Users have their own self-service API[0] they can call to change their own password. This is separate from the update_user one, and is currently not covered by any policy. There are ways to enforce security regulations (PCI-DSS) on users, which is more defined here[1].
[0] https://developer.openstack.org/api-ref/identity/v3/#change-password-for-user [1] https://docs.openstack.org/keystone/pike/admin/identity-security-compliance.html ** Changed in: keystone Status: New => Invalid -- You received this bug notification because you are a member of Yahoo! Engineering Team, which is subscribed to OpenStack Identity (keystone). https://bugs.launchpad.net/bugs/1796077 Title: policy.json doesn't allow user to change password Status in OpenStack Identity (keystone): Invalid Bug description: Currently in Keystone the default policy.v3cloudsample.json doesn't allow user to change its password. It's defined in: "identity:update_user": "rule:cloud_admin or rule:admin_and_matching_target_user_domain_id" which make user (which is owner in policy.json) unable to change it own password. Not sure if this change is intended or not, but as a operator, I would like to allow users to change its password by default. To manage notifications about this bug go to: https://bugs.launchpad.net/keystone/+bug/1796077/+subscriptions -- Mailing list: https://launchpad.net/~yahoo-eng-team Post to : yahoo-eng-team@lists.launchpad.net Unsubscribe : https://launchpad.net/~yahoo-eng-team More help : https://help.launchpad.net/ListHelp
