<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">I’d like to propose a design session on Fine Grained Access Control for the summit.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Session info: <a href="http://summit.openstack.org/cfp/edit/99">
http://summit.openstack.org/cfp/edit/99</a><o:p></o:p></p>
<p class="MsoNormal">Blueprint: <a href="https://blueprints.launchpad.net/keystone/+spec/fine-grain">
https://blueprints.launchpad.net/keystone/+spec/fine-grain</a> <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Details:<o:p></o:p></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:.2in;margin-left:0in;line-height:13.5pt;background:white">
<span class="apple-converted-space"><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#333333"> </span></span><span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#333333">a large implementation, there can be many users each
having some level of access to a shared pool of resources. Not all users need that much access though and there are cases where access must be restricted further. V3 introduces policies and that works for restricting access to certain capabilities (only a
user with the role "admin" or group "foo" can create server in nova, etc). Policies bloat up though if they need to get down the resource level (only joe can delete server "ABC").<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:.2in;margin-left:0in;line-height:13.5pt;background:white;max-width: 45em;orphans: auto;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#333333">This blue print (which will be expanded upon) introduces the concept of a "resource group" in an attempt to provide highly-available, easily modifiable fine grained access control
to OpenStack services.<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:.2in;margin-left:0in;line-height:13.5pt;background:white;max-width: 45em;orphans: auto;widows: auto;-webkit-text-size-adjust: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#333333">1. The v3 core spec doesn’t allow for fine-grained access control. You can force it into policy blobs, but that isn’t scalable or transparent enough<br>
2. Identity shouldn’t act as a CMDB, keeping track and storing references to all resources<br>
3. Having a configurable group that represents resources across services is easier to maintain in identity<br>
4. Token scope has layers (all optional), and<br>
a. Service endpoints the token has access to<br>
b. Which roles the token is scoped to<br>
c. Which policies the token is scoped to<br>
5. Likewise, policies should have scope:<br>
a. Which resource groups the policies apply to<br>
6. Services should make a call available to introspect which servers, files, etc make up that resource group<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:.2in;margin-left:0in;line-height:13.5pt;background:white">
<span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#333333"><o:p> </o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:.2in;margin-left:0in;line-height:13.5pt;background:white">
<span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#333333">Looking forward to your comments & the discussion!<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:.2in;margin-left:0in;line-height:13.5pt;background:white">
<span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#333333">Thanks,<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:.2in;margin-left:0in;line-height:13.5pt;background:white">
<span style="font-size:9.0pt;font-family:"Arial","sans-serif";color:#333333">Joe Savak<o:p></o:p></span></p>
</div>
</body>
</html>