access control & roles & uuid's

Dmitri Dolguikh dmitri at redhat.com
Fri Mar 19 18:42:03 UTC 2010


On 10-03-19 2:55 PM, Bryan Kearney wrote:
> On 03/19/2010 01:06 PM, Justin Harris wrote:
>    
>> ----- "Devan Goodwin"<dgoodwin at rm-rf.ca>   wrote:
>>
>>      
>>> On Fri, Mar 19, 2010 at 1:10 PM, Justin Harris<jharris at redhat.com>
>>> wrote:
>>>        
>>>> So in this case I think its a pretty similar situation:
>>>>
>>>> GET /pools = all entitlement pools in the system - only admin
>>>> GET /owner/34/pools = all entitlement pools for that owner -
>>>>          
>>> available to the owner and all consumers under that owner
>>>        
>>>> I don't think that I understand the first example - would the
>>>>          
>>> consumer want to see entitlement pools before consuming
>>>        
>>>> an entitlement to e.g. see what was available?
>>>>
>>>>    - Justin
>>>>          
>>> Correct, the client tools let users select which pools they'd like to
>>> consume from.
>>>
>>> We can'd do anything like /consumer/uuid/pools because that looks
>>> like
>>> ownership when it's really not.
>>>
>>> So I think we're left with /pools and /pools?consumer=blah needing
>>> different security.
>>>        
>> I think that this would just be the second example above:
>>
>> If I am a consumer and my owner is 5, I can see my available entitlement pools via
>> GET /owners/5/pools
>>
>> Am I oversimplifying things?
>>      
while on the surface this design is simpler, it is not any different 
from enforcing the access control on the level of curators/entities: we 
will have to inspect current consumer for their owner_uuid, and retrieve 
data based on that. We could drop the prefix '/owners/5' and keep /pools 
and the result will be the same, with one exception: the client will 
never get a 403 - only a set of data that it is authorized to see.
> That would mean we would need to either:
>
> 1) have the client get the owner id
> 2) Issue a redirect, where if you are not an admin and you go to /pools
> you are redirected to /owner/5/pools
>    
I would very much like to stay away from redirects. If we are taking the 
route of role-specific urls, I'd rather keep things simple and return a 
403 for clients that are not supposed to access a given url.

-d



More information about the candlepin mailing list