{"action":"created","comment":{"url":"https://api.github.com/repos/openshift/openshift-docs/pulls/comments/29726661","id":29726661,"diff_hunk":"@@ -0,0 +1,86 @@\n+= Authorization\n+{product-author}\n+{product-version}\n+:data-uri:\n+:icons:\n+:experimental:\n+:toc: macro\n+:toc-title:\n+\n+toc::[]\n+\n+== Overview\n+Authorization determines whether an identity is allowed to perform any action.\n+Note that authorization is a separate step from\n+link:authentication.html[authentication], which is more about determining the\n+identity of who is taking the action.\n+\n+Authorization is managed using:\n+\n+[horizontal]\n+Rules:: Describe sets of permitted verbs on a set of resource types.\n+Roles:: Collection of rules.\n+Bindings:: Associate users and/or groups with a role.\n+\n+Users and groups may be bound to multiple roles at the same time.\n+\n+Several factors are combined to make the decision when authorization is\n+evaluated:\n+\n+[horizontal]\n+Identity:: Both the username and list of groups the user belongs to.\n+Action:: The action being performed. In most cases, this consists of:\n+Project::: The project being accessed.\n+Verb::: Can be `get`, `list`, `create`, `update`, or others.\n+Resource::: The API endpoint being accessed. This is distinct from the resource\n+being touched, such as pods, `*deploymentconfigs*`, or builds.\n+Bindings:: The full list of bindings.\n+\n+The evaluation goes through the following steps:\n+","path":"architecture/additional_concepts/authorization.adoc","position":40,"original_position":40,"commit_id":"531cdd5d1a663a0e2c1e7a3265cd3aa968bdd39c","original_commit_id":"531cdd5d1a663a0e2c1e7a3265cd3aa968bdd39c","user":{"login":"CowboysFan","id":5652976,"avatar_url":"https://avatars.githubusercontent.com/u/5652976?v=3","gravatar_id":"","url":"https://api.github.com/users/CowboysFan","html_url":"https://github.com/CowboysFan","followers_url":"https://api.github.com/users/CowboysFan/followers","following_url":"https://api.github.com/users/CowboysFan/following{/other_user}","gists_url":"https://api.github.com/users/CowboysFan/gists{/gist_id}","starred_url":"https://api.github.com/users/CowboysFan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/CowboysFan/subscriptions","organizations_url":"https://api.github.com/users/CowboysFan/orgs","repos_url":"https://api.github.com/users/CowboysFan/repos","events_url":"https://api.github.com/users/CowboysFan/events{/privacy}","received_events_url":"https://api.github.com/users/CowboysFan/received_events","type":"User","site_admin":false},"body":"Should this be \"An evaluation....\"?","created_at":"2015-05-06T00:17:17Z","updated_at":"2015-05-06T00:17:17Z","html_url":"https://github.com/openshift/openshift-docs/pull/341#discussion_r29726661","pull_request_url":"https://api.github.com/repos/openshift/openshift-docs/pulls/341","_links":{"self":{"href":"https://api.github.com/repos/openshift/openshift-docs/pulls/comments/29726661"},"html":{"href":"https://github.com/openshift/openshift-docs/pull/341#discussion_r29726661"},"pull_request":{"href":"https://api.github.com/repos/openshift/openshift-docs/pulls/341"}}},"pull_request":{"url":"https://api.github.com/repos/openshift/openshift-docs/pulls/341","id":34672166,"html_url":"https://github.com/openshift/openshift-docs/pull/341","diff_url":"https://github.com/openshift/openshift-docs/pull/341.diff","patch_url":"https://github.com/openshift/openshift-docs/pull/341.patch","issue_url":"https://api.github.com/repos/openshift/openshift-docs/issues/341","number":341,"state":"open","locked":false,"title":"Edits to authz topics.","user":{"login":"adellape","id":3442316,"avatar_url":"https://avatars.githubusercontent.com/u/3442316?v=3","gravatar_id":"","url":"https://api.github.com/users/adellape","html_url":"https://github.com/adellape","followers_url":"https://api.github.com/users/adellape/followers","following_url":"https://api.github.com/users/adellape/following{/other_user}","gists_url":"https://api.github.com/users/adellape/gists{/gist_id}","starred_url":"https://api.github.com/users/adellape/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adellape/subscriptions","organizations_url":"https://api.github.com/users/adellape/orgs","repos_url":"https://api.github.com/users/adellape/repos","events_url":"https://api.github.com/users/adellape/events{/privacy}","received_events_url":"https://api.github.com/users/adellape/received_events","type":"User","site_admin":false},"body":"@deads2k This breaks up the existing authorization topic into an Admin Guide topic <1> (showing `osadm` usage) and an Architecture topic <2> (discussing authz in general). I updated the global roles/bindings examples in <1> for what I was seeing in latest builds, as it seemed to have grown/changed quite a bit. In absence of `insecure-cluster-admin`, I wasn't sure what to use in the `remove-role-from-group` example, so I went with `system:delete-tokens` for now, but interested in thoughts there.\r\n\r\nI figure we can re-introduce an end-user-focused authz topic for the Dev Guide once they (presumably) don't have to use `osadm` to manage roles for local bindings?\r\n\r\nPTAL. Prettier versions for convenience (the rendering gets weird in GH):\r\n\r\n<1> http://file.rdu.redhat.com/~adellape/050415/authz_edits/authz_edits/admin_guide/manage_authorization_policy.html\r\n<2> http://file.rdu.redhat.com/~adellape/050415/authz_edits/authz_edits/architecture/additional_concepts/authorization.html","created_at":"2015-05-04T20:33:16Z","updated_at":"2015-05-06T00:17:17Z","closed_at":null,"merged_at":null,"merge_commit_sha":"7585549a50ae37b711e4dc5cc3e544a01e3fd6ea","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/openshift/openshift-docs/pulls/341/commits","review_comments_url":"https://api.github.com/repos/openshift/openshift-docs/pulls/341/comments","review_comment_url":"https://api.github.com/repos/openshift/openshift-docs/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openshift/openshift-docs/issues/341/comments","statuses_url":"https://api.github.com/repos/openshift/openshift-docs/statuses/531cdd5d1a663a0e2c1e7a3265cd3aa968bdd39c","head":{"label":"adellape:authz_edits","ref":"authz_edits","sha":"531cdd5d1a663a0e2c1e7a3265cd3aa968bdd39c","user":{"login":"adellape","id":3442316,"avatar_url":"https://avatars.githubusercontent.com/u/3442316?v=3","gravatar_id":"","url":"https://api.github.com/users/adellape","html_url":"https://github.com/adellape","followers_url":"https://api.github.com/users/adellape/followers","following_url":"https://api.github.com/users/adellape/following{/other_user}","gists_url":"https://api.github.com/users/adellape/gists{/gist_id}","starred_url":"https://api.github.com/users/adellape/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adellape/subscriptions","organizations_url":"https://api.github.com/users/adellape/orgs","repos_url":"https://api.github.com/users/adellape/repos","events_url":"https://api.github.com/users/adellape/events{/privacy}","received_events_url":"https://api.github.com/users/adellape/received_events","type":"User","site_admin":false},"repo":{"id":29119125,"name":"openshift-docs","full_name":"adellape/openshift-docs","owner":{"login":"adellape","id":3442316,"avatar_url":"https://avatars.githubusercontent.com/u/3442316?v=3","gravatar_id":"","url":"https://api.github.com/users/adellape","html_url":"https://github.com/adellape","followers_url":"https://api.github.com/users/adellape/followers","following_url":"https://api.github.com/users/adellape/following{/other_user}","gists_url":"https://api.github.com/users/adellape/gists{/gist_id}","starred_url":"https://api.github.com/users/adellape/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adellape/subscriptions","organizations_url":"https://api.github.com/users/adellape/orgs","repos_url":"https://api.github.com/users/adellape/repos","events_url":"https://api.github.com/users/adellape/events{/privacy}","received_events_url":"https://api.github.com/users/adellape/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/adellape/openshift-docs","description":"OpenShift Documentation","fork":true,"url":"https://api.github.com/repos/adellape/openshift-docs","forks_url":"https://api.github.com/repos/adellape/openshift-docs/forks","keys_url":"https://api.github.com/repos/adellape/openshift-docs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/adellape/openshift-docs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/adellape/openshift-docs/teams","hooks_url":"https://api.github.com/repos/adellape/openshift-docs/hooks","issue_events_url":"https://api.github.com/repos/adellape/openshift-docs/issues/events{/number}","events_url":"https://api.github.com/repos/adellape/openshift-docs/events","assignees_url":"https://api.github.com/repos/adellape/openshift-docs/assignees{/user}","branches_url":"https://api.github.com/repos/adellape/openshift-docs/branches{/branch}","tags_url":"https://api.github.com/repos/adellape/openshift-docs/tags","blobs_url":"https://api.github.com/repos/adellape/openshift-docs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/adellape/openshift-docs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/adellape/openshift-docs/git/refs{/sha}","trees_url":"https://api.github.com/repos/adellape/openshift-docs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/adellape/openshift-docs/statuses/{sha}","languages_url":"https://api.github.com/repos/adellape/openshift-docs/languages","stargazers_url":"https://api.github.com/repos/adellape/openshift-docs/stargazers","contributors_url":"https://api.github.com/repos/adellape/openshift-docs/contributors","subscribers_url":"https://api.github.com/repos/adellape/openshift-docs/subscribers","subscription_url":"https://api.github.com/repos/adellape/openshift-docs/subscription","commits_url":"https://api.github.com/repos/adellape/openshift-docs/commits{/sha}","git_commits_url":"https://api.github.com/repos/adellape/openshift-docs/git/commits{/sha}","comments_url":"https://api.github.com/repos/adellape/openshift-docs/comments{/number}","issue_comment_url":"https://api.github.com/repos/adellape/openshift-docs/issues/comments{/number}","contents_url":"https://api.github.com/repos/adellape/openshift-docs/contents/{+path}","compare_url":"https://api.github.com/repos/adellape/openshift-docs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/adellape/openshift-docs/merges","archive_url":"https://api.github.com/repos/adellape/openshift-docs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/adellape/openshift-docs/downloads","issues_url":"https://api.github.com/repos/adellape/openshift-docs/issues{/number}","pulls_url":"https://api.github.com/repos/adellape/openshift-docs/pulls{/number}","milestones_url":"https://api.github.com/repos/adellape/openshift-docs/milestones{/number}","notifications_url":"https://api.github.com/repos/adellape/openshift-docs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/adellape/openshift-docs/labels{/name}","releases_url":"https://api.github.com/repos/adellape/openshift-docs/releases{/id}","created_at":"2015-01-12T04:47:07Z","updated_at":"2015-04-29T21:31:10Z","pushed_at":"2015-05-05T15:48:56Z","git_url":"git://github.com/adellape/openshift-docs.git","ssh_url":"git@github.com:adellape/openshift-docs.git","clone_url":"https://github.com/adellape/openshift-docs.git","svn_url":"https://github.com/adellape/openshift-docs","homepage":null,"size":3355,"stargazers_count":0,"watchers_count":0,"language":"CSS","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"openshift:master","ref":"master","sha":"f402e307cc4f71f612e4ad594e2cb682821818db","user":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"repo":{"id":21740844,"name":"openshift-docs","full_name":"openshift/openshift-docs","owner":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openshift/openshift-docs","description":"OpenShift Documentation","fork":false,"url":"https://api.github.com/repos/openshift/openshift-docs","forks_url":"https://api.github.com/repos/openshift/openshift-docs/forks","keys_url":"https://api.github.com/repos/openshift/openshift-docs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openshift/openshift-docs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openshift/openshift-docs/teams","hooks_url":"https://api.github.com/repos/openshift/openshift-docs/hooks","issue_events_url":"https://api.github.com/repos/openshift/openshift-docs/issues/events{/number}","events_url":"https://api.github.com/repos/openshift/openshift-docs/events","assignees_url":"https://api.github.com/repos/openshift/openshift-docs/assignees{/user}","branches_url":"https://api.github.com/repos/openshift/openshift-docs/branches{/branch}","tags_url":"https://api.github.com/repos/openshift/openshift-docs/tags","blobs_url":"https://api.github.com/repos/openshift/openshift-docs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openshift/openshift-docs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openshift/openshift-docs/git/refs{/sha}","trees_url":"https://api.github.com/repos/openshift/openshift-docs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openshift/openshift-docs/statuses/{sha}","languages_url":"https://api.github.com/repos/openshift/openshift-docs/languages","stargazers_url":"https://api.github.com/repos/openshift/openshift-docs/stargazers","contributors_url":"https://api.github.com/repos/openshift/openshift-docs/contributors","subscribers_url":"https://api.github.com/repos/openshift/openshift-docs/subscribers","subscription_url":"https://api.github.com/repos/openshift/openshift-docs/subscription","commits_url":"https://api.github.com/repos/openshift/openshift-docs/commits{/sha}","git_commits_url":"https://api.github.com/repos/openshift/openshift-docs/git/commits{/sha}","comments_url":"https://api.github.com/repos/openshift/openshift-docs/comments{/number}","issue_comment_url":"https://api.github.com/repos/openshift/openshift-docs/issues/comments{/number}","contents_url":"https://api.github.com/repos/openshift/openshift-docs/contents/{+path}","compare_url":"https://api.github.com/repos/openshift/openshift-docs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openshift/openshift-docs/merges","archive_url":"https://api.github.com/repos/openshift/openshift-docs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openshift/openshift-docs/downloads","issues_url":"https://api.github.com/repos/openshift/openshift-docs/issues{/number}","pulls_url":"https://api.github.com/repos/openshift/openshift-docs/pulls{/number}","milestones_url":"https://api.github.com/repos/openshift/openshift-docs/milestones{/number}","notifications_url":"https://api.github.com/repos/openshift/openshift-docs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openshift/openshift-docs/labels{/name}","releases_url":"https://api.github.com/repos/openshift/openshift-docs/releases{/id}","created_at":"2014-07-11T15:14:42Z","updated_at":"2015-05-05T20:31:17Z","pushed_at":"2015-05-05T21:31:47Z","git_url":"git://github.com/openshift/openshift-docs.git","ssh_url":"git@github.com:openshift/openshift-docs.git","clone_url":"https://github.com/openshift/openshift-docs.git","svn_url":"https://github.com/openshift/openshift-docs","homepage":null,"size":6742,"stargazers_count":14,"watchers_count":14,"language":"CSS","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":63,"mirror_url":null,"open_issues_count":17,"forks":63,"open_issues":17,"watchers":14,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openshift/openshift-docs/pulls/341"},"html":{"href":"https://github.com/openshift/openshift-docs/pull/341"},"issue":{"href":"https://api.github.com/repos/openshift/openshift-docs/issues/341"},"comments":{"href":"https://api.github.com/repos/openshift/openshift-docs/issues/341/comments"},"review_comments":{"href":"https://api.github.com/repos/openshift/openshift-docs/pulls/341/comments"},"review_comment":{"href":"https://api.github.com/repos/openshift/openshift-docs/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openshift/openshift-docs/pulls/341/commits"},"statuses":{"href":"https://api.github.com/repos/openshift/openshift-docs/statuses/531cdd5d1a663a0e2c1e7a3265cd3aa968bdd39c"}}}}