On Wed, Jul 27, 2011 at 09:31:44AM -0400, Dmitri Pal wrote:
On 07/27/2011 05:30 AM, Mark McLoughlin wrote:
> - It's fine if Joe has launch access to all images; we just need to
> make sure that Joe can't delete or overwrite images. Perhaps this
> means that Joe has no direct access to IWHD or Image Factory at
> all, only the images list in Conductor
>
That would be perfect but what prevents him to use IWHD CLI and access
the objects directly? I was talking about this issue from the very
beginning. If the plan is that only a subset of the users will be
allowed to use IWHD and all the rest will have to interact with
Conductor this is fine but I never seen this spelled out.
It seems to me that we could probably save the IWHD guys a lot of work
if we lock down IWHD so that you can only access it if you have valid
credentials in either Conductor or Katello. This is a change from what
we had discussed, but if we can say that we can trust a Conductor
admin to bless the images that can be launched in a given place, and
that that's the only place Joe gets to see images, then that ought to
be enough, at least until someone tells us something different?
--Hugh
The deneral assumtion I have is that all the components are hooked
into
the same identity namespace (read domain or group of domains provided by
LDAP, AD, IPA or mixture of those). If there is no specific restriction
and grouping any user would be able to present a valid authentication
when it accesses any component so it is the responsibility of every
component to decide what the user is allowed to do.
--
Thank you,
Dmitri Pal
Sr. Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
_______________________________________________
aeolus-devel mailing list
aeolus-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/aeolus-devel
--
== Hugh Brock, hbrock(a)redhat.com ==
== Engineering Manager, Cloud BU ==
== Aeolus Project: Manage virtual infrastructure across clouds. ==
==
http://aeolusproject.org ==
"I know that you believe you understand what you think I said, but I’m
not sure you realize that what you heard is not what I meant."
--Robert McCloskey