Open Stack

On Tue, Jul 23, 2013 at 10:40 AM, Henry Nash <henryn at linux.vnet.ibm.com>wrote:

> Hi
>
> As part of bp
> https://blueprints.launchpad.net/keystone/+spec/policy-on-api-target I
> have uploaded some example WIP code showing a proposed approach for just a
> few API calls (one easy, one more complex).  I'd appreciate early feedback
> on this before I take it any further.
>
> https://review.openstack.org/#/c/38308/
>
> A couple of points:
>
> - One question is on how to handle errors when you are going to get a
> target object before doing you policy check.  What do you do if the object
> does not exist?  If you return NotFound, then someone, who was not
> authorized  could troll for the existence of entities by seeing whether
> they got NotFound or Forbidden.  If however, you return Forbidden, then
> users who are authorized to, say, manage users in a domain would aways get
> Forbidden for objects that didn't exist (since we can know where the
> non-existant object was!).  So this would modify the expected return codes.
>

This could be based on whether debug mode is enabled or not... in debug
mode, raise a Forbidden for an object that exists but you don't have access
to. In normal mode, suppress that extra (potentially sensitive) information
by convert Forbidden errors into 404's. Either way, the ID's would be very
difficult to guess, so I'm not sure how much trouble it's worth?


>
> - I really think we need some good documentation on how to bud keystone
> policy files.  I'm happy to take a first cut as such a thing - what do you
> think the right place is for such documentation
>

That would be MUCH appreciated -- definitely belongs in openstack-manuals
but I'm not sure which book would be most appropriate?

  https://github.com/openstack/openstack-manuals/tree/master/doc/src/docbkx


>
> _______________________________________________
> OpenStack-dev mailing list
> OpenStack-dev at lists.openstack.org
> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
>



-- 

-Dolph
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20130723/860d3124/attachment.html>