On 04/30/2013 05:25 PM, Nick Coghlan wrote:
However, I think we can do something slightly different in the
revised
design that will still handle that case:
1. If SubmitBot is submitting an individual job with the nominal
submitter as "Bob", then SubmitBot must be in Bob's delegation list
2. If SubmitBot is submitting a group job for "Bob's Team" with the
nominal submitter as "Bob", then SubmitBot must be in Bob's delegation
list OR in the delegation list for "Bob's Team"
The reason for the extra restriction is that users can be in multiple
groups, so the group based delegations shouldn't bleed across in those
cases.
In writing this up, I realised that since users can create ad hoc groups
whenever they want, group-based delegation was all we needed to cover
the use cases I had in mind.
User-based delegation is still an interesting idea, but I'll be flagging
it as a deferred feature rather than something we try to do for 1.0.
I'll start a new thread once I have the revised design proposal published.
Cheers,
Nick.
--
Nick Coghlan
Red Hat Infrastructure Engineering & Development, Brisbane
Python Applications Team Lead
Beaker Development Lead (
http://beaker-project.org/)
PulpDist Development Lead (
http://pulpdist.readthedocs.org)