[CLOUDSTACK-5136] Domain admin cannot create accounts/users.

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 4.2.0
• Fix Version/s: Future
• Component/s: API
• Security Level: Public (Anyone can view this level - this is the default.)
• Labels: API admin features
• Assignee: Wei Zhou
• Reporter: David Matteson
• Created: 11/Nov/13 16:09
• Updated: 18/Nov/13 19:12
• Resolved: 11/Nov/13 19:01

Description

Currently a Domain Admin cannot create accounts. This means that allowing Reselling of CloudStack services is not really viable at the moment since any Resellers won't be able to create accounts for their customers, unless we give that Reseller ROOT admin access. Which is obviously not ideal.

Since Domain Admin already exists as an established access level, and adding more functionality that they currently don't have would possibly negatively impact people who are relying on it in production, perhaps a new level of admin is needed between Domain and ROOT?

This new tier that would facilitate Reseller accounts would need everything Domain Admins have plus CreateAccount/CreateUser for their domain and Usage Record access for their domain.

Obviously even better than this would be an admin tier where you could specify what they had access to but that's obviously more complicated.

Issue Links

• duplicates: CLOUDSTACK-4830 Allow creation of users and accounts by domain admin in UI