Designate

Recommendation to restrict zone name creation

Asked by Chris DeVita

We want to restrict a tenant to only be able to create a SLD zones under a given TLD. Instead of a blacklist of what you can't create we want a list of what zones you CAN create. For example if the the lists contains xyz.com , then the tenant could create abc.xyz.com but no other domains / zones.

Question information

Language:
English Edit question
Status:
Expired
For:
Designate Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:
Revision history for this message
Chris DeVita (cdev3) said : 		#1

As Admin I can create a tld, to keep the tenant from hijacking other domains

$ openstack tld create --name tld
-> ok
$ openstack tld list
+--------------------------------------+------+-------------+
| id | name | description |
 +--------------------------------------+------+-------------+
| 434abc87-9dbf-4e74-a9aa-faec8bde5b67 | tld | |
 +

Then logged in as as the DEMO project

I cannot create zone for TLD,

$ openstack zone create --email test@tld tld.
More than one label is required

But can create sub domains

$ openstack zone create --email test@tld sld.tld.
-> ok
$ openstack zone create --email test@tld xyz.sld.tld.
-> ok

I can also make other zones not in the tld list

$ openstack zone create --email test@tld abc.com.
-> ok
$ openstack zone list
+--------------------------------------+--------------+---------+------------+---------+--------+
| id | name | type | serial | status | action |
 +--------------------------------------+--------------+---------+------------+---------+--------+
| 5162eaa3-9b93-4e61-8239-577440292006 | sld.tld. | PRIMARY | 1503684349 | ACTIVE | NONE |
| a355cc9c-1e91-4c4d-a5ff-5ab869a94b42 | xyz.sld.tld. | PRIMARY | 1503684364 | ACTIVE | NONE |
| 52c6b574-64fd-4055-8980-05e8e382c78e | abc.com. | PRIMARY | 1503684636 | ACTIVE | NONE |
 +--------------------------------------+--------------+---------+------------+---------+--------+

So if the admin sets up a TLD the project user can make any zone but not the TLD zone itself ( tld. )

Revision history for this message
Launchpad Janitor (janitor) said : 		#2

This question was expired because it remained in the 'Open' state without activity for the last 15 days.