{"action":"created","issue":{"url":"https://api.github.com/repos/StackStorm/st2/issues/1765","labels_url":"https://api.github.com/repos/StackStorm/st2/issues/1765/labels{/name}","comments_url":"https://api.github.com/repos/StackStorm/st2/issues/1765/comments","events_url":"https://api.github.com/repos/StackStorm/st2/issues/1765/events","html_url":"https://github.com/StackStorm/st2/pull/1765","id":98017333,"number":1765,"title":"[WIP] Initial RBAC implementation","user":{"login":"Kami","id":125088,"avatar_url":"https://avatars.githubusercontent.com/u/125088?v=3","gravatar_id":"","url":"https://api.github.com/users/Kami","html_url":"https://github.com/Kami","followers_url":"https://api.github.com/users/Kami/followers","following_url":"https://api.github.com/users/Kami/following{/other_user}","gists_url":"https://api.github.com/users/Kami/gists{/gist_id}","starred_url":"https://api.github.com/users/Kami/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Kami/subscriptions","organizations_url":"https://api.github.com/users/Kami/orgs","repos_url":"https://api.github.com/users/Kami/repos","events_url":"https://api.github.com/users/Kami/events{/privacy}","received_events_url":"https://api.github.com/users/Kami/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":13,"created_at":"2015-07-29T19:57:32Z","updated_at":"2015-08-01T00:54:49Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/StackStorm/st2/pulls/1765","html_url":"https://github.com/StackStorm/st2/pull/1765","diff_url":"https://github.com/StackStorm/st2/pull/1765.diff","patch_url":"https://github.com/StackStorm/st2/pull/1765.patch"},"body":"This pull request includes initial work in progress changes needed for RBAC.\r\n\r\nI plan to finish and polish it up and get those changed merged into master soon. Permission loading from files is not there yet, but I plan to implement it soon (I will gist some examples in the upcoming days).\r\n\r\nKeep in mind that those changes are behind a feature flag (config option, disabled by default) so they can be merged into master without any user impact. \r\n\r\nP.S. Sorry for all the (merge) commits. I tried to be a good citizen and make general cleanup, refactoring and improvements changes in a branch based off master, get it merged into master first and then merge it back into this branch.\r\n\r\n## TODO\r\n\r\n- [ ] More tests\r\n- [ ] Finish and polish up the code\r\n- [ ] More and better docs\r\n- [ ] Loading roles and permission grants from YAML files (incremental change, can be done in a separate PR as well)\r\n- [ ] Lint script which checks that all the controllers perform permission checking\r\n- [ ] Performance optimizations\r\n- [ ] Log \"access denied\" errors in a special audit log\r\n- [ ] Make sure all the operations currently carry over the user who performed the operation in the context\r\n\r\n## Open questions / To discuss\r\n\r\n### What to do with other controllers where we currently don't perform any permission checking?\r\n\r\nThings such as runner types, actions executions, history, stream, etc. We could add a new set of permission for each of those resources, but this might be an over kill right now. We could also add a single \"SYSTEM_RESOURCE\" permission type which applies to all the other (non content pack) resources.\r\n\r\n### How to handle action execution permissions\r\n\r\nShould we introduce new permissions for \"action executions\" endpoint? We could also inherit actions permissions, but I'm not too big of a fan of that.\r\n\r\n### How to handle temporary tokens which are passed to sensors and actions\r\n\r\nI propose to tie those tokens to a \"system\" user (this user can't be manipulated) which has an \"admin\" role.\r\n\r\nWe could (and maybe should) also tie the token to the user which invoked the action, but this gets more tricky, especially for \"event\" actions which are not directly triggered by the API.\r\n\r\nMaybe we could also perform do a mix:\r\n\r\n1. If an action is triggered by the API tie token to the user who triggered the action\r\n2. If it's a sensor or \"event\" triggered actions tie it to the system user\r\n\r\n### Blacklist for globally disabled runner type\r\n\r\nPer @lakshmi-kannan that was a feature request. Imo that seems a reasonable feature. I think we should handle it via a special \"blacklisted_runner_types\" (or similar) configuration option since it doesn't really fit that much into the RBAC model and the config option is imo simpler and better.\r\n\r\n### Permission which allows user to disable / enable a resource\r\n\r\n@dzimine said someone asked for that. It would be great to get some more context into it since I don't really understand how it's useful.\r\n\r\nIn any case, this should be easily to implement via new \"<resource>_modify_state\" (or similar) permission type."},"comment":{"url":"https://api.github.com/repos/StackStorm/st2/issues/comments/126841661","html_url":"https://github.com/StackStorm/st2/pull/1765#issuecomment-126841661","issue_url":"https://api.github.com/repos/StackStorm/st2/issues/1765","id":126841661,"user":{"login":"dzimine","id":1294734,"avatar_url":"https://avatars.githubusercontent.com/u/1294734?v=3","gravatar_id":"","url":"https://api.github.com/users/dzimine","html_url":"https://github.com/dzimine","followers_url":"https://api.github.com/users/dzimine/followers","following_url":"https://api.github.com/users/dzimine/following{/other_user}","gists_url":"https://api.github.com/users/dzimine/gists{/gist_id}","starred_url":"https://api.github.com/users/dzimine/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dzimine/subscriptions","organizations_url":"https://api.github.com/users/dzimine/orgs","repos_url":"https://api.github.com/users/dzimine/repos","events_url":"https://api.github.com/users/dzimine/events{/privacy}","received_events_url":"https://api.github.com/users/dzimine/received_events","type":"User","site_admin":false},"created_at":"2015-08-01T00:54:49Z","updated_at":"2015-08-01T00:54:49Z","body":"Couple of syntax pointers: \r\n* AWS IAM Policy structure http://docs.aws.amazon.com/IAM/latest/UserGuide/policies_overview.html#policies-introduction\r\n* I want to place OpenStack as an example but it’s almost serves as an anti-example: http://docs.openstack.org/kilo/config-reference/content/section_keystone-policy.json.html\r\n"}}