<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Le 21/11/2013 10:04, Yuriy Taraday a
écrit :<br>
</div>
<blockquote
cite="mid:CABocrW5arDz0Sg2OnX5EeqKMQ24ue8jJ5c9LWi7mLA6nXZ+r0A@mail.gmail.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div class="gmail_extra">
<div class="gmail_quote">On Thu, Nov 21, 2013 at 12:37 PM,
Sylvain Bauza <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:sylvain.bauza@bull.net" target="_blank">sylvain.bauza@bull.net</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<div>Hi Yuriy, Dolph et al.<br>
<br>
I'm implementing a climate.policy.check_is_admin(ctx)
which will look at policy.json entry
'context_is_admin' for knowing which roles do have
elevated rights for Climate.<br>
<br>
This check must be called when creating a context for
knowing if we can allow extra rights. The is_admin
flag is pretty handsome because it can be triggered
upon that check.<br>
<br>
If we say that one is bad, how should we manage that ?<br>
<br>
-Sylvain<br>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>There should be no need for is_admin and some special
policy rule like "context_is_admin". </div>
<div>Every action that might require granular access control
(for controllers it should be every action at all, I
guess) should call enforce() from openstack.common.policy
to check appropriate rule in policy.json.</div>
<div>Rules for actions that require user to be admin should
contain a reference to some basic rule like
"admin_required" in Keystone (see <a
moz-do-not-send="true"
href="https://github.com/openstack/keystone/blob/master/etc/policy.json">https://github.com/openstack/keystone/blob/master/etc/policy.json</a>).</div>
<div><br>
</div>
<div>We should not check from code if the user is an admin.
We should always ask openstack.common.policy if the user
have access to the action.</div>
</div>
<div><br>
</div>
-- <br>
<br>
<div>Kind regards, Yuriy.</div>
</div>
</div>
</blockquote>
<br>
<br>
Thanks for all your thoughts, really appreciated. OK, I will discuss
with Swann and see what needs to be modified accordingly.<br>
<br>
I'll deliver a new patchset for
<a class="moz-txt-link-freetext" href="https://review.openstack.org/#/c/57200/">https://review.openstack.org/#/c/57200/</a> (policies) based on Context
patch from Swann and having is_admin, and then I'll iterate removing
the necessary parts.<br>
<br>
-Sylvain<br>
(Btw, that's bad I spent a few days implementing policies without
clear guidelines and copying Nova stuff with latest Oslo policies,
we definitely need developer documentation for that...)<br>
<br>
<br>
<br>
</body>
</html>