{"action":"created","comment":{"url":"https://api.github.com/repos/docker/docker/pulls/comments/36605799","id":36605799,"diff_hunk":"@@ -0,0 +1,130 @@\n+package authorization\n+\n+import (\n+\t\"fmt\"\n+\t\"github.com/Sirupsen/logrus\"\n+\t\"github.com/docker/docker/pkg/plugins\"\n+\t\"github.com/docker/docker/pkg/version\"\n+\t\"net/http\"\n+\t\"net/http/httptest\"\n+\t\"net/http/httputil\"\n+)\n+\n+// NewCtx creates new authZ context, it is used to store authorization information related to a specific docker\n+// REST http session\n+// A context provides two method:\n+// Authenticate Request:\n+// Call authZ plugins with current REST request and AuthN response\n+// Request contains full HTTP packet sent to the docker daemon\n+// https://docs.docker.com/reference/api/docker_remote_api/\n+//\n+// Authenticate Response:\n+// Call authZ plugins with full info about current REST request, REST response and AuthN response\n+// The response from this method may contains content that overrides the daemon response\n+// This allows authZ plugins to filter privileged content\n+//\n+// If multiple authZ plugins are specified, the block/allow decision is based on ANDing all plugin results\n+// For response manipulation, the response from each plugin is piped between plugins. Plugin execution order\n+// is determined according to daemon parameters\n+func NewCtx(authZPlugins []string, user, userAuthNMethod, requestMethod, requestUri string) *Ctx {\n+\treturn &Ctx{authZPlugins: authZPlugins, user: user, userAuthNMethod: userAuthNMethod, requestMethod: requestMethod, requestUri: requestUri}\n+}\n+\n+type Ctx struct {\n+\tuser            string\n+\tuserAuthNMethod string\n+\trequestMethod   string\n+\trequestUri      string\n+\tauthZPlugins    []string\n+\tplugins         []*plugins.Plugin\n+\trawRequest      []byte\n+}\n+\n+// AuthRequest authorized the request to the docker daemon using authZ plugins\n+func (a *Ctx) AuthZRequest(w http.ResponseWriter, r *http.Request) (err error) {\n+\n+\tlogrus.Debugf(\"AuthZ requset using plugins %s\", a.authZPlugins)\n+\n+\tfor _, name := range a.authZPlugins {\n+\n+\t\tp, err := plugins.Get(name, AuthZApiImplements)\n+\t\tif err != nil {\n+\t\t\treturn err\n+\t\t}\n+\t\ta.plugins = append(a.plugins, p)","path":"pkg/authorization/authz.go","position":54,"original_position":54,"commit_id":"4544302d011a3dd6c9b56050a8f58dba507eb8fe","original_commit_id":"4544302d011a3dd6c9b56050a8f58dba507eb8fe","user":{"login":"NathanMcCauley","id":695682,"avatar_url":"https://avatars.githubusercontent.com/u/695682?v=3","gravatar_id":"","url":"https://api.github.com/users/NathanMcCauley","html_url":"https://github.com/NathanMcCauley","followers_url":"https://api.github.com/users/NathanMcCauley/followers","following_url":"https://api.github.com/users/NathanMcCauley/following{/other_user}","gists_url":"https://api.github.com/users/NathanMcCauley/gists{/gist_id}","starred_url":"https://api.github.com/users/NathanMcCauley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NathanMcCauley/subscriptions","organizations_url":"https://api.github.com/users/NathanMcCauley/orgs","repos_url":"https://api.github.com/users/NathanMcCauley/repos","events_url":"https://api.github.com/users/NathanMcCauley/events{/privacy}","received_events_url":"https://api.github.com/users/NathanMcCauley/received_events","type":"User","site_admin":false},"body":"Is it necessary to parse and build this on every request? Could instead the `Ctx` struct be built with a set of `authZPlugins` of type `[]*plugins.Plugin`? Or better yet does it make sense to create a typed plugin that could be plugins.AuthZPlugin`?","created_at":"2015-08-10T07:02:30Z","updated_at":"2015-08-10T07:02:30Z","html_url":"https://github.com/docker/docker/pull/15365#discussion_r36605799","pull_request_url":"https://api.github.com/repos/docker/docker/pulls/15365","_links":{"self":{"href":"https://api.github.com/repos/docker/docker/pulls/comments/36605799"},"html":{"href":"https://github.com/docker/docker/pull/15365#discussion_r36605799"},"pull_request":{"href":"https://api.github.com/repos/docker/docker/pulls/15365"}}},"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/15365","id":41776212,"html_url":"https://github.com/docker/docker/pull/15365","diff_url":"https://github.com/docker/docker/pull/15365.diff","patch_url":"https://github.com/docker/docker/pull/15365.patch","issue_url":"https://api.github.com/repos/docker/docker/issues/15365","number":15365,"state":"open","locked":false,"title":"Docker authorization plug-in infrastructure","user":{"login":"liron-l","id":10955685,"avatar_url":"https://avatars.githubusercontent.com/u/10955685?v=3","gravatar_id":"","url":"https://api.github.com/users/liron-l","html_url":"https://github.com/liron-l","followers_url":"https://api.github.com/users/liron-l/followers","following_url":"https://api.github.com/users/liron-l/following{/other_user}","gists_url":"https://api.github.com/users/liron-l/gists{/gist_id}","starred_url":"https://api.github.com/users/liron-l/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liron-l/subscriptions","organizations_url":"https://api.github.com/users/liron-l/orgs","repos_url":"https://api.github.com/users/liron-l/repos","events_url":"https://api.github.com/users/liron-l/events{/privacy}","received_events_url":"https://api.github.com/users/liron-l/received_events","type":"User","site_admin":false},"body":"REMARK: Code is intended to be complementary to the docker (authZ discussion) [https://github.com/docker/docker/issues/14674]. There are several aspects of the proposed code which require additional work and testing. Please use this commit as a low level design proposal.\r\n\r\n=======\r\n\r\nDocker authorization plug-in infrastructure enables extending the functionality of the Docker daemon with respect to user authorization.\r\nThe infrastructure enables registering a set of external authorization\r\nplug-in. Each plug-in receives information about the user and the\r\nrequest and decides whether to allow or deny the request. Only in case\r\nall plug-ins allow accessing the resource the access is granted.\r\n\r\nEach plug-in operates as a separate service, and registers with Docker\r\nthrough general (plug-ins API)\r\n[https://blog.docker.com/2015/06/extending-docker-with-plugins/]. No\r\nDocker daemon recompilation is required in order to add / remove an\r\nauthentication plug-in. Each plug-in is notified twice for each\r\noperation: 1) before the operation is performed and, 2) before the\r\nresponse is returned to the client. The plug-ins can modify the response\r\nthat is returned to the client.\r\n\r\nThe authorization depends on the authorization effort that takes place\r\nin parallel [https://github.com/docker/docker/issues/13697].\r\n\r\nThis is the official issue of the authorization effort:\r\nhttps://github.com/docker/docker/issues/14674\r\n\r\n(Here)[https://github.com/rhatdan/docker-rbac] you can find an open\r\ndocument that discusses a default RBAC plug-in for Docker.","created_at":"2015-08-06T11:08:57Z","updated_at":"2015-08-10T07:02:30Z","closed_at":null,"merged_at":null,"merge_commit_sha":"fb10ff6e12f62cc603fd61dc4f7dd40d77e511ca","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/docker/docker/pulls/15365/commits","review_comments_url":"https://api.github.com/repos/docker/docker/pulls/15365/comments","review_comment_url":"https://api.github.com/repos/docker/docker/pulls/comments{/number}","comments_url":"https://api.github.com/repos/docker/docker/issues/15365/comments","statuses_url":"https://api.github.com/repos/docker/docker/statuses/4544302d011a3dd6c9b56050a8f58dba507eb8fe","head":{"label":"twistlock:14674-docker-authz","ref":"14674-docker-authz","sha":"4544302d011a3dd6c9b56050a8f58dba507eb8fe","user":{"login":"twistlock","id":12218272,"avatar_url":"https://avatars.githubusercontent.com/u/12218272?v=3","gravatar_id":"","url":"https://api.github.com/users/twistlock","html_url":"https://github.com/twistlock","followers_url":"https://api.github.com/users/twistlock/followers","following_url":"https://api.github.com/users/twistlock/following{/other_user}","gists_url":"https://api.github.com/users/twistlock/gists{/gist_id}","starred_url":"https://api.github.com/users/twistlock/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/twistlock/subscriptions","organizations_url":"https://api.github.com/users/twistlock/orgs","repos_url":"https://api.github.com/users/twistlock/repos","events_url":"https://api.github.com/users/twistlock/events{/privacy}","received_events_url":"https://api.github.com/users/twistlock/received_events","type":"Organization","site_admin":false},"repo":{"id":37524309,"name":"docker","full_name":"twistlock/docker","owner":{"login":"twistlock","id":12218272,"avatar_url":"https://avatars.githubusercontent.com/u/12218272?v=3","gravatar_id":"","url":"https://api.github.com/users/twistlock","html_url":"https://github.com/twistlock","followers_url":"https://api.github.com/users/twistlock/followers","following_url":"https://api.github.com/users/twistlock/following{/other_user}","gists_url":"https://api.github.com/users/twistlock/gists{/gist_id}","starred_url":"https://api.github.com/users/twistlock/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/twistlock/subscriptions","organizations_url":"https://api.github.com/users/twistlock/orgs","repos_url":"https://api.github.com/users/twistlock/repos","events_url":"https://api.github.com/users/twistlock/events{/privacy}","received_events_url":"https://api.github.com/users/twistlock/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/twistlock/docker","description":"Docker - the open-source application container engine","fork":true,"url":"https://api.github.com/repos/twistlock/docker","forks_url":"https://api.github.com/repos/twistlock/docker/forks","keys_url":"https://api.github.com/repos/twistlock/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/twistlock/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/twistlock/docker/teams","hooks_url":"https://api.github.com/repos/twistlock/docker/hooks","issue_events_url":"https://api.github.com/repos/twistlock/docker/issues/events{/number}","events_url":"https://api.github.com/repos/twistlock/docker/events","assignees_url":"https://api.github.com/repos/twistlock/docker/assignees{/user}","branches_url":"https://api.github.com/repos/twistlock/docker/branches{/branch}","tags_url":"https://api.github.com/repos/twistlock/docker/tags","blobs_url":"https://api.github.com/repos/twistlock/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/twistlock/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/twistlock/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/twistlock/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/twistlock/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/twistlock/docker/languages","stargazers_url":"https://api.github.com/repos/twistlock/docker/stargazers","contributors_url":"https://api.github.com/repos/twistlock/docker/contributors","subscribers_url":"https://api.github.com/repos/twistlock/docker/subscribers","subscription_url":"https://api.github.com/repos/twistlock/docker/subscription","commits_url":"https://api.github.com/repos/twistlock/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/twistlock/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/twistlock/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/twistlock/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/twistlock/docker/contents/{+path}","compare_url":"https://api.github.com/repos/twistlock/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/twistlock/docker/merges","archive_url":"https://api.github.com/repos/twistlock/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/twistlock/docker/downloads","issues_url":"https://api.github.com/repos/twistlock/docker/issues{/number}","pulls_url":"https://api.github.com/repos/twistlock/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/twistlock/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/twistlock/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/twistlock/docker/labels{/name}","releases_url":"https://api.github.com/repos/twistlock/docker/releases{/id}","created_at":"2015-06-16T10:46:44Z","updated_at":"2015-06-16T10:46:54Z","pushed_at":"2015-08-06T11:10:10Z","git_url":"git://github.com/twistlock/docker.git","ssh_url":"git@github.com:twistlock/docker.git","clone_url":"https://github.com/twistlock/docker.git","svn_url":"https://github.com/twistlock/docker","homepage":"http://www.docker.com","size":64917,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"docker:master","ref":"master","sha":"ad5355151ce233388df0d5b8a1c3b3e7a6ba9077","user":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"repo":{"id":7691631,"name":"docker","full_name":"docker/docker","owner":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/docker/docker","description":"Docker - the open-source application container engine","fork":false,"url":"https://api.github.com/repos/docker/docker","forks_url":"https://api.github.com/repos/docker/docker/forks","keys_url":"https://api.github.com/repos/docker/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/docker/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/docker/docker/teams","hooks_url":"https://api.github.com/repos/docker/docker/hooks","issue_events_url":"https://api.github.com/repos/docker/docker/issues/events{/number}","events_url":"https://api.github.com/repos/docker/docker/events","assignees_url":"https://api.github.com/repos/docker/docker/assignees{/user}","branches_url":"https://api.github.com/repos/docker/docker/branches{/branch}","tags_url":"https://api.github.com/repos/docker/docker/tags","blobs_url":"https://api.github.com/repos/docker/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/docker/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/docker/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/docker/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/docker/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/docker/docker/languages","stargazers_url":"https://api.github.com/repos/docker/docker/stargazers","contributors_url":"https://api.github.com/repos/docker/docker/contributors","subscribers_url":"https://api.github.com/repos/docker/docker/subscribers","subscription_url":"https://api.github.com/repos/docker/docker/subscription","commits_url":"https://api.github.com/repos/docker/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/docker/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/docker/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/docker/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/docker/docker/contents/{+path}","compare_url":"https://api.github.com/repos/docker/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/docker/docker/merges","archive_url":"https://api.github.com/repos/docker/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/docker/docker/downloads","issues_url":"https://api.github.com/repos/docker/docker/issues{/number}","pulls_url":"https://api.github.com/repos/docker/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/docker/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/docker/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/docker/docker/labels{/name}","releases_url":"https://api.github.com/repos/docker/docker/releases{/id}","created_at":"2013-01-18T18:10:57Z","updated_at":"2015-08-10T06:11:28Z","pushed_at":"2015-08-10T03:13:12Z","git_url":"git://github.com/docker/docker.git","ssh_url":"git@github.com:docker/docker.git","clone_url":"https://github.com/docker/docker.git","svn_url":"https://github.com/docker/docker","homepage":"http://www.docker.com","size":237557,"stargazers_count":23845,"watchers_count":23845,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":6041,"mirror_url":null,"open_issues_count":1037,"forks":6041,"open_issues":1037,"watchers":23845,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/docker/docker/pulls/15365"},"html":{"href":"https://github.com/docker/docker/pull/15365"},"issue":{"href":"https://api.github.com/repos/docker/docker/issues/15365"},"comments":{"href":"https://api.github.com/repos/docker/docker/issues/15365/comments"},"review_comments":{"href":"https://api.github.com/repos/docker/docker/pulls/15365/comments"},"review_comment":{"href":"https://api.github.com/repos/docker/docker/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/docker/docker/pulls/15365/commits"},"statuses":{"href":"https://api.github.com/repos/docker/docker/statuses/4544302d011a3dd6c9b56050a8f58dba507eb8fe"}}}}