...

1. Cloud admin should be able to to map AD OU / group to a Domain or Account in CloudStack.
2. While mapping a group to AD, the cloud admin should be able to specify the option to include nested groups and the profile to select for the group users (Domain Admin / normal user in case of domain mapping).
3. Once a domain/account is mapped to an AD Group/OU the cloud admin / domain admin will not have the option to manually import users to the domain/account.
4. The "Trust AD" component will automatically authorize users in CloudStack when added to an AD group without manual setup.
5. when users are removed from a group in AD, the account should be blocked access in CloudStack as well. (The resources are still provisioned and running.)

Design Flow

Image Modified

...

DB ChangesDB

API Changes

UI Changes

Testing

Unit Tests

...

References

Bug Reference & Branch