<html><body>
<p><tt><font size="2">"Bak, Ed (HPCS Fort Collins)" <ed.bak2@hp.com> wrote on 04/25/2013 12:58:07 PM:<br>
<br>
> From: "Bak, Ed (HPCS Fort Collins)" <ed.bak2@hp.com></font></tt><br>
<tt><font size="2">> To: OpenStack Development Mailing List <openstack-dev@lists.openstack.org>, </font></tt><br>
<tt><font size="2">> Date: 04/25/2013 03:18 PM</font></tt><br>
<tt><font size="2">> Subject: Re: [openstack-dev] view-only use case but APIs are admin-only</font></tt><br>
<tt><font size="2">> <br>
> We also have a need for various explicit roles which we can’t put in<br>
> place because of this issue. I have also noticed cases where <br>
> certain rules aren’t granular enough and several places where an <br>
> incorrect policy returns an HTTP 500 instead of an HTTP 403. I’m <br>
> willing to fix all of this but I would like some buy in on a <br>
> solution before I submit the code in order to minimize rework. I <br>
> can turn this discussion into a blueprint if that is more <br>
> appropriate. I would like to propose the following;</font></tt><br>
<tt><font size="2">> </font></tt><br>
<tt><font size="2">> 1. Remove the require_admin_context everywhere. Access to <br>
> actions will then only be controlled through roles specified through<br>
> policy.json.</font></tt><br>
<tt><font size="2">> 2. Fix the cases where a single rule can apply to multiple <br>
> actions. In most cases the groupings make sense, but making things <br>
> as granular as possible will allow everyone to define rules and <br>
> roles in the most flexible way possible.</font></tt><br>
<tt><font size="2">> 3. Fix the error handling so that invalid permissions always <br>
> return a 403.</font></tt><br>
<tt><font size="2">> 4. Remove the concept of a default rule. In order to avoid <br>
> inadvertently opening up any current admin only functions, the <br>
> default behavior when a rule is not specified should be a failure ( <br>
> or maybe require admin in this case ).</font></tt><br>
<br>
<tt><font size="2">+1 to all these proposals (and to turning this into a blueprint). </font></tt><br>
<br>
<tt><font size="2">Just for clarity, are you talking about fixing Nova only or across all the projects?</font></tt><br>
<br>
<font size="2" face="sans-serif">Michael<br>
<br>
-------------------------------------------------<br>
Michael Fork<br>
Architect, OpenStack Development<br>
IBM Systems & Technology Group</font><br>
</body></html>