# Authentication and Authorization

## The `manila.quota` Module

Quotas for shares.

class AbsoluteResource(name, flag=None)

  Bases: `manila.quota.BaseResource`

  Describe a non-reservable resource.

class BaseResource(name, flag=None)

  Bases: `object`

  Describe a single resource for quota checking.

  property default

    Return the default value of the quota.

class CountableResource(name, count, flag=None)

  Bases: `manila.quota.AbsoluteResource`

  Describe a countable resource.

  Describe a resource where the counts aren’t based solely on the project ID.

class DbQuotaDriver

  Bases: `object`

  Database Quota driver.

  Driver to perform necessary checks to enforce quotas and obtain quota information. The default driver utilizes the local database.

  commit(context, reservations, project_id=None, user_id=None, share_type_id=None)

    Commit reservations.

    Parameters

      - context – The request context, for access checks.

      - reservations – A list of the reservation UUIDs, as returned by the reserve() method.

      - project_id – Specify the project_id if current context is admin and admin wants to impact on common user’s tenant.

      - user_id – Specify the user_id if current context is admin and admin wants to impact on common user. (Special case: user operates on resource, owned/created by different user)

  destroy_all_by_project(context, project_id)

    Destroy metadata associated with a project.

    Destroy all quotas, usages, and reservations associated with a project.

    Parameters

      - context – The request context, for access checks.

      - project_id – The ID of the project being deleted.

  destroy_all_by_project_and_share_type(context, project_id, share_type_id)

    Destroy metadata associated with a project and share_type.

    Destroy all quotas, usages, and reservations associated with a project and share_type.

    Parameters

      - context – The request context, for access checks.

      - project_id – The ID of the project.

      - share_type_id – The UUID of the share type.

  destroy_all_by_project_and_user(context, project_id, user_id)

    Destroy metadata associated with a project and user.

    Destroy all quotas, usages, and reservations associated with a project and user.

    Parameters

      - context – The request context, for access checks.

      - project_id – The ID of the project being deleted.

      - user_id – The ID of the user being deleted.

  expire(context)

    Expire reservations.

    Explores all currently existing reservations and rolls back any that have expired.

    Parameters

      context – The request context, for access checks.

  get_by_class(context, quota_class, resource)

    Get a specific quota by quota class.

  get_class_quotas(context, resources, quota_class, defaults=True)

    Retrieve quotas for a quota class.

    Given a list of resources, retrieve the quotas for the given quota class.

    Parameters

      - context – The request context, for access checks.

      - resources – A dictionary of the registered resources.

      - quota_class – The name of the quota class to return quotas for.

      - defaults – If True, the default value will be reported if there is no specific value for the resource.

  get_defaults(context, resources)

    Given a list of resources, retrieve the default quotas.

    Parameters

      - context – The request context, for access checks.

      - resources – A dictionary of the registered resources.

  get_project_quotas(context, resources, project_id, quota_class=None, defaults=True, usages=True, remains=False)

    Retrieve quotas for project.

    Given a list of resources, retrieve the quotas for the given project.

    Parameters

      - context – The request context, for access checks.

      - resources – A dictionary of the registered resources.

      - project_id – The ID of the project to return quotas for.

      - quota_class – If project_id != context.project_id, the quota class cannot be determined. This parameter allows it to be specified. It will be ignored if project_id == context.project_id.

      - defaults – If True, the quota class value (or the default value, if there is no value from the quota class) will be reported if there is no specific value for the resource.

      - usages – If True, the current in_use and reserved counts will also be returned.

      - remains – If True, the current remains of the project will will be returned.

  get_settable_quotas(context, resources, project_id, user_id=None, share_type_id=None)

    Retrieve range of settable quotas.

    Given a list of resources, retrieve the range of settable quotas for the given user or project.

    Parameters

      - context – The request context, for access checks.

      - resources – A dictionary of the registered resources.

      - project_id – The ID of the project to return quotas for.

      - user_id – The ID of the user to return quotas for.

      - share_type_id – The UUID of the share_type to return quotas for.

  get_share_type_quotas(context, resources, project_id, share_type_id, quota_class=None, defaults=True, usages=True)

    Retrieve quotas for share_type and project.

    Given a list of resources, retrieve the quotas for the given share_type and project.

    Parameters

      - context – The request context, for access checks.

      - resources – A dictionary of the registered resources.

      - project_id – The UUID of the project to return quotas for.

      - share_type – UUID/name of a share type to return quotas for.

      - quota_class – If project_id != context.project_id, the quota class cannot be determined. This parameter allows it to be specified. It will be ignored if project_id == context.project_id.

      - defaults – If True, the quota class value (or the default value, if there is no value from the quota class) will be reported if there is no specific value for the resource.

      - usages – If True, the current in_use and reserved counts will also be returned.

  get_user_quotas(context, resources, project_id, user_id, quota_class=None, defaults=True, usages=True)

    Retrieve quotas for user and project.

    Given a list of resources, retrieve the quotas for the given user and project.

    Parameters

      - context – The request context, for access checks.

      - resources – A dictionary of the registered resources.

      - project_id – The ID of the project to return quotas for.

      - user_id – The ID of the user to return quotas for.

      - quota_class – If project_id != context.project_id, the quota class cannot be determined. This parameter allows it to be specified. It will be ignored if project_id == context.project_id.

      - defaults – If True, the quota class value (or the default value, if there is no value from the quota class) will be reported if there is no specific value for the resource.

      - usages – If True, the current in_use and reserved counts will also be returned.

  limit_check(context, resources, values, project_id=None)

    Check simple quota limits.

    For limits–those quotas for which there is no usage synchronization function–this method checks that a set of proposed values are permitted by the limit restriction.

    This method will raise a QuotaResourceUnknown exception if a given resource is unknown or if it is not a simple limit resource.

    If any of the proposed values is over the defined quota, an OverQuota exception will be raised with the sorted list of the resources which are too high. Otherwise, the method returns nothing.

    Parameters

      - context – The request context, for access checks.

      - resources – A dictionary of the registered resources.

      - values – A dictionary of the values to check against the quota.

      - project_id – Specify the project_id if current context is admin and admin wants to impact on common user’s tenant.

  reserve(context, resources, deltas, expire=None, project_id=None, user_id=None, share_type_id=None, overquota_allowed=False)

    Check quotas and reserve resources.

    For counting quotas–those quotas for which there is a usage synchronization function–this method checks quotas against current usage and the desired deltas.

    This method will raise a QuotaResourceUnknown exception if a given resource is unknown or if it does not have a usage synchronization function.

    If any of the proposed values is over the defined quota, an OverQuota exception will be raised with the sorted list of the resources which are too high. Otherwise, the method returns a list of reservation UUIDs which were created.

    Parameters

      - context – The request context, for access checks.

      - resources – A dictionary of the registered resources.

      - deltas – A dictionary of the proposed delta changes.

      - expire – An optional parameter specifying an expiration time for the reservations. If it is a simple number, it is interpreted as a number of seconds and added to the current time; if it is a datetime.timedelta object, it will also be added to the current time. A datetime.datetime object will be interpreted as the absolute expiration time. If None is specified, the default expiration time set by –default-reservation-expire will be used (this value will be treated as a number of seconds).

      - project_id – Specify the project_id if current context is admin and admin wants to impact on common user’s tenant.

      - user_id – Specify the user_id if current context is admin and admin wants to impact on common user. (Special case: user operates on resource, owned/created by different user)

  rollback(context, reservations, project_id=None, user_id=None, share_type_id=None)

    Roll back reservations.

    Parameters

      - context – The request context, for access checks.

      - reservations – A list of the reservation UUIDs, as returned by the reserve() method.

      - project_id – Specify the project_id if current context is admin and admin wants to impact on common user’s tenant.

      - user_id – Specify the user_id if current context is admin and admin wants to impact on common user. (Special case: user operates on resource, owned/created by different user)

  usage_reset(context, resources)

    Reset usage records.

    Reset the usage records for a particular user on a list of resources. This will force that user’s usage records to be refreshed the next time a reservation is made.

    Note: this does not affect the currently outstanding reservations the user has; those reservations must be committed or rolled back (or expired).

    Parameters

      - context – The request context, for access checks.

      - resources – A list of the resource names for which the usage must be reset.

class QuotaEngine(quota_driver_class=None)

  Bases: `object`

  Represent the set of recognized quotas.

  commit(context, reservations, project_id=None, user_id=None, share_type_id=None)

    Commit reservations.

    Parameters

      - context – The request context, for access checks.

      - reservations – A list of the reservation UUIDs, as returned by the reserve() method.

      - project_id – Specify the project_id if current context is admin and admin wants to impact on common user’s tenant.

  count(context, resource, *args, **kwargs)

    Count a resource.

    For countable resources, invokes the count() function and returns its result. Arguments following the context and resource are passed directly to the count function declared by the resource.

    Parameters

      - context – The request context, for access checks.

      - resource – The name of the resource, as a string.

  destroy_all_by_project(context, project_id)

    Destroy metadata associated with a project.

    Destroy all quotas, usages, and reservations associated with a project.

    Parameters

      - context – The request context, for access checks.

      - project_id – The ID of the project being deleted.

  destroy_all_by_project_and_share_type(context, project_id, share_type_id)

    Destroy metadata associated with a project and share_type.

    Destroy all quotas, usages, and reservations associated with a project and share_type.

    Parameters

      - context – The request context, for access checks.

      - project_id – The ID of the project.

      - share_type_id – The UUID of the share_type.

  destroy_all_by_project_and_user(context, project_id, user_id)

    Destroy metadata associated with a project and user.

    Destroy all quotas, usages, and reservations associated with a project and user.

    Parameters

      - context – The request context, for access checks.

      - project_id – The ID of the project being deleted.

      - user_id – The ID of the user being deleted.

  expire(context)

    Expire reservations.

    Explores all currently existing reservations and rolls back any that have expired.

    Parameters

      context – The request context, for access checks.

  get_by_class(context, quota_class, resource)

    Get a specific quota by quota class.

  get_class_quotas(context, quota_class, defaults=True)

    Retrieve the quotas for the given quota class.

    Parameters

      - context – The request context, for access checks.

      - quota_class – The name of the quota class to return quotas for.

      - defaults – If True, the default value will be reported if there is no specific value for the resource.

  get_defaults(context)

    Retrieve the default quotas.

    Parameters

      context – The request context, for access checks.

  get_project_quotas(context, project_id, quota_class=None, defaults=True, usages=True, remains=False)

    Retrieve the quotas for the given project.

    Parameters

      - context – The request context, for access checks.

      - project_id – The ID of the project to return quotas for.

      - quota_class – If project_id != context.project_id, the quota class cannot be determined. This parameter allows it to be specified.

      - defaults – If True, the quota class value (or the default value, if there is no value from the quota class) will be reported if there is no specific value for the resource.

      - usages – If True, the current in_use and reserved counts will also be returned.

      - remains – If True, the current remains of the project will will be returned.

  get_settable_quotas(context, project_id, user_id=None, share_type_id=None)

    Get settable quotas.

    Given a list of resources, retrieve the range of settable quotas for the given user or project.

    Parameters

      - context – The request context, for access checks.

      - resources – A dictionary of the registered resources.

      - project_id – The ID of the project to return quotas for.

      - user_id – The ID of the user to return quotas for.

      - share_type_id – The UUID of the share_type to return quotas for.

  get_share_type_quotas(context, project_id, share_type_id, quota_class=None, defaults=True, usages=True)

    Retrieve the quotas for the given user and project.

    Parameters

      - context – The request context, for access checks.

      - project_id – The ID of the project to return quotas for.

      - share_type_id – The UUID of the user to return quotas for.

      - quota_class – If project_id != context.project_id, the quota class cannot be determined. This parameter allows it to be specified.

      - defaults – If True, the quota class value (or the default value, if there is no value from the quota class) will be reported if there is no specific value for the resource.

      - usages – If True, the current in_use and reserved counts will also be returned.

  get_user_quotas(context, project_id, user_id, quota_class=None, defaults=True, usages=True)

    Retrieve the quotas for the given user and project.

    Parameters

      - context – The request context, for access checks.

      - project_id – The ID of the project to return quotas for.

      - user_id – The ID of the user to return quotas for.

      - quota_class – If project_id != context.project_id, the quota class cannot be determined. This parameter allows it to be specified.

      - defaults – If True, the quota class value (or the default value, if there is no value from the quota class) will be reported if there is no specific value for the resource.

      - usages – If True, the current in_use and reserved counts will also be returned.

  limit_check(context, project_id=None, **values)

    Check simple quota limits.

    For limits–those quotas for which there is no usage synchronization function–this method checks that a set of proposed values are permitted by the limit restriction. The values to check are given as keyword arguments, where the key identifies the specific quota limit to check, and the value is the proposed value.

    This method will raise a QuotaResourceUnknown exception if a given resource is unknown or if it is not a simple limit resource.

    If any of the proposed values is over the defined quota, an OverQuota exception will be raised with the sorted list of the resources which are too high. Otherwise, the method returns nothing.

    Parameters

      - context – The request context, for access checks.

      - project_id – Specify the project_id if current context is admin and admin wants to impact on common user’s tenant.

  register_resource(resource)

    Register a resource.

  register_resources(resources)

    Register a list of resources.

  reserve(context, expire=None, project_id=None, user_id=None, share_type_id=None, overquota_allowed=False, **deltas)

    Check quotas and reserve resources.

    For counting quotas–those quotas for which there is a usage synchronization function–this method checks quotas against current usage and the desired deltas. The deltas are given as keyword arguments, and current usage and other reservations are factored into the quota check.

    This method will raise a QuotaResourceUnknown exception if a given resource is unknown or if it does not have a usage synchronization function.

    If any of the proposed values is over the defined quota, an OverQuota exception will be raised with the sorted list of the resources which are too high. Otherwise, the method returns a list of reservation UUIDs which were created.

    Parameters

      - context – The request context, for access checks.

      - expire – An optional parameter specifying an expiration time for the reservations. If it is a simple number, it is interpreted as a number of seconds and added to the current time; if it is a datetime.timedelta object, it will also be added to the current time. A datetime.datetime object will be interpreted as the absolute expiration time. If None is specified, the default expiration time set by –default-reservation-expire will be used (this value will be treated as a number of seconds).

      - project_id – Specify the project_id if current context is admin and admin wants to impact on common user’s tenant.

  property resources
  rollback(context, reservations, project_id=None, user_id=None, share_type_id=None)

    Roll back reservations.

    Parameters

      - context – The request context, for access checks.

      - reservations – A list of the reservation UUIDs, as returned by the reserve() method.

      - project_id – Specify the project_id if current context is admin and admin wants to impact on common user’s tenant.

  usage_reset(context, resources)

    Reset usage records.

    Reset the usage records for a particular user on a list of resources. This will force that user’s usage records to be refreshed the next time a reservation is made.

    Note: this does not affect the currently outstanding reservations the user has; those reservations must be committed or rolled back (or expired).

    Parameters

      - context – The request context, for access checks.

      - resources – A list of the resource names for which the usage must be reset.

class ReservableResource(name, sync, flag=None)

  Bases: `manila.quota.BaseResource`

  Describe a reservable resource.

## The `manila.policy` Module

Policy Engine For Manila

authorize(context, action, target, do_raise=True, exc=None)

  Verifies that the action is valid on the target in this context.

  Parameters

    - context – manila context

    - action – string representing the action to be checked this should be colon separated for clarity. i.e. `share:create`,

    - target – dictionary representing the object of the action for object creation this should be a dictionary representing the location of the object e.g. `{'project_id': context.project_id}`

    - do_raise – if True (the default), raises PolicyNotAuthorized; if False, returns False

    - exc – Class of the exception to raise if the check fails. Any remaining arguments passed to `authorize()` (both positional and keyword arguments) will be passed to the exception class. If not specified, `PolicyNotAuthorized` will be used.

  Raises

    manila.exception.PolicyNotAuthorized – if verification fails and do_raise is True. Or if ‘exc’ is specified it will raise an exception of that type.

  Returns

    returns a non-False value (not necessarily “True”) if authorized, and the exact value False if not authorized and do_raise is False.

check_is_admin(context)

  Whether or not user is admin according to policy setting.

check_policy(context, resource, action, target_obj=None, do_raise=True)

default_target(context)

enforce(context, action, target, do_raise=True)

  Verifies that the action is valid on the target in this context.

  IMPORTANT ONLY for use in API extensions. This method ignores unregistered rules and applies a default rule on them; there should be no unregistered rules in first party manila APIs.

  Parameters

    - context – manila context

    - action – string representing the action to be checked, this should be colon separated for clarity. i.e. `share:create`,

    - target – dictionary representing the object of the action for object creation, this should be a dictionary representing the location of the object e.g. `{'project_id': context.project_id}`

    - do_raise – Whether to raise an exception if check fails.

  Returns

    When `do_raise` is `False`, returns a value that evaluates as `True` or `False` depending on whether the policy allows action on the target.

  Raises

    manila.exception.PolicyNotAuthorized if verification fails and `do_raise` is `True`.

get_enforcer()

get_rules()

init(rules=None, use_conf=True, suppress_deprecation_warnings=False)

  Init an Enforcer class.

  Parameters

    - policy_file – Custom policy file to use, if none is specified, CONF.policy_file will be used.

    - rules – Default dictionary / Rules to use. It will be considered just in the first instantiation.

    - use_conf – Whether to load rules from config file.

    - suppress_deprecation_warnings – Whether to suppress policy deprecation warnings.

register_rules(enforcer)

reset()

set_rules(rules, overwrite=True, use_conf=False)

  Set rules based on the provided dict of rules.

  Parameters

    - rules – New rules to use. It should be an instance of dict.

    - overwrite – Whether to overwrite current rules or update them with the new rules.

    - use_conf – Whether to reload rules from config file.

wrap_check_policy(resource)

  Check policy corresponding to the wrapped methods prior to execution.

## System limits

The following limits need to be defined and enforced:

- Maximum cumulative size of shares and snapshots (GB)

- Total number of shares

- Total number of snapshots

- Total number of share networks

this page last updated: 2026-03-20 00:30:00

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.

found an error? report a bug