1.

取消userCred.IsSystemAdmin()，在使用policy的应用中，通过userCred.IsAdminAllow判断是否是管理员且具备相应的权限。获取token时，需要传入policy.FilterPolicyCredential，将普通userCred转换成支持rbac的userCred
2. 在应用启动时候，必须设置 SetServiceType，否则退出

pkg/cloudcommon/auth.go

@@ -3,13 +3,14 @@ package cloudcommon
 import (
 	"fmt"
 	"os"
-
 	"time"
+
 	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/mcclient/auth"
 )
 
 func InitAuth(options *Options, authComplete auth.AuthCompletedCallback) {
+
 	if len(options.AuthURL) == 0 {
 		fmt.Println("Missing AuthURL")
 		os.Exit(1)

pkg/cloudcommon/db/db_dispatcher.go

@@ -65,7 +65,7 @@ func (dispatcher *DBModelDispatcher) Filter(f appsrv.FilterHandler) appsrv.Filte
 }
 
 func fetchUserCredential(ctx context.Context) mcclient.TokenCredential {
-	token := auth.FetchUserCredential(ctx)
+	token := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 	if token == nil && !consts.IsRbacEnabled() {
 		log.Fatalf("user token credential not found?")
 	}
@@ -113,7 +113,7 @@ func listFields(manager IModelManager, userCred mcclient.TokenCredential) []stri
 		if !utils.IsInStringArray(list, []string{"user", "admin", ""}) {
 			log.Warningf("Invalid list value %s for field %s", list, col.Name())
 		}
-		if list == "user" || (list == "admin" && userCred.IsSystemAdmin()) {
+		if list == "user" || (list == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -127,7 +127,7 @@ func searchFields(manager IModelManager, userCred mcclient.TokenCredential) []st
 		tags := col.Tags()
 		list := tags["list"]
 		search := tags["search"]
-		if list == "user" || search == "user" || ((list == "admin" || search == "admin") && userCred.IsSystemAdmin()) {
+		if list == "user" || search == "user" || ((list == "admin" || search == "admin") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -140,7 +140,7 @@ func getDetailFields(manager IModelManager, userCred mcclient.TokenCredential) [
 		tags := col.Tags()
 		list := tags["list"]
 		get := tags["get"]
-		if list == "user" || get == "user" || ((list == "admin" || get == "admin") && userCred.IsSystemAdmin()) {
+		if list == "user" || get == "user" || ((list == "admin" || get == "admin") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionGet)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -152,7 +152,7 @@ func createRequireFields(manager IModelManager, userCred mcclient.TokenCredentia
 	for _, col := range manager.TableSpec().Columns() {
 		tags := col.Tags()
 		create, _ := tags["create"]
-		if create == "required" || (create == "admin_required" && userCred.IsSystemAdmin()) {
+		if create == "required" || (create == "admin_required" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -166,7 +166,7 @@ func createFields(manager IModelManager, userCred mcclient.TokenCredential) []st
 		tags := col.Tags()
 		create, _ := tags["create"]
 		update := tags["update"]
-		if update == "user" || (update == "admin" && userCred.IsSystemAdmin()) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && userCred.IsSystemAdmin()) {
+		if update == "user" || (update == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -179,7 +179,7 @@ func updateFields(manager IModelManager, userCred mcclient.TokenCredential) []st
 	for _, col := range manager.TableSpec().Columns() {
 		tags := col.Tags()
 		update := tags["update"]
-		if update == "user" || (update == "admin" && userCred.IsSystemAdmin()) {
+		if update == "user" || (update == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionUpdate)) {
 			ret = append(ret, col.Name())
 		}
 	}
@@ -315,7 +315,7 @@ func query2List(manager IModelManager, ctx context.Context, userCred mcclient.To
 	}
 	listF := listFields(manager, userCred)
 	fieldFilter := jsonutils.GetQueryStringArray(query, "field")
-	if len(fieldFilter) > 0 && userCred.IsSystemAdmin() {
+	if len(fieldFilter) > 0 && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) {
 		// only sysadmin can specify list Fields
 		listF = fieldFilter
 	}
@@ -735,7 +735,7 @@ func fetchOwnerProjectId(ctx context.Context, manager IModelManager, userCred mc
 			isAllow = true
 		}
 	} else {
-		isAllow = userCred.IsSystemAdmin()
+		isAllow = userCred.IsAdminAllow(consts.GetServiceType(), policy.PolicyDelegation, "")
 	}
 	if !isAllow {
 		return "", httperrors.NewForbiddenError("Delegation not allowed")

pkg/cloudcommon/db/enabledstatusstandalone.go

@@ -5,6 +5,8 @@ import (
 
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/mcclient"
 )
 
@@ -23,7 +25,7 @@ func NewEnabledStatusStandaloneResourceBaseManager(dt interface{}, tableName str
 }
 
 func (self *SEnabledStatusStandaloneResourceBase) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "enable")
 }
 
 func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -42,7 +44,7 @@ func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Cont
 }
 
 func (self *SEnabledStatusStandaloneResourceBase) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "disable")
 }
 
 func (self *SEnabledStatusStandaloneResourceBase) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/cloudcommon/db/interface.go

@@ -69,6 +69,8 @@ type IModel interface {
 
 	GetName() string
 
+	KeywordPlural() string
+
 	GetModelManager() IModelManager
 	SetModelManager(IModelManager)
 
@@ -164,7 +166,7 @@ type IVirtualModel interface {
 	IStandaloneModel
 
 	IsOwner(userCred mcclient.TokenCredential) bool
-	IsAdmin(userCred mcclient.TokenCredential) bool
+	// IsAdmin(userCred mcclient.TokenCredential) bool
 }
 
 type ISharableVirtualModelManager interface {

pkg/cloudcommon/db/jointbase.go

@@ -8,6 +8,8 @@ import (
 
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/mcclient"
 	"yunion.io/x/pkg/util/reflectutils"
 	"yunion.io/x/sqlchemy"
@@ -191,7 +193,7 @@ func (self *SJointResourceBase) AllowGetJointDetails(ctx context.Context, userCr
 	master := item.Master()
 	switch master.(type) {
 	case IVirtualModel:
-		return master.(IVirtualModel).IsOwner(userCred)
+		return master.(IVirtualModel).IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), master.KeywordPlural(), policy.PolicyActionGet)
 	default: // case item implemented customized AllowGetDetails, eg hostjoints
 		return item.AllowGetDetails(ctx, userCred, query)
 	}
@@ -201,7 +203,7 @@ func (self *SJointResourceBase) AllowUpdateJointItem(ctx context.Context, userCr
 	master := item.Master()
 	switch master.(type) {
 	case IVirtualModel:
-		return master.(IVirtualModel).IsOwner(userCred)
+		return master.(IVirtualModel).IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), master.KeywordPlural(), policy.PolicyActionUpdate)
 	default: // case item implemented customized AllowGetDetails, eg hostjoints
 		return item.AllowUpdateItem(ctx, userCred)
 	}

pkg/cloudcommon/db/metadata.go

@@ -11,7 +11,9 @@ import (
 	"yunion.io/x/onecloud/pkg/mcclient"
 	"yunion.io/x/pkg/util/stringutils"
 
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 )
 
 const (
@@ -65,7 +67,7 @@ raise Exception('get_object_idstr: failed to generate obj ID')
 return idstr */
 
 func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCred mcclient.TokenCredential) string {
-	if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsSystemAdmin()) {
+	if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata")) {
 		return ""
 	}
 	idStr := GetObjectIdstr(model)
@@ -78,7 +80,7 @@ func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCr
 }
 
 func (manager *SMetadataManager) GetJsonValue(model IModel, key string, userCred mcclient.TokenCredential) jsonutils.JSONObject {
-	if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsSystemAdmin()) {
+	if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata")) {
 		return nil
 	}
 	idStr := GetObjectIdstr(model)
@@ -194,7 +196,7 @@ func (manager *SMetadataManager) GetAll(obj IModel, keys []string, userCred mccl
 	for _, rec := range records {
 		if len(rec.Value) > 0 {
 			if strings.HasPrefix(rec.Key, SYSTEM_ADMIN_PREFIX) {
-				if userCred != nil && userCred.IsSystemAdmin() {
+				if userCred != nil && userCred.IsAdminAllow(consts.GetServiceType(), obj.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata") {
 					key := rec.Key[len(SYSTEM_ADMIN_PREFIX):]
 					ret[key] = rec.Value
 				}

pkg/cloudcommon/db/modelbase.go

@@ -6,6 +6,8 @@ import (
 	"fmt"
 
 	"yunion.io/x/jsonutils"
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/mcclient"
 	"yunion.io/x/sqlchemy"
 )
@@ -151,7 +153,7 @@ func (manager *SModelBaseManager) PerformAction(ctx context.Context, userCred mc
 }
 
 func (manager *SModelBaseManager) AllowPerformCheckCreateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionPerform, "check-create-data")
 }
 
 func (manager *SModelBaseManager) InitializeData() error {
@@ -178,6 +180,10 @@ func (model *SModelBase) Keyword() string {
 	return model.GetModelManager().Keyword()
 }
 
+func (model *SModelBase) KeywordPlural() string {
+	return model.GetModelManager().KeywordPlural()
+}
+
 func (model *SModelBase) GetName() string {
 	return ""
 }

pkg/cloudcommon/db/opslog.go

@@ -9,6 +9,8 @@ import (
 
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/mcclient"
 	"yunion.io/x/onecloud/pkg/util/logclient"
 	"yunion.io/x/pkg/util/stringutils"
@@ -293,7 +295,7 @@ func (manager *SOpsLogManager) ListItemFilter(ctx context.Context, q *sqlchemy.S
 		queryDict.RemoveIgnoreCase("action")
 		q = q.Filter(sqlchemy.In(q.Field("action"), action))
 	}
-	if !userCred.IsSystemAdmin() {
+	if !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) {
 		q = q.Filter(sqlchemy.OR(sqlchemy.AND(sqlchemy.IsNotNull(q.Field("owner_tenant_id")), sqlchemy.Equals(q.Field("owner_tenant_id"), userCred.GetProjectId())), sqlchemy.Equals(q.Field("tenant_id"), userCred.GetProjectId())))
 	}
 	since, _ := query.GetTime("since")
@@ -324,7 +326,7 @@ func (manager *SOpsLogManager) AllowCreateItem(ctx context.Context, userCred mcc
 }
 
 func (self *SOpsLog) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin() || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId
+	return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet) || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId
 }
 
 func (self *SOpsLog) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {

pkg/cloudcommon/db/quotas/handler.go

@@ -72,7 +72,7 @@ func queryQuota(ctx context.Context, projectId string) (*jsonutils.JSONDict, err
 }
 
 func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-	userCred := auth.FetchUserCredential(ctx)
+	userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 	params := appctx.AppContextParams(ctx)
 
 	projectId := params["<tenantid>"]
@@ -93,7 +93,7 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request
 				policy.PolicyDelegation, policy.PolicyActionGet)
 			isAllow = result == rbacutils.AdminAllow
 		} else {
-			isAllow = userCred.IsSystemAdmin()
+			isAllow = userCred.IsAdminAllow(consts.GetServiceType(), policy.PolicyDelegation, policy.PolicyActionGet)
 		}
 		if !isAllow {
 			httperrors.ForbiddenError(w, "not allow to delegate query quota")
@@ -133,14 +133,15 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request
 }
 
 func setQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-	userCred := auth.FetchUserCredential(ctx)
+	userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 
 	var isAllow bool
 	if consts.IsRbacEnabled() {
 		isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
 			"quotas", policy.PolicyActionUpdate) == rbacutils.AdminAllow
 	} else {
-		isAllow = userCred.IsSystemAdmin()
+		isAllow = userCred.IsAdminAllow(consts.GetServiceType(),
+			"quotas", policy.PolicyActionUpdate)
 	}
 	if !isAllow {
 		httperrors.ForbiddenError(w, "not allow to set quota")
@@ -196,14 +197,15 @@ func setQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request
 }
 
 func checkQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) {
-	userCred := auth.FetchUserCredential(ctx)
+	userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential)
 
 	isAllow := false
 	if consts.IsRbacEnabled() {
 		isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(),
 			policy.PolicyDelegation, policy.PolicyActionGet) == rbacutils.AdminAllow
 	} else {
-		isAllow = userCred.IsSystemAdmin()
+		isAllow = userCred.IsAdminAllow(consts.GetServiceType(),
+			policy.PolicyDelegation, policy.PolicyActionGet)
 	}
 	if !isAllow {
 		httperrors.ForbiddenError(w, "not allow to delegate check quota")

pkg/cloudcommon/db/sharablevirtual.go

@@ -4,6 +4,8 @@ import (
 	"context"
 
 	"yunion.io/x/jsonutils"
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/mcclient"
 	"yunion.io/x/sqlchemy"
 )
@@ -30,7 +32,7 @@ func (manager *SSharableVirtualResourceBaseManager) FilterByOwner(q *sqlchemy.SQ
 }
 
 func (model *SSharableVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return model.IsOwner(userCred) || model.IsPublic
+	return model.IsOwner(userCred) || model.IsPublic || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet)
 }
 
 func (model *SSharableVirtualResourceBase) IsSharable() bool {
@@ -38,11 +40,11 @@ func (model *SSharableVirtualResourceBase) IsSharable() bool {
 }
 
 func (model *SSharableVirtualResourceBase) AllowPerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "public")
 }
 
 func (model *SSharableVirtualResourceBase) AllowPerformPrivate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "private")
 }
 
 func (model *SSharableVirtualResourceBase) PerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/cloudcommon/db/standalone.go

@@ -7,6 +7,8 @@ import (
 
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/mcclient"
 	"yunion.io/x/pkg/util/regutils"
@@ -147,7 +149,7 @@ func (model *SStandaloneResourceBase) GetMetadataJson(key string, userCred mccli
 }
 
 func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key string, value interface{}, userCred mcclient.TokenCredential) error {
-	if Metadata.IsSystemAdminKey(key) && !userCred.IsSystemAdmin() {
+	if Metadata.IsSystemAdminKey(key) && !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata") {
 		return httperrors.NewNotSufficientPrivilegeError("cannot set system key")
 	}
 	return Metadata.SetValue(ctx, model, key, value, userCred)
@@ -155,7 +157,7 @@ func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key strin
 
 func (model *SStandaloneResourceBase) SetAllMetadata(ctx context.Context, dictstore map[string]interface{}, userCred mcclient.TokenCredential) error {
 	for k := range dictstore {
-		if Metadata.IsSystemAdminKey(k) && !userCred.IsSystemAdmin() {
+		if Metadata.IsSystemAdminKey(k) && !userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata") {
 			return httperrors.NewNotSufficientPrivilegeError(fmt.Sprintf("not allow to set system key %s", k))
 		}
 	}
@@ -175,7 +177,7 @@ func (model *SStandaloneResourceBase) GetAllMetadata(userCred mcclient.TokenCred
 }
 
 func (model *SStandaloneResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet, "metadata")
 }
 
 func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) {
@@ -188,7 +190,7 @@ func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, us
 }
 
 func (model *SStandaloneResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "metadata")
 }
 
 func (model *SStandaloneResourceBase) PerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/cloudcommon/db/statusstandalone.go

@@ -6,6 +6,8 @@ import (
 	"strings"
 
 	"yunion.io/x/jsonutils"
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/mcclient"
 	"yunion.io/x/onecloud/pkg/util/logclient"
 )
@@ -50,7 +52,7 @@ func (model *SStatusStandaloneResourceBase) SetStatus(userCred mcclient.TokenCre
 }
 
 func (model *SStatusStandaloneResourceBase) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "status")
 }
 
 func (model *SStatusStandaloneResourceBase) PerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/cloudcommon/db/taskman/tasks.go

@@ -18,9 +18,11 @@ import (
 	"yunion.io/x/pkg/utils"
 	"yunion.io/x/sqlchemy"
 
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/quotas"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 )
 
 const (
@@ -70,7 +72,7 @@ type STask struct {
 }
 
 func (manager *STaskManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return true
 }
 
 func (manager *STaskManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
@@ -115,7 +117,7 @@ func (manager *STaskManager) FilterByOwner(q *sqlchemy.SQuery, owner string) *sq
 }
 
 func (self *STask) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin() || userCred.GetProjectId() == self.UserCred.GetProjectId()
+	return userCred.IsAdminAllow(consts.GetServiceType(), self.GetModelManager().KeywordPlural(), policy.PolicyActionGet) || userCred.GetProjectId() == self.UserCred.GetProjectId()
 }
 
 func (self *STask) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {

pkg/cloudcommon/db/virtualjointbase.go

@@ -10,6 +10,8 @@ import (
 	"yunion.io/x/pkg/util/reflectutils"
 	"yunion.io/x/sqlchemy"
 
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/mcclient"
 )
@@ -27,7 +29,7 @@ func NewVirtualJointResourceBaseManager(dt interface{}, tableName string, keywor
 }
 
 func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	if jsonutils.QueryBoolean(query, "admin", false) && !userCred.IsSystemAdmin() {
+	if jsonutils.QueryBoolean(query, "admin", false) && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) {
 		return false
 	}
 	return true
@@ -36,7 +38,7 @@ func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Cont
 
 func (manager *SVirtualJointResourceBaseManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, master IStandaloneModel, query jsonutils.JSONObject) bool {
 	masterVirtual := master.(IVirtualModel)
-	if masterVirtual.IsOwner(userCred) {
+	if masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionList) {
 		return true
 	}
 	return false
@@ -62,12 +64,12 @@ func (manager *SVirtualJointResourceBaseManager) AllowAttach(ctx context.Context
 
 func (self *SVirtualJointResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
 	masterVirtual := self.Master().(IVirtualModel)
-	return masterVirtual.IsOwner(userCred)
+	return masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionGet)
 }
 
 func (self *SVirtualJointResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
 	masterVirtual := self.Master().(IVirtualModel)
-	return masterVirtual.IsOwner(userCred)
+	return masterVirtual.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), masterVirtual.KeywordPlural(), policy.PolicyActionUpdate)
 }
 
 func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) {
@@ -96,7 +98,7 @@ func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Cont
 		sqlchemy.IsFalse(masterTable.Field("deleted"))))
 	q = q.Join(slaveTable, sqlchemy.AND(sqlchemy.Equals(slaveField, slaveTable.Field("id")),
 		sqlchemy.IsFalse(slaveTable.Field("deleted"))))
-	if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsSystemAdmin() {
+	if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) {
 		isSystem := jsonutils.QueryBoolean(query, "system", false)
 		if !isSystem {
 			if len(slaveQueryId) == 0 {

pkg/cloudcommon/db/virtualresource.go

@@ -12,7 +12,9 @@ import (
 	"yunion.io/x/pkg/utils"
 	"yunion.io/x/sqlchemy"
 
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
+	"yunion.io/x/onecloud/pkg/cloudcommon/policy"
 	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/mcclient"
 )
@@ -38,12 +40,12 @@ type SVirtualResourceBase struct {
 }
 
 func (model *SVirtualResourceBase) IsOwner(userCred mcclient.TokenCredential) bool {
-	return userCred.IsSystemAdmin() || userCred.GetProjectId() == model.ProjectId
+	return userCred.GetProjectId() == model.ProjectId
 }
 
-func (model *SVirtualResourceBase) IsAdmin(userCred mcclient.TokenCredential) bool {
+/*func (model *SVirtualResourceBase) IsAdmin(userCred mcclient.TokenCredential) bool {
 	return userCred.IsSystemAdmin() || (userCred.GetProjectId() == model.ProjectId && userCred.IsAdmin())
-}
+}*/
 
 func (model *SVirtualResourceBase) GetOwnerProjectId() string {
 	return model.ProjectId
@@ -111,7 +113,7 @@ func (manager *SVirtualResourceBaseManager) ListItemFilter(ctx context.Context,
 
 func (manager *SVirtualResourceBaseManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
 	isSystem, err := data.Bool("is_system")
-	if err == nil && isSystem && !userCred.IsSystemAdmin() {
+	if err == nil && isSystem && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) {
 		return nil, httperrors.NewNotSufficientPrivilegeError("non-admin user not allowed to create system object")
 	}
 	return manager.SStandaloneResourceBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data)
@@ -130,14 +132,14 @@ func (model *SVirtualResourceBase) CustomizeCreate(ctx context.Context, userCred
 
 func (manager *SVirtualResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
 	isAdmin, err := query.Bool("admin")
-	if err == nil && isAdmin && !userCred.IsSystemAdmin() {
+	if err == nil && isAdmin && !userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) {
 		return false
 	}
 	return true
 }
 
 func (model *SVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return model.IsOwner(userCred)
+	return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet)
 }
 
 func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
@@ -145,19 +147,19 @@ func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context,
 }
 
 func (model *SVirtualResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
-	return model.IsOwner(userCred)
+	return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionUpdate)
 }
 
 func (model *SVirtualResourceBase) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return model.IsOwner(userCred)
+	return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionDelete)
 }
 
 func (model *SVirtualResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return model.IsOwner(userCred)
+	return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionGet, "metadata")
 }
 
 func (model *SVirtualResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return model.IsOwner(userCred)
+	return model.IsOwner(userCred) || userCred.IsAdminAllow(consts.GetServiceType(), model.KeywordPlural(), policy.PolicyActionPerform, "metadata")
 }
 
 func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant, error) {
@@ -166,7 +168,7 @@ func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant
 }
 
 func (model *SVirtualResourceBase) getMoreDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, extra *jsonutils.JSONDict) *jsonutils.JSONDict {
-	if userCred.IsSystemAdmin() {
+	if userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionGet) {
 		// log.Debugf("GetCustomizeColumns")
 		tobj, err := model.GetTenantCache(ctx)
 		if err == nil {
@@ -198,7 +200,7 @@ func (model *SVirtualResourceBase) GetExtraDetails(ctx context.Context, userCred
 }
 
 func (model *SVirtualResourceBase) AllowPerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
-	return userCred.IsSystemAdmin()
+	return userCred.IsAdminAllow(consts.GetServiceType(), model.GetModelManager().KeywordPlural(), policy.PolicyActionPerform, "change-owner")
 }
 
 func (model *SVirtualResourceBase) PerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {

pkg/cloudcommon/options.go

@@ -63,6 +63,10 @@ func (this *DBOptions) GetDBConnection() (dialect, connstr string, err error) {
 }
 
 func ParseOptions(optStruct interface{}, optionsRef *Options, args []string, configFileName string) {
+	if len(consts.GetServiceType()) == 0 {
+		log.Fatalf("ServiceType not initialized!")
+	}
+
 	serviceName := path.Base(args[0])
 	parser, err := structarg.NewArgumentParser(optStruct,
 		serviceName,

pkg/cloudcommon/policy/policy.go

@@ -90,6 +90,12 @@ var (
 			Action:   PolicyActionCreate,
 			Result:   rbacutils.UserAllow,
 		},
+		{
+			Service:  "yunionconf",
+			Resource: "parameters",
+			Action:   PolicyActionGet,
+			Result:   rbacutils.OwnerAllow,
+		},
 	}
 )
 
@@ -278,7 +284,7 @@ func (manager *SPolicyManager) explainPolicy(userCred mcclient.TokenCredential,
 	if !consts.IsRbacEnabled() {
 		if !isAdmin {
 			return reqStrs, rbacutils.OwnerAllow, nil
-		} else if isAdmin && userCred.IsSystemAdmin() {
+		} else if isAdmin && userCred.HasSystemAdminPrivelege() {
 			return reqStrs, rbacutils.AdminAllow, nil
 		} else {
 			return reqStrs, rbacutils.Deny, httperrors.NewForbiddenError("operation not allowed")
@@ -305,7 +311,7 @@ func (manager *SPolicyManager) ExplainRpc(userCred mcclient.TokenCredential, par
 }
 
 func (manager *SPolicyManager) IsAdminCapable(userCred mcclient.TokenCredential) bool {
-	if !consts.IsRbacEnabled() && userCred.IsSystemAdmin() {
+	if !consts.IsRbacEnabled() && userCred.HasSystemAdminPrivelege() {
 		return true
 	}
 

pkg/cloudcommon/policy/token.go

@@ -0,0 +1,145 @@
+package policy
+
+import (
+	"time"
+
+	"yunion.io/x/jsonutils"
+	"yunion.io/x/pkg/gotypes"
+
+	"yunion.io/x/onecloud/pkg/cloudcommon/consts"
+	"yunion.io/x/onecloud/pkg/mcclient"
+	"yunion.io/x/onecloud/pkg/util/rbacutils"
+)
+
+type SPolicyTokenCredential struct {
+	Token mcclient.TokenCredential
+}
+
+func (self *SPolicyTokenCredential) String() string {
+	return self.Token.String()
+}
+
+func (self *SPolicyTokenCredential) IsZero() bool {
+	return self.Token.IsZero()
+}
+
+func (self *SPolicyTokenCredential) GetProjectId() string {
+	return self.Token.GetProjectId()
+}
+
+func (self *SPolicyTokenCredential) GetTenantId() string {
+	return self.Token.GetTenantId()
+}
+
+func (self *SPolicyTokenCredential) GetUserId() string {
+	return self.Token.GetUserId()
+}
+
+func (self *SPolicyTokenCredential) GetServiceURL(service, region, zone, endpointType string) (string, error) {
+	return self.Token.GetServiceURL(service, region, zone, endpointType)
+}
+
+func (self *SPolicyTokenCredential) GetServiceURLs(service, region, zone, endpointType string) ([]string, error) {
+	return self.Token.GetServiceURLs(service, region, zone, endpointType)
+}
+
+func (self *SPolicyTokenCredential) GetTokenString() string {
+	return self.Token.GetTokenString()
+}
+
+func (self *SPolicyTokenCredential) GetDomainId() string {
+	return self.Token.GetDomainId()
+}
+
+func (self *SPolicyTokenCredential) GetDomainName() string {
+	return self.Token.GetDomainName()
+}
+
+func (self *SPolicyTokenCredential) GetTenantName() string {
+	return self.Token.GetTenantName()
+}
+
+func (self *SPolicyTokenCredential) GetProjectName() string {
+	return self.Token.GetProjectName()
+}
+
+func (self *SPolicyTokenCredential) GetUserName() string {
+	return self.Token.GetUserName()
+}
+
+func (self *SPolicyTokenCredential) GetRoles() []string {
+	return self.Token.GetRoles()
+}
+
+func (self *SPolicyTokenCredential) GetExpires() time.Time {
+	return self.Token.GetExpires()
+}
+
+func (self *SPolicyTokenCredential) IsValid() bool {
+	return self.Token.IsValid()
+}
+
+func (self *SPolicyTokenCredential) ValidDuration() time.Duration {
+	return self.Token.ValidDuration()
+}
+
+func (self *SPolicyTokenCredential) GetRegions() []string {
+	return self.Token.GetRegions()
+}
+
+func (self *SPolicyTokenCredential) GetServiceCatalog() mcclient.IServiceCatalog {
+	return self.Token.GetServiceCatalog()
+}
+
+func (self *SPolicyTokenCredential) GetCatalogData(serviceTypes []string, region string) jsonutils.JSONObject {
+	return self.Token.GetCatalogData(serviceTypes, region)
+}
+
+func (self *SPolicyTokenCredential) GetInternalServices(region string) []string {
+	return self.Token.GetInternalServices(region)
+}
+
+func (self *SPolicyTokenCredential) GetExternalServices(region string) []mcclient.ExternalService {
+	return self.Token.GetExternalServices(region)
+}
+
+func (self *SPolicyTokenCredential) GetEndpoints(region string, endpointType string) []mcclient.Endpoint {
+	return self.Token.GetEndpoints(region, endpointType)
+}
+
+func (self *SPolicyTokenCredential) ToJson() jsonutils.JSONObject {
+	return self.Token.ToJson()
+}
+
+func (self *SPolicyTokenCredential) HasSystemAdminPrivelege() bool {
+	if consts.IsRbacEnabled() {
+		return PolicyManager.IsAdminCapable(self.Token)
+	}
+	return self.Token.HasSystemAdminPrivelege()
+}
+
+func (self *SPolicyTokenCredential) IsAdminAllow(service string, resource string, action string, extra ...string) bool {
+	if consts.IsRbacEnabled() {
+		result := PolicyManager.Allow(true, self.Token, service, resource, action, extra...)
+		return result == rbacutils.AdminAllow
+	}
+	return self.Token.IsAdminAllow(service, resource, action, extra...)
+}
+
+func init() {
+	gotypes.RegisterSerializable(mcclient.TokenCredentialType, func() gotypes.ISerializable {
+		return &SPolicyTokenCredential{}
+	})
+}
+
+func FilterPolicyCredential(token mcclient.TokenCredential) mcclient.TokenCredential {
+	if !consts.IsRbacEnabled() {
+		return token
+	}
+	switch token.(type) {
+	case *SPolicyTokenCredential:
+		return token
+	default:
+		return &SPolicyTokenCredential{Token: token}
+	}
+}