<div dir="ltr"><div style>On Thu, Jun 6, 2013 at 1:19 PM, Gaspareto, Otavio <span dir="ltr"><<a href="mailto:otavio.barcelos-gaspareto@hp.com" target="_blank">otavio.barcelos-gaspareto@hp.com</a>></span> wrote:<br></div>
<div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div>
<p class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Thank you guys!<u></u><u></u></span></p>
<p class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Also, more than the
<b>add/delete/update</b> services, the <b>list</b> services could operate based on the domain_id of the user that is calling it.</span></p></div></div></blockquote><div>Services don't have any mapping to domains, so I'm not sure I understand the desired behavior here.<br>
</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div><p class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Today there are the query strings to filter the search, but what happens if the user doesn´t use them? He will be able to list all
projects from all domains, for example.<u></u><u></u></span></p>
<p class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u></span></p></div></div></blockquote><div style>Yes, that's by design (you're literally querying for the entire collection, so that's what you should receive, if not a 403). If policy.json was written to require domain-specific authorization, I would expect this to either require the user to specify the domain in a query string, the results to be limited to projects from the token's scope, or both. I vastly prefer both because I don't like two requests to return different results where it's not obvious as to why they are different (even with Vary: X-Auth-Token).</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div><p class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> <u></u></span></p>
<p class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">To deal with the
<b>domain_id</b> and <b>target.domain_id</b>, what do you think if we take this information based on the user token_id? So, will not be
</span><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">necessary</span><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"> the user send the domain_id</span><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">
in the request.</span></p></div></div></blockquote><div style>The target's domain_id should have to match the domain of a domain-scoped token (which is not necessarily the user's domain ID).</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word"><div><p class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u><u></u></span></p>
<p class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Thanks,<u></u><u></u></span></p>
<p class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Otavio<u></u><u></u></span></p>
<p class=""><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<div>
<div style="border-style:solid none none;border-top-color:rgb(181,196,223);border-top-width:1pt;padding:3pt 0cm 0cm">
<p class=""><b><span style="font-size:10pt;font-family:Tahoma,sans-serif">From:</span></b><span style="font-size:10pt;font-family:Tahoma,sans-serif"> Henry Nash [mailto:<a href="mailto:henryn@linux.vnet.ibm.com" target="_blank">henryn@linux.vnet.ibm.com</a>]
<br>
<b>Sent:</b> quinta-feira, 6 de junho de 2013 12:06<br>
<b>To:</b> OpenStack Development Mailing List<br>
<b>Cc:</b> Knuppe, Gustavo (Brazil R&D-ECL); Gaspareto, Otavio; Rosa, Leandro (Brazil R&D-ECL)<br>
<b>Subject:</b> Re: [openstack-dev] [keystone] Domain admin roles<u></u><u></u></span></p>
</div>
</div><div class="im">
<p class=""><u></u> <u></u></p>
<p class="">To expand on Dolph's comments, the restriction in Grizzly is that you can include a domain_id check in your policy file against apis - however, this will only work if the objects in the parameters of the api calls includes the domain_id
(so that it can be checked by the policy engine). So for instance you can restrict the creation of users, groups and projects to the domain scope of a user by including a policy rule like:<u></u><u></u></p>
<div>
<p class=""><u></u> <u></u></p>
</div>
<div>
<blockquote style="margin-top:5pt;margin-bottom:5pt">
<div>
<div>
<div>
<blockquote style="border-style:none none none solid;border-left-color:rgb(204,204,204);border-left-width:1pt;padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt">
<div>
<div>
<p class=""><b>"domain_id:%(user.domain_id)s"</b><u></u><u></u></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
</div>
<div>
<p class="">(substitute group or project for user in the above as required). <u></u><u></u></p>
</div>
<div>
<p class=""><u></u> <u></u></p>
</div>
<div>
<p class="">The issue is, of course, that this only works for create (since you are passing the object to create), but doesn't work for update or delete. Extending keystone to enable rule definition that checks
<i>the object the api will operate on</i> is what we are working on for Havana.<u></u><u></u></p>
</div>
<div>
<p class=""><u></u> <u></u></p>
</div>
<div>
<p class="">There is a blueprint for this already : <a href="https://blueprints.launchpad.net/keystone/+spec/policy-on-api-target" target="_blank">https://blueprints.launchpad.net/keystone/+spec/policy-on-api-target</a><u></u><u></u></p>
</div>
<div>
<p class=""><u></u> <u></u></p>
</div>
<div>
<p class="">Henry<u></u><u></u></p>
</div>
<div>
<p class=""><u></u> <u></u></p>
<div>
<div>
<p class="">On 6 Jun 2013, at 15:42, Dolph Mathews wrote:<u></u><u></u></p>
</div>
<p class="" style="margin-bottom:12pt"><u></u> <u></u></p>
<div>
<p class="">We're on our way to supporting domain-based role assignments in policy.json, but it's not quite there in grizzly. Related bug:<u></u><u></u></p>
<div>
<p class=""><u></u> <u></u></p>
</div>
<div>
<p class=""> <a href="https://bugs.launchpad.net/keystone/+bug/1187198" target="_blank">https://bugs.launchpad.net/keystone/+bug/1187198</a><u></u><u></u></p>
</div>
<div>
<div>
<p class=""><u></u> <u></u></p>
</div>
<div>
<p class="">(this should probably be turned into a blueprint)<u></u><u></u></p>
</div>
<div>
<p class=""><u></u> <u></u></p>
</div>
<p class="">-Dolph<u></u><u></u></p>
</div>
<div>
<p class=""><u></u> <u></u></p>
<div>
<p class="" style="margin-bottom:12pt">On Thu, Jun 6, 2013 at 9:10 AM, Gaspareto, Otavio <<a href="mailto:otavio.barcelos-gaspareto@hp.com" target="_blank">otavio.barcelos-gaspareto@hp.com</a>> wrote:<u></u><u></u></p>
<div>
<div>
<p class="">Hi Dolph/Guang,<u></u><u></u></p>
<p class=""> <u></u><u></u></p>
<p class="">I’m implementing here a new role, called
<i>domain_admin</i>, where the user with this role will be a manager inside his domain. For this, I’ve created this entry into the policy.json file:
<u></u><u></u></p>
<p class=""> <u></u><u></u></p>
<p class=""><b>"domain_admin_required" : [["role:domain_admin", "domain_id:%(domain_id)s"]],</b><u></u><u></u></p>
<p class=""> <u></u><u></u></p>
<p class="">Testing some services marked with this rule, and using an user that is a
<i>domain_admin</i> I could perform operations in other domains, like create project.<u></u><u></u></p>
<p class=""> <u></u><u></u></p>
<p class="">So, my question: this rule
<b>"domain_id:%(domain_id)s" </b>shouldn’t<b> </b>block operations on domains different from mine?<u></u><u></u></p>
<p class=""> <u></u><u></u></p>
<p class="">Another info, I’m using domain scoped authentication.<u></u><u></u></p>
<p class=""> <u></u><u></u></p>
<p class="">Thanks,<u></u><u></u></p>
<p class=""> <u></u><u></u></p>
<p class=""><b><span style="font-family:Arial,sans-serif">Otavio Gaspareto<br>
</span></b><span style="font-family:Arial,sans-serif;color:rgb(113,113,114)">Software Designer<br>
<br>
</span><u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</div>
<p class=""><u></u> <u></u></p>
</div>
</div></div>
</div>
<br>_______________________________________________<br>
OpenStack-dev mailing list<br>
<a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<br></blockquote></div><br></div></div>