From dc65e5c2ba75e4068b4a3d5c7d7c54e293992ba3 Mon Sep 17 00:00:00 2001
From: mprokopchuk <mprokopchuk@apple.com>
Date: Tue, 11 Aug 2026 19:21:42 +0530
Subject: [PATCH] Allow Domain Admins to provide custom Id for Resource (VM,
 Volume, etc) creation commands.

---
 .../cloud/uuididentity/UUIDManagerImpl.java   | 41 ++++++++++++++++---
 1 file changed, 36 insertions(+), 5 deletions(-)

diff --git a/server/src/main/java/com/cloud/uuididentity/UUIDManagerImpl.java b/server/src/main/java/com/cloud/uuididentity/UUIDManagerImpl.java
index 9b6ac8a960a6..c19cd250bb61 100644
--- a/server/src/main/java/com/cloud/uuididentity/UUIDManagerImpl.java
+++ b/server/src/main/java/com/cloud/uuididentity/UUIDManagerImpl.java
@@ -42,21 +42,52 @@ public class UUIDManagerImpl implements UUIDManager {
 
     @Override
     public <T> void checkUuid(String uuid, Class<T> entityType) {
+        checkUuid(uuid, entityType, false);
+    }
+
+    /**
+     * Validate UUID (validate format, allowed user role and UUID uniqueness across the resource).
+     *
+     * @param uuid                         UUID
+     * @param entityType                   the resource for which UUID is provided
+     * @param allowUuidFromDomainAdminRole allow Domain Admin user to provide UUID
+     */
+    private <T> void checkUuid(String uuid, Class<T> entityType, boolean allowUuidFromDomainAdminRole) {
 
         if (uuid == null) {
             return;
         }
 
         Account caller = CallContext.current().getCallingAccount();
+        long callerId = caller.getId();
 
-        // Only admin and system allowed to do this
-        if (!(caller.getId() == Account.ACCOUNT_ID_SYSTEM || _accountMgr.isRootAdmin(caller.getId()))) {
-            throw new PermissionDeniedException("Please check your permissions, you are not allowed to create/update custom id");
-        }
+        validateCustomIdOperation(callerId, allowUuidFromDomainAdminRole);
 
         checkUuidSimple(uuid, entityType);
     }
 
+    /**
+     * Validates that the caller is allowed to provide a custom id. Allowed callers are the system
+     * account and ROOT admins, plus domain admins when allowUuidFromDomainAdminRole is true.
+     *
+     * @param callerId                     the calling account id
+     * @param allowUuidFromDomainAdminRole allow Domain Admin user to provide UUID
+     * @throws PermissionDeniedException if the caller is not allowed to provide a custom id
+     */
+    private void validateCustomIdOperation(long callerId, boolean allowUuidFromDomainAdminRole) {
+        // if not system account
+        boolean operationDenied = callerId != Account.ACCOUNT_ID_SYSTEM
+                // and not root admin
+                && !_accountMgr.isRootAdmin(callerId)
+                // and if not domain admin (if allowUuidFromDomainAdminRole == true)
+                && !(allowUuidFromDomainAdminRole && _accountMgr.isDomainAdmin(callerId));
+
+        // Only admin and system allowed to do this, optionally domain admins allowed to do as well.
+        if (operationDenied) {
+            throw new PermissionDeniedException("Please check your permissions, you are not allowed to create/update custom id");
+        }
+    }
+
     @Override
     public <T> void checkUuidSimple(String uuid, Class<T> entityType) {
 
@@ -107,7 +138,7 @@ public <T> String generateUuid(Class<T> entityType, String customId) {
 
             throw new CloudRuntimeException("Unable to generate a unique uuid, please try again");
         } else {
-            checkUuid(customId, entityType);
+            checkUuid(customId, entityType, true);
             return customId;
         }
     }