access control & roles & uuid's

Dmitri Dolguikh dmitri at redhat.com
Fri Mar 19 16:30:38 UTC 2010


On 10-03-19 12:57 PM, Justin Harris wrote:
> ----- "Dmitri Dolguikh"<dmitri at redhat.com>  wrote:
>
>    
>> On 10-03-19 11:48 AM, Justin Harris wrote:
>>      
>>> I still feel funny about a given resource url resulting in different
>>>        
>>      
>>> results
>>> based on who is asking.  My inital thought on this was to have a
>>>        
>> similar setup
>>      
>>> to what you proposed for the curators, but on the resources.  The
>>>        
>> main difference
>>      
>>> being that instead of applying filters to a query, it simply allows
>>>        
>> access or 403s.
>>      
>>>
>>>        
>> hmm. I don't think I follow you. Let's consider
>>
>> GET /consumers
>>
>> And let's assume that the caller has 'owner' (or owner-admin in
>> bryan's
>> taxonomy of roles)  role. We don't have owner uuid in the url, but the
>>
>> request is valid. We can't return a 403; instead we should return all
>>
>> consumers in the owner's organization.
>>
>> Unless we create a management-client-specific methods (for the example
>>
>> above: GET /owners/{owner_uuid}/consumers) I don't see any other way
>> around it.\
>>      
> Yeah so this actually goes back to the collections thing.  I think that for REST this is interpreted as "all consumers in the system", which
> IMO should only be available to the super-user (or whatever we call it) role.  The way to get a collection of consumers under an owner is, like
> you said:  GET /owners/4/consumers - these are the consumers under this owner, and I think that the URL conveys that.
>
>   - Justin
>
>
>    
Agreed. So is it how we want to approach this? I'm not sure if this is 
an issue in our case, but I would like to avoid the situation when the 
client has to be specifically coded for a particular role. We have at 
least another role owner_admin, which means:

we still need: GET /owners/4/consumers (super_admin has access to any 
owner_uuid)
but also: GET /owners (returns all owners in the system - only 
super_admin has access to this one)

-d



More information about the candlepin mailing list