<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.5pt;
font-family:Consolas;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:Consolas;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText">Hi Jay,<o:p></o:p></p>
<p class="MsoPlainText"> See my comments below & thanks for the feedback. :)<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><b>What is the difference between a resource group and a group?<o:p></o:p></b></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">A group in keystone is a collection of users. This aids in role assignments and makes a logical collection of users possible.
<o:p></o:p></p>
<p class="MsoPlainText">A resource group in the context of keystone is an identifier of a distributed restriction that can be assigned to policies and users.
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">For example: Policy "x" defines that user "joe" can perform the capability "deleteServers". That policy is tied to a resource group called "prod-servers".<o:p></o:p></p>
<p class="MsoPlainText">Hitting up nova in a GET /resource-group/prod-servers will yield all the resources (with respect to that service) that comprise that resource group. Those are the servers that joe may delete.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><b>Do your scalability concerns revolve around having a single policy BLOB for the service and the corresponding single record, multi-writer data access pattern that would mean? If you had a policy BLOB per group, would that assuage
those concerns? Meaning... a compromise between having a REST API that would essentially operate on single resources and the existing API that changes all policies in one call?<o:p></o:p></b></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The proposed solution above helps distribute the real load of a fine-grained access control solution out to the services that would know more about the resources.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Thanks,<o:p></o:p></p>
<p class="MsoPlainText">joe<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: openstack-bounces+joe.savak=rackspace.com@lists.launchpad.net [mailto:openstack-bounces+joe.savak=rackspace.com@lists.launchpad.net] On Behalf Of Jay Pipes<br>
Sent: Tuesday, April 02, 2013 9:58 AM<br>
To: openstack@lists.launchpad.net<br>
Subject: Re: [Openstack] Keystone Design Session - Fine Grained Access Control<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">On 04/02/2013 09:51 AM, Joe Savak wrote:<o:p></o:p></p>
<p class="MsoPlainText">> I’d like to propose a design session on Fine Grained Access Control
<o:p></o:p></p>
<p class="MsoPlainText">> for the summit.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Session info: <a href="http://summit.openstack.org/cfp/edit/99">
<span style="color:windowtext;text-decoration:none">http://summit.openstack.org/cfp/edit/99</span></a><o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Blueprint: <o:p></o:p></p>
<p class="MsoPlainText">> <a href="https://blueprints.launchpad.net/keystone/+spec/fine-grain">
<span style="color:windowtext;text-decoration:none">https://blueprints.launchpad.net/keystone/+spec/fine-grain</span></a><o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Details:<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> a large implementation, there can be many users each having some level
<o:p></o:p></p>
<p class="MsoPlainText">> of access to a shared pool of resources. Not all users need that much
<o:p></o:p></p>
<p class="MsoPlainText">> access though and there are cases where access must be restricted
<o:p></o:p></p>
<p class="MsoPlainText">> further. V3 introduces policies and that works for restricting access
<o:p></o:p></p>
<p class="MsoPlainText">> to certain capabilities (only a user with the role "admin" or group
<o:p></o:p></p>
<p class="MsoPlainText">> "foo" can create server in nova, etc). Policies bloat up though if
<o:p></o:p></p>
<p class="MsoPlainText">> they need to get down the resource level (only joe can delete server
<o:p></o:p></p>
<p class="MsoPlainText">> "ABC").<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Once you go down this super-fine-grained route and start managing privileges in this manner, it definitely complicates things. :)<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> This blue print (which will be expanded upon) introduces the concept
<o:p></o:p></p>
<p class="MsoPlainText">> of a "resource group" in an attempt to provide highly-available,
<o:p></o:p></p>
<p class="MsoPlainText">> easily modifiable fine grained access control to OpenStack services.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">What is the difference between a resource group and a group?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> 1. The v3 core spec doesn’t allow for fine-grained access control.
<o:p></o:p></p>
<p class="MsoPlainText">> You can force it into policy blobs, but that isn’t scalable or
<o:p></o:p></p>
<p class="MsoPlainText">> transparent enough<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Do your scalability concerns revolve around having a single policy BLOB for the service and the corresponding single record, multi-writer data access pattern that would mean? If you had a policy BLOB per group, would that assuage those
concerns? Meaning... a compromise between having a REST API that would essentially operate on single resources and the existing API that changes all policies in one call?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Best,<o:p></o:p></p>
<p class="MsoPlainText">-jay<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">_______________________________________________<o:p></o:p></p>
<p class="MsoPlainText">Mailing list: <a href="https://launchpad.net/~openstack">
<span style="color:windowtext;text-decoration:none">https://launchpad.net/~openstack</span></a><o:p></o:p></p>
<p class="MsoPlainText">Post to : <a href="mailto:openstack@lists.launchpad.net">
<span style="color:windowtext;text-decoration:none">openstack@lists.launchpad.net</span></a><o:p></o:p></p>
<p class="MsoPlainText">Unsubscribe : <a href="https://launchpad.net/~openstack">
<span style="color:windowtext;text-decoration:none">https://launchpad.net/~openstack</span></a><o:p></o:p></p>
<p class="MsoPlainText">More help : <a href="https://help.launchpad.net/ListHelp">
<span style="color:windowtext;text-decoration:none">https://help.launchpad.net/ListHelp</span></a><o:p></o:p></p>
</div>
</body>
</html>