On 02/29/2016 12:44 PM, Jakub Hrozek wrote:
On Mon, Feb 29, 2016 at 11:50:06AM +0100, Lukáš Hellebrandt wrote:
> On 02/28/2016 11:42 AM, Jakub Hrozek wrote:
>> On Fri, Feb 26, 2016 at 02:03:37PM +0100, Lukáš Hellebrandt wrote:
>>>> First question I have is that the URLs only match on complete string
>>>> match. From past conversations I thought we wanted to add a more
>>>> granular evaluation..?
>>>
>>> I am planning to interpret URI as a prefix. However, there might be
>>> problem getting enough granularity because FreeIPA has dropped DENY
>>> rules: it will be hard to get some behaviors, e.g. "Allow access to
>>> hostname/* but not to hostname/admin/*". I do not know yet how to solve
>>> this.
>>
>> Wouldn't it help if all rules that match URI-wise need to allow the
>> person requesting the resource?
>>
> I am not sure if I understand.
> The problem is, I do not know how to make a rule to allow "everything
> except".
Just don't do it, the current HBAC rules don't support that either :)
That's probably the way to go for now, I need to make some basic working
example first.
> E.g., allow every URI that does NOT start with
> $(hostname)/admin/ . It would be possible if there was finite number of
> prefixes other than $(hostname)/admin , but it might not be the case.
In this example "hostname" would be an HBAC service. Then there might be
additional URI rule "/myapp/*" that would be permitted for the
'appusers'
group and an URI rule "myapp/admin*" that would be permitted for the
'appadmins' groups. An attempt to access anything under "myapp/admin"
would match both URIs, but unless the user requesting access was a
member of appusers, one of the two rules wouldn't match and access would
be denied..
So, effectively, there would be no way to make some URI accessible to
more than one group? And if I understand that example correctly, users
from 'appadmins' wouldn't be allowed access anywhere (including
"/myapp/admin") because of the very same reason users from 'appusers'
wouldn't be (not all rules matching "/myapp/admin" URI-wise allow the
'appadmins' group).
Furthermore, this would require not only evaluating rules of the
matching (service and hostname and) user group, but of all the rules
(with matching service and hostname).
--
Lukas Hellebrandt
Associate Quality Engineer
lhellebr(a)redhat.com