On 07/27/2011 05:30 AM, Mark McLoughlin wrote:
- It's fine if Joe has launch access to all images; we just
need to
make sure that Joe can't delete or overwrite images. Perhaps this
means that Joe has no direct access to IWHD or Image Factory at
all, only the images list in Conductor
That would be perfect but what prevents him to use IWHD CLI and access
the objects directly? I was talking about this issue from the very
beginning. If the plan is that only a subset of the users will be
allowed to use IWHD and all the rest will have to interact with
Conductor this is fine but I never seen this spelled out.
The deneral assumtion I have is that all the components are hooked into
the same identity namespace (read domain or group of domains provided by
LDAP, AD, IPA or mixture of those). If there is no specific restriction
and grouping any user would be able to present a valid authentication
when it accesses any component so it is the responsibility of every
component to decide what the user is allowed to do.
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/