{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/15365","labels_url":"https://api.github.com/repos/docker/docker/issues/15365/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/15365/comments","events_url":"https://api.github.com/repos/docker/docker/issues/15365/events","html_url":"https://github.com/docker/docker/pull/15365","id":99412122,"number":15365,"title":"Docker authorization plug-in infrastructure","user":{"login":"liron-l","id":10955685,"avatar_url":"https://avatars.githubusercontent.com/u/10955685?v=3","gravatar_id":"","url":"https://api.github.com/users/liron-l","html_url":"https://github.com/liron-l","followers_url":"https://api.github.com/users/liron-l/followers","following_url":"https://api.github.com/users/liron-l/following{/other_user}","gists_url":"https://api.github.com/users/liron-l/gists{/gist_id}","starred_url":"https://api.github.com/users/liron-l/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liron-l/subscriptions","organizations_url":"https://api.github.com/users/liron-l/orgs","repos_url":"https://api.github.com/users/liron-l/repos","events_url":"https://api.github.com/users/liron-l/events{/privacy}","received_events_url":"https://api.github.com/users/liron-l/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/status/3-docs-review","name":"status/3-docs-review","color":"c7def8"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":28,"created_at":"2015-08-06T11:08:57Z","updated_at":"2015-11-25T19:14:57Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/15365","html_url":"https://github.com/docker/docker/pull/15365","diff_url":"https://github.com/docker/docker/pull/15365.diff","patch_url":"https://github.com/docker/docker/pull/15365.patch"},"body":"REMARK: Code is intended to be complementary to the docker (authZ discussion) [https://github.com/docker/docker/issues/14674]. There are several aspects of the proposed code which require additional work and testing. Please use this commit as a low level design proposal.\r\n\r\n=======\r\n\r\nDocker authorization plug-in infrastructure enables extending the functionality of the Docker daemon with respect to user authorization.\r\nThe infrastructure enables registering a set of external authorization\r\nplug-in. Each plug-in receives information about the user and the\r\nrequest and decides whether to allow or deny the request. Only in case\r\nall plug-ins allow accessing the resource the access is granted.\r\n\r\nEach plug-in operates as a separate service, and registers with Docker\r\nthrough general (plug-ins API)\r\n[https://blog.docker.com/2015/06/extending-docker-with-plugins/]. No\r\nDocker daemon recompilation is required in order to add / remove an\r\nauthentication plug-in. Each plug-in is notified twice for each\r\noperation: 1) before the operation is performed and, 2) before the\r\nresponse is returned to the client. The plug-ins can modify the response\r\nthat is returned to the client.\r\n\r\nThe authorization depends on the authorization effort that takes place\r\nin parallel [https://github.com/docker/docker/issues/13697].\r\n\r\nThis is the official issue of the authorization effort:\r\nhttps://github.com/docker/docker/issues/14674\r\n\r\n(Here)[https://github.com/rhatdan/docker-rbac] you can find an open\r\ndocument that discusses a default RBAC plug-in for Docker."},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/159704888","html_url":"https://github.com/docker/docker/pull/15365#issuecomment-159704888","issue_url":"https://api.github.com/repos/docker/docker/issues/15365","id":159704888,"user":{"login":"cpuguy83","id":799078,"avatar_url":"https://avatars.githubusercontent.com/u/799078?v=3","gravatar_id":"","url":"https://api.github.com/users/cpuguy83","html_url":"https://github.com/cpuguy83","followers_url":"https://api.github.com/users/cpuguy83/followers","following_url":"https://api.github.com/users/cpuguy83/following{/other_user}","gists_url":"https://api.github.com/users/cpuguy83/gists{/gist_id}","starred_url":"https://api.github.com/users/cpuguy83/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cpuguy83/subscriptions","organizations_url":"https://api.github.com/users/cpuguy83/orgs","repos_url":"https://api.github.com/users/cpuguy83/repos","events_url":"https://api.github.com/users/cpuguy83/events{/privacy}","received_events_url":"https://api.github.com/users/cpuguy83/received_events","type":"User","site_admin":false},"created_at":"2015-11-25T19:14:57Z","updated_at":"2015-11-25T19:14:57Z","body":"Honestly I'm not sure what the benefit is of passing the request (or the response) body to the auth plugin.\r\nIn addition, `docker login` will indeed pass credentials to the auth plugin."}}