# Configuration Options

oslo.policy uses oslo.config to define and manage configuration options that allow the deployer to control where the policy files are located, the default rule to apply, etc.

## oslo_policy

enforce_scope
  Type:

    boolean

  Default:

    `True`

  This option controls whether or not to enforce scope when evaluating policies. If `True`, the scope of the token used in the request is compared to the `scope_types` of the policy being enforced. If the scopes do not match, an `InvalidScope` exception will be raised. If `False`, a message will be logged informing operators that policies are being invoked with mismatching scope.

  Warning

  This option is deprecated for removal. Its value may be silently ignored in the future.

  Reason:

    This configuration was added temporarily to facilitate a smooth transition to the new RBAC. OpenStack will always enforce scope checks. This configuration option is deprecated and will be removed in the 2025.2 cycle.

enforce_new_defaults
  Type:

    boolean

  Default:

    `True`

  This option controls whether or not to use old deprecated defaults when evaluating policies. If `True`, the old deprecated defaults are not going to be evaluated. This means if any existing token is allowed for old defaults but is disallowed for new defaults, it will be disallowed. It is encouraged to enable this flag along with the `enforce_scope` flag so that you can get the benefits of new defaults and `scope_type` together. If `False`, the deprecated policy check string is logically OR’d with the new policy check string, allowing for a graceful upgrade experience between releases with new policies, which is the default behavior.

policy_file
  Type:

    string

  Default:

    `policy.yaml`

  The relative or absolute path of a file that maps roles to permissions for a given service. Relative paths must be specified in relation to the configuration file setting this option.

policy_default_rule
  Type:

    string

  Default:

    `default`

  Default rule. Enforced when a requested rule is not found.

policy_dirs
  Type:

    multi-valued

  Default:

    `policy.d`

  Directories where policy configuration files are stored. They can be relative to any directory in the search path defined by the config_dir option, or absolute paths. The file defined by policy_file must exist for these directories to be searched. Missing or empty directories are ignored.

remote_content_type
  Type:

    string

  Default:

    `application/x-www-form-urlencoded`

  Valid Values:

    application/x-www-form-urlencoded, application/json

  Content Type to send and receive data for REST based policy check

remote_ssl_verify_server_crt
  Type:

    boolean

  Default:

    `False`

  server identity verification for REST based policy check

remote_ssl_ca_crt_file
  Type:

    string

  Default:

    `<None>`

  Absolute path to ca cert file for REST based policy check

remote_ssl_client_crt_file
  Type:

    string

  Default:

    `<None>`

  Absolute path to client cert for REST based policy check

remote_ssl_client_key_file
  Type:

    string

  Default:

    `<None>`

  Absolute path client key file REST based policy check

remote_timeout
  Type:

    floating point

  Default:

    `60`

  Minimum Value:

    0

  Timeout in seconds for REST based policy check

this page last updated: 2026-03-26 20:19:55

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug