{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/15365","labels_url":"https://api.github.com/repos/docker/docker/issues/15365/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/15365/comments","events_url":"https://api.github.com/repos/docker/docker/issues/15365/events","html_url":"https://github.com/docker/docker/pull/15365","id":99412122,"number":15365,"title":"Docker authorization plug-in infrastructure","user":{"login":"liron-l","id":10955685,"avatar_url":"https://avatars.githubusercontent.com/u/10955685?v=3","gravatar_id":"","url":"https://api.github.com/users/liron-l","html_url":"https://github.com/liron-l","followers_url":"https://api.github.com/users/liron-l/followers","following_url":"https://api.github.com/users/liron-l/following{/other_user}","gists_url":"https://api.github.com/users/liron-l/gists{/gist_id}","starred_url":"https://api.github.com/users/liron-l/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liron-l/subscriptions","organizations_url":"https://api.github.com/users/liron-l/orgs","repos_url":"https://api.github.com/users/liron-l/repos","events_url":"https://api.github.com/users/liron-l/events{/privacy}","received_events_url":"https://api.github.com/users/liron-l/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/status/1-design-review","name":"status/1-design-review","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":11,"created_at":"2015-08-06T11:08:57Z","updated_at":"2015-10-16T17:17:19Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/15365","html_url":"https://github.com/docker/docker/pull/15365","diff_url":"https://github.com/docker/docker/pull/15365.diff","patch_url":"https://github.com/docker/docker/pull/15365.patch"},"body":"REMARK: Code is intended to be complementary to the docker (authZ discussion) [https://github.com/docker/docker/issues/14674]. There are several aspects of the proposed code which require additional work and testing. Please use this commit as a low level design proposal.\r\n\r\n=======\r\n\r\nDocker authorization plug-in infrastructure enables extending the functionality of the Docker daemon with respect to user authorization.\r\nThe infrastructure enables registering a set of external authorization\r\nplug-in. Each plug-in receives information about the user and the\r\nrequest and decides whether to allow or deny the request. Only in case\r\nall plug-ins allow accessing the resource the access is granted.\r\n\r\nEach plug-in operates as a separate service, and registers with Docker\r\nthrough general (plug-ins API)\r\n[https://blog.docker.com/2015/06/extending-docker-with-plugins/]. No\r\nDocker daemon recompilation is required in order to add / remove an\r\nauthentication plug-in. Each plug-in is notified twice for each\r\noperation: 1) before the operation is performed and, 2) before the\r\nresponse is returned to the client. The plug-ins can modify the response\r\nthat is returned to the client.\r\n\r\nThe authorization depends on the authorization effort that takes place\r\nin parallel [https://github.com/docker/docker/issues/13697].\r\n\r\nThis is the official issue of the authorization effort:\r\nhttps://github.com/docker/docker/issues/14674\r\n\r\n(Here)[https://github.com/rhatdan/docker-rbac] you can find an open\r\ndocument that discusses a default RBAC plug-in for Docker."},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/148776441","html_url":"https://github.com/docker/docker/pull/15365#issuecomment-148776441","issue_url":"https://api.github.com/repos/docker/docker/issues/15365","id":148776441,"user":{"login":"calavera","id":1050,"avatar_url":"https://avatars.githubusercontent.com/u/1050?v=3","gravatar_id":"","url":"https://api.github.com/users/calavera","html_url":"https://github.com/calavera","followers_url":"https://api.github.com/users/calavera/followers","following_url":"https://api.github.com/users/calavera/following{/other_user}","gists_url":"https://api.github.com/users/calavera/gists{/gist_id}","starred_url":"https://api.github.com/users/calavera/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/calavera/subscriptions","organizations_url":"https://api.github.com/users/calavera/orgs","repos_url":"https://api.github.com/users/calavera/repos","events_url":"https://api.github.com/users/calavera/events{/privacy}","received_events_url":"https://api.github.com/users/calavera/received_events","type":"User","site_admin":false},"created_at":"2015-10-16T17:17:19Z","updated_at":"2015-10-16T17:17:19Z","body":"I'd rather avoid premature optimizations. That will allow us to get this in sooner rather than later. If we don't need cross references with the daemon, let's not add them from now.\r\n\r\nFrom a design point of view, this change looks good to me, but I'll wait for other maintainers to confirm.\r\nFrom a code point of view, there have been a lot of changes in the server package that conflict with this. We can probably reduce the conflicts transforming this code in a middleware like we've done with other pre processing code in the server:\r\n\r\nhttps://github.com/docker/docker/blob/master/api/server/middleware.go"}}