Authorization Model

The authorization model separates system administrators, tenant administrators, and project users.

System administrators are permitted to read and modify all the objects in the system. They can also create tenant administrators. A tenant administrator can view and modify projects, quotas, and other objects owned by the tenant. A tenant administrator or a system administrator can create project users, who can view and modify project resources, such as VMs, disks, and images.

System Administrator

These users have full access to all APIs in the system.

The table below describes APIs that are to be used by System Administrators and their attributes:

API Calls by System Administrators

Only a system administrator can access these API endpoints.

API Call	Description
/datastores	List datastores in use by Photon Controller
/deployments	List Photon Controller deployments
/hosts	List hosts under control of Photon Controller
/portgroups	List portgroups available
/status	List Photon Controller's system status

Sysadmin R/W; Others R/O - API Calls

Only a system administrator can write to these API endpoints; all other users may read them. By "write," we mean create, modify, and delete---"manage" in the table below.

API Call	Sysadmin Actions	Actions for others
/flavors	Manage flavors	List/show flavors
/networks	Manage networks	List/show networks
/tenants	Manage tenants	List/show tenants
/tenants/quotas	Manage quotas	List/show quotas

Tenant Administrator

Tenant Administrators are assigned on a per-tenant basis and have the following capabilities:

Creating and deleting projects under the tenant they are assigned
Creating and deleting quotas
Managing the security groups associated with the tenant
Fully manipulating any object scoped under the tenant and project

API Calls by Tenant Administrator

A tenant administrator can manage the the projects within the tenant.

API Call	Description
/tenants/MY-TENANT/set_security_groups	Manage security groups for MY-TENANT
/tenants/MY-TENANT/projects	Manage projects for MY-TENANT

Project Users

Project users can view and modify project resources, including VMs and disks. After a Photon Controller tenant administrator or system administrator binds a security group to a project, all members of that group are granted project user rights.

API Calls by Project Users

API Call	Description
/projects/MY-PROJECT/clusters	Manage container clusters for MY-PROJECT
/projects/MY-PROJECT/disks	Manage disks for MY-PROJECT
/projects/MY-PROJECT/vms	Manage VMs for MY-PROJECT
/projects/MY-PROJECT/set_security_groups	Manage security groups for MY-PROJECT