access control & roles & uuid's

Dmitri Dolguikh ddolguik at redhat.com
Fri Mar 19 13:34:13 UTC 2010


We need both: role based access control and more granular form of access 
control.

An example of a simple role-based access:
GET /owners/{owner_uuid} - shouldn't be accessoble to 'client' role, but 
should be available for 'owner'.

More granular access control, based on client or owner uuid:
GET /consumers/{consumer_uuid}/entitlements - a 'consumer' can issue 
this call for themselves only, while 'owner' for any consumer (within 
the organization).

While role-based access control is rather straightforward, the latter 
form of access control is much less so. I can think of two possible 
implementations.

url-based:
  - at the resource level;
  - have to specify role AND uuid (probably in the form of a url pattern)
  - relatively simple
  - something in the form:
       @Requires(role = Roles.CONSUMER, assertUUID = 
'/consumers/{uuid}/entitlements') // has to match uuid

  the trouble: above url doesn't contain any references to the owner. 
Are we going to have a different url for 'owners'?  If we are to keep 
the same url, then the implementation won't differ significantly from 
the next approach.

entity-based
  - at the curator level
  - will have to have a way to relate to consumer & owner (it seems that 
it might not be that difficult - we have references to both on main 
entities)
  - something in the form: @RequiresConsumerRole, @RequiresOwnerRole
  - under the hood (assume GET /consumers/{consumer_uuid}/entitlements 
is being accessed):

       POST/DELETE Role.CONSUMER: extract consumer_uuid from the 
certificate, compare it with consumer.uuid on the entitlement
       GET Role.CONSUMER: extract consumer_uuid from the certificate, 
apply filter: where consumer.uuid = consumer_uuid
       or
       POST/DELETE Role.OWNER: extract owner_uuid from the user object, 
compare it with owner.uuid on the entitlement
       GET Role.OWNER: extract extract owner_uuid from the user object, 
apply filter: where owner.uuid = owner_uuid


Thoughts? Comments?
-d

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/candlepin/attachments/20100319/156f5096/attachment.html>


More information about the candlepin mailing list