RFC Feature Planning: User Groups

Jason Guiditta jguiditt at redhat.com
Wed Apr 4 18:07:07 UTC 2012


On 04/04/12 13:54 -0400, Scott Seago wrote:
>On 03/30/2012 09:50 AM, Scott Seago wrote:
>>Rather than paste in the entire text, I'm just linking to the wiki 
>>writeup. Please read the whole thing first and if you want to 
>>comment on anything specific, quote it and comment on this thread.
>>
>>
>>https://www.aeolusproject.org/redmine/projects/aeolus/wiki/Adding_User_Groups
>>
>>
>>Scott
>>
>OK I've updated to take into account feedback from Imre, Jan, Jay, and 
>Angus.
>
>In particular, we'll allow both LDAP and Local groups to exist 
>concurrently (subject to config flags, so we can still lock this down 
>to only one type). I've added consideration of dynamic user group 
>lists managed via LDAP queries, but in the 'future plans' section, as 
>it will probably not be included in the initial iteration.
>
>In addition, I've noted that, subject to availability of a scheduling 
>infrastructure, I'd prefer the background re-sync to inline/blocking 
>re-sync.
>
>Scott
>

Scott, couple minor questions/thoughts here:

* what happens if an ldap usergroup is deleted on a sync (and I
   would assume all permissions for a given user that was in that group
   on any objects they own as well), but nobody else owns those
   objects?  For example, Joes group is deleted, and he has some
   deployables he created, and a few running instances.  Nobod else has
   access to those objects, so what happens to them (especially the
   running instances)?

* This is probably out of scope, but I would hope we will include a
   task(s) to make whatever controller changes are needed also provide
   an api?

Aside from this, I think you have captured all the bits we have
discussed, and looks like a pretty workable plan to me.

-j



More information about the aeolus-devel mailing list