On Mon, Sep 19, 2011 at 01:52:10PM -0400, Matt Wagner wrote:
Hi all,
I picked up #2121 this morning, to integrate a warden authentication
strategy that provides two-legged OAuth. (Which someone described as
"our favorite catch-phrase ever.")
I've spent a bit looking into this, and I think I have a decent
understanding of the technical side of things. But what's not clear to
me at all is the user story.
I think we're actually trying to do two very different things with
OAuth.
One is to be an OAuth "server" that aeolus-image can connect to. I'm
thinking this is more a case of 3-legged OAuth, though, as I think we
want aeolus-image to have user-level permissions. (i.e., aeolus-image
authenticates the user to Conductor via token.)
I'm not clear that we need to do this in the short term, if at
all. I'd be happy with the user passing their credentials to Conductor
on each call for the short term, and in the long term it sounds a bit
like replicating Kerberos.
The other is to act as an OAuth client when connecting to other
services, using two-legged OAuth. Off the top of my head, we want to be
consumers of Katello, iwhd, and Factory. (Actually, I'm thinking that we
want Katello to work both ways, and I'm not sure how this is normally
handled. I suspect that sometimes we'll want to make calls to Katello,
and other times they may wish to make calls to us.)
I think this critical for 1.0 b/c otherwise we wind up with iwhd and
Factory listening on the box with no authentication.
How many of these things are in scope for this sprint? How many of
these
providers actually support OAuth on their end yet?
And how about #2309, "Ensure that owner information is stored as
meta-data in iwhd"? Does it make any sense to consider passing this
information along via OAuth from aeolus-image to Factory?
However we need to pass the UID is fine with me as long as we know
Conductor is the only trusted writer -- i.e. the only thing that can
give the information to Factory.
--H
--
== Hugh Brock, hbrock(a)redhat.com ==
== Engineering Manager, Cloud BU ==
== Aeolus Project: Manage virtual infrastructure across clouds. ==
==
http://aeolusproject.org ==
"I know that you believe you understand what you think I said, but I’m
not sure you realize that what you heard is not what I meant."
--Robert McCloskey