access control & roles & uuid's
Dmitri Dolguikh
dmitri at redhat.com
Fri Mar 19 16:30:38 UTC 2010
On 10-03-19 12:57 PM, Justin Harris wrote:
> ----- "Dmitri Dolguikh"<dmitri at redhat.com> wrote:
>
>
>> On 10-03-19 11:48 AM, Justin Harris wrote:
>>
>>> I still feel funny about a given resource url resulting in different
>>>
>>
>>> results
>>> based on who is asking. My inital thought on this was to have a
>>>
>> similar setup
>>
>>> to what you proposed for the curators, but on the resources. The
>>>
>> main difference
>>
>>> being that instead of applying filters to a query, it simply allows
>>>
>> access or 403s.
>>
>>>
>>>
>> hmm. I don't think I follow you. Let's consider
>>
>> GET /consumers
>>
>> And let's assume that the caller has 'owner' (or owner-admin in
>> bryan's
>> taxonomy of roles) role. We don't have owner uuid in the url, but the
>>
>> request is valid. We can't return a 403; instead we should return all
>>
>> consumers in the owner's organization.
>>
>> Unless we create a management-client-specific methods (for the example
>>
>> above: GET /owners/{owner_uuid}/consumers) I don't see any other way
>> around it.\
>>
> Yeah so this actually goes back to the collections thing. I think that for REST this is interpreted as "all consumers in the system", which
> IMO should only be available to the super-user (or whatever we call it) role. The way to get a collection of consumers under an owner is, like
> you said: GET /owners/4/consumers - these are the consumers under this owner, and I think that the URL conveys that.
>
> - Justin
>
>
>
Agreed. So is it how we want to approach this? I'm not sure if this is
an issue in our case, but I would like to avoid the situation when the
client has to be specifically coded for a particular role. We have at
least another role owner_admin, which means:
we still need: GET /owners/4/consumers (super_admin has access to any
owner_uuid)
but also: GET /owners (returns all owners in the system - only
super_admin has access to this one)
-d
More information about the candlepin
mailing list