<div dir="ltr"><div><div><div>Hi All,<br><br></div>The correct link is:<br><a href="https://openstack.invisionapp.com/share/9Z3RI8OD7#/screens">https://openstack.invisionapp.com/share/9Z3RI8OD7#/screens</a><br><br></div>Regards,<br></div>Ioram<br><div><div><div><div class="gmail_extra"><br><div class="gmail_quote">2015-08-04 11:42 GMT+01:00 David Chadwick <span dir="ltr"><<a href="mailto:d.w.chadwick@kent.ac.uk" target="_blank">d.w.chadwick@kent.ac.uk</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi All<br>
<br>
Ioram has built a complete set of wireframe policy GUI screens for<br>
comment. He has uploaded them to InVision<br>
<br>
<a href="https://openstack.invisionapp.com/share/HQ3QN2123#/screens" rel="noreferrer" target="_blank">https://openstack.invisionapp.com/share/HQ3QN2123#/screens</a><br>
<br>
Please comment on these in InVision<br>
<br>
regards<br>
<br>
David<br>
<div><div class="h5"><br>
On 03/08/2015 21:39, Lin Hua Cheng wrote:<br>
> Hi Timur,<br>
><br>
> Thanks for bringing this up.<br>
><br>
> I think we can borrow some concept from the Mistral Workbook Builder. I<br>
> like the ability to add items and seeing the preview on the right side.<br>
> We can re-use that part.<br>
><br>
> The challenging part would be building a Rule expression builder that<br>
> supports the policy semantic [1] [2]. We should start with creating some<br>
> mockups. The builder will also be useful even if we don't land the<br>
> dynamic policy in L by adding support of loading local policy files for<br>
> editing and providing export functionality.<br>
><br>
> I imagine there would be a pop-up that will allow user to build the<br>
> expression with support for:<br>
> 1. Building nested expression using AND OR and ()<br>
> 2. Auto-complete that lists:<br>
> - existing rule definition<br>
> - available context variable (like domain_id, user_id, target.token)<br>
><br>
> Just throwing some ideas around.<br>
><br>
> This is a good opportunity to engage the new UX project they might have<br>
> a better idea how the Expression Builder should look like. :)<br>
><br>
> Thanks,<br>
> Lin<br>
><br>
> [1]<br>
> <a href="https://github.com/openstack/oslo.policy/blob/master/oslo_policy/policy.py#L18-L210" rel="noreferrer" target="_blank">https://github.com/openstack/oslo.policy/blob/master/oslo_policy/policy.py#L18-L210</a><br>
> [2]<br>
> <a href="http://docs.openstack.org/kilo/config-reference/content/policy-json-file.html" rel="noreferrer" target="_blank">http://docs.openstack.org/kilo/config-reference/content/policy-json-file.html</a><br>
><br>
><br>
> On Mon, Aug 3, 2015 at 5:10 AM, Timur Sufiev <<a href="mailto:tsufiev@mirantis.com">tsufiev@mirantis.com</a><br>
</div></div><div><div class="h5">> <mailto:<a href="mailto:tsufiev@mirantis.com">tsufiev@mirantis.com</a>>> wrote:<br>
><br>
> Hello, folks!<br>
><br>
> A word has come to me that on the recent Keystone mid-cycle summit<br>
> dynamic policies have been discussed - as well as the lack of means<br>
> to edit them in UX-friendly manner. I had my own share of editing<br>
> *_policy.json files inside openstack_dashboard/conf and can hardly<br>
> state it's easy. At least, when dynamic policies are fully supported<br>
> by all OpenStack services we will have no longer to edit the same<br>
> files on every controller node in case of HA installations. Still,<br>
> the problem of editing a single policy file remains. AFAIK, the<br>
> obscurity of policy rules' format had lead may deployers to the<br>
> copy-pasting existing rules with minimal changes - when they were<br>
> meant to a flexible tool for RBAC definitions.<br>
><br>
> But I wouldn't write this letter, if I didn't have some kind of<br>
> solution to the task of editing the policies. During my work on<br>
> Merlin framework/Mistral Workbook Builder I've achieved some results<br>
> that might be useful for a Keystone community. More specifically,<br>
> visual structure and type of relations between Workbook entities<br>
> appeared to me to be similar to the entities of Keystone policies.<br>
> Understanding that some things are better seen in dynamic than in<br>
> static screenshots, I'm sharing the address of the VM where the<br>
> Workbook builder is deployed inside<br>
> Horizon: <a href="http://horizon-merlin.mirantis.com/horizon/project/" rel="noreferrer" target="_blank">http://horizon-merlin.mirantis.com/horizon/project/</a><br>
> Credentials are demo/demo. Some features like saving the workbooks<br>
> to db or the rest OpenStack control plane are disabled for security<br>
> reasons, leaving only the Workbook Builder UI there.<br>
><br>
> I'd like to start the discussion about the extent of reusing Merlin<br>
> UI elements for making a dynamic policies editor.<br>
><br>
> __________________________________________________________________________<br>
> OpenStack Development Mailing List (not for usage questions)<br>
> Unsubscribe:<br>
> <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
</div></div>> <<a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a>><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
<div class="HOEnZb"><div class="h5">><br>
><br>
><br>
><br>
> __________________________________________________________________________<br>
> OpenStack Development Mailing List (not for usage questions)<br>
> Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
> <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
><br>
<br>
__________________________________________________________________________<br>
OpenStack Development Mailing List (not for usage questions)<br>
Unsubscribe: <a href="http://OpenStack-dev-request@lists.openstack.org?subject:unsubscribe" rel="noreferrer" target="_blank">OpenStack-dev-request@lists.openstack.org?subject:unsubscribe</a><br>
<a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" rel="noreferrer" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><br>
</div></div></blockquote></div><br></div></div></div></div></div>