name>¶: Set user name

--domain <domain>¶: Domain the user belongs to (name or ID). This can be used in case collisions between user names exist.

--project <project>¶: Set default project (name or ID)

--project-domain <project-domain>¶: Domain the project belongs to (name or ID). This can be used in case collisions between project names exist.

--password <password>¶: Set user password

--password-prompt¶: Prompt interactively for password

--email <email-address>¶: Set user email address

--description <description>¶: Set user description

--ignore-lockout-failure-attempts¶: Opt into ignoring the number of times a user has authenticated and locking out the user as a result

--no-ignore-lockout-failure-attempts¶: Opt out of ignoring the number of times a user has authenticated and locking out the user as a result

--ignore-password-expiry¶: Opt into allowing user to continue using passwords that may be expired

--no-ignore-password-expiry¶: Opt out of allowing user to continue using passwords that may be expired

--ignore-change-password-upon-first-use¶: Control if a user should be forced to change their password immediately after they log into keystone for the first time. Opt into ignoring the user to change their password during first time login in keystone

--no-ignore-change-password-upon-first-use¶: Control if a user should be forced to change their password immediately after they log into keystone for the first time. Opt out of ignoring the user to change their password during first time login in keystone

--enable-lock-password¶: Disables the ability for a user to change its password through self-service APIs

--disable-lock-password¶: Enables the ability for a user to change its password through self-service APIs

--enable-multi-factor-auth¶: Enables the MFA (Multi Factor Auth)

--disable-multi-factor-auth¶: Disables the MFA (Multi Factor Auth)

--multi-factor-auth-rule <rule>¶: Set multi-factor auth rules. For example, to set a rule requiring the “password” and “totp” auth methods to be provided, use: “–multi-factor-auth-rule password,totp”. May be provided multiple times to set different rule combinations.

--enable¶: Enable user (default)

--disable¶: Disable user

user¶: User to modify (name or ID)

user show¶

Display user details

openstack user show [--domain <domain>] <user>

--domain <domain>¶: Domain owning <user> (name or ID)

user¶: User to display (name or ID)