Ability to filter who can access a cloudstack resource set (possibly domain or...) based on his IP address besides username-password.

[alsko-icom]

The required feature described as a wish

As a a Cloudstack admin, who recently implemented v4.20 for the first time, I am wondering if we can filter which IP address/network can access a set of resources, a domain, subdomain, account, anything that you can offer. Can we maybe access a domain or subdomain through a direct URL without typing it on the box underneath the password? This might mean injecting the domain path on the URL. but the actual need is to filter based on source IP, the connection to the end user UI specific dashboard. In other words allow a user to reach a specific domain or set of virtualization resources. Is something like this implemented? Also, is there a guide out there to describe the methods to achive isolation per tenant/customer?

[alsko-icom]

Is this a popular request? Are there other ways to implement filtering?

[bernardodemarco]

Hello, @alsko-icom

Can we maybe access a domain or subdomain through a direct URL without typing it on the box underneath the password?

Currently, Apache CloudStack does not support this functionality. A functionality that similarly encompasses the described use case is the GUI whitelabel runtime system, proposed in the PR #8942. The new proposed APIs support a parameter called commonnames, that enables a theme to be retrieved according to a set of Internet common names. Therefore, for example, the operators can configure a dark theme to be retrieved when the users access a URL with the dark subdomain (e.g.: dark.acme.com).

the actual need is to filter based on source IP, the connection to the end user UI specific dashboard

What Apache CloudStack allows the operator to control is the IPv4/IPv6 CIDRs from which API calls can be performed. This can be configured through the api.allowed.source.cidr.list global configuration, and it can be overwritten on account level as well.

Also, is there a guide out there to describe the methods to achieve isolation per tenant/customer?

One option to achieve tenant isolation is through domains. Multiple accounts of a customer can be grouped into a single domain. Another option is to create an account for a customer and create users for that account as needed.