{"action":"created","comment":{"url":"https://api.github.com/repos/openshift/openshift-docs/pulls/comments/29968645","id":29968645,"diff_hunk":"@@ -0,0 +1,194 @@\n+= Authorization\n+{product-author}\n+{product-version}\n+:data-uri:\n+:icons:\n+:experimental:\n+:toc: macro\n+:toc-title:\n+\n+toc::[]\n+\n+== Overview\n+Authorization policy determines whether a user is allowed to perform a given\n+link:#action[action]. This allows platform administrators to use\n+link:#cluster-policy-and-local-policy[cluster policy] to control who has various\n+access levels to the overall OpenShift platform itself. It also allows\n+developers to use link:#cluster-policy-and-local-policy[local policy] to control\n+who has access to their link:../../dev_guide/projects.html[projects]. Note that\n+authorization is a separate step from link:authentication.html[authentication],\n+which is more about determining the identity of who is taking the action.\n+\n+Authorization is managed using:\n+\n+[cols=\"1,7\"]\n+|===\n+\n+|[[rules-def]]*Rules* |Sets of permitted link:#action[verbs] on a set of\n+link:../core_objects/overview.html[resources]. For example, whether something\n+can `create` pods.\n+\n+|[[roles-def]]*Roles* |Collections of rules.\n+link:authentication.html#users-and-groups[Users and groups] can be associated\n+with, or _bound_ to, multiple link:#roles[roles] at the same time.\n+\n+|[[bindings]]*Bindings* |Associations between users and/or groups with a\n+link:#roles[role].\n+\n+|===\n+\n+Rules, roles, and bindings can be visualized\n+link:../../admin_guide/manage_authorization_policy.html#viewing-roles-and-bindings[using\n+the CLI]. For example, consider the following excerpt from\n+link:../../admin_guide/manage_authorization_policy.html#viewing-roles-and-bindings[viewing\n+a policy], showing rule sets for the *admin* and *basic-user*\n+link:#roles[default roles]:\n+\n+====\n+\n+[options=\"nowrap\"]\n+----\n+admin\t\t\tVerbs\t\t\t\t\tResources\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tResource Names\tExtension\n+\t\t\t[create delete get list update watch]\t[projects resourcegroup:exposedkube resourcegroup:exposedopenshift resourcegroup:granter secrets]\t\t\t\t[]\n+\t\t\t[get list watch]\t\t\t[resourcegroup:allkube resourcegroup:allkube-status resourcegroup:allopenshift-status resourcegroup:policy]\t\t\t[]\n+basic-user\t\tVerbs\t\t\t\t\tResources\t\t\t\t\t\t\t\t\t\t\t\t\t\t\tResource Names\tExtension\n+\t\t\t[get]\t\t\t\t\t[users]\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t[~]\n+\t\t\t[list]\t\t\t\t\t[projectrequests]\t\t\t\t\t\t\t\t\t\t\t\t\t\t[]\n+\t\t\t[list]\t\t\t\t\t[projects]\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t[]\n+\t\t\t[create]\t\t\t\t[subjectaccessreviews]\t\t\t\t\t\t\t\t\t\t\t\t\t\t[]\t\tIsPersonalSubjectAccessReview\n+----\n+====\n+\n+The following excerpt from\n+link:../../admin_guide/manage_authorization_policy.html#viewing-roles-and-bindings[viewing\n+policy bindings] shows the above roles bound to various users and groups:\n+\n+====\n+\n+[options=\"nowrap\"]\n+----\n+RoleBinding[admins]:\n+\t\t\t\tRole:\tadmin\n+\t\t\t\tUsers:\t[alice system:admin]\n+\t\t\t\tGroups:\t[]\n+RoleBinding[basic-user]:\n+\t\t\t\tRole:\tbasic-user\n+\t\t\t\tUsers:\t[joe]\n+\t\t\t\tGroups:\t[devel]\n+----\n+====\n+\n+== Evaluating Authorization\n+\n+Several factors are combined to make the decision when OpenShift evaluates\n+authorization:\n+\n+[cols=\"1,7\"]\n+|===\n+\n+|[[identity]]*Identity* |Both the user name and list of groups the user belongs to.\n+\n+|[[action]]*Action* a|The action being performed. In most cases, this consists of:\n+\n+[horizontal]\n+Project:: The link:../../dev_guide/projects.html[project] being accessed.\n+Verb:: Can be `get`, `list`, `create`, `update`, or others.\n+Resource:: The API endpoint being accessed.","path":"architecture/additional_concepts/authorization.adoc","position":96,"original_position":96,"commit_id":"fbfbbe7b684c6ba495e51377e231de21de82c798","original_commit_id":"fbfbbe7b684c6ba495e51377e231de21de82c798","user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"body":"We can now control on \"Resource Name\" as well.","created_at":"2015-05-08T19:18:37Z","updated_at":"2015-05-08T19:18:37Z","html_url":"https://github.com/openshift/openshift-docs/pull/341#discussion_r29968645","pull_request_url":"https://api.github.com/repos/openshift/openshift-docs/pulls/341","_links":{"self":{"href":"https://api.github.com/repos/openshift/openshift-docs/pulls/comments/29968645"},"html":{"href":"https://github.com/openshift/openshift-docs/pull/341#discussion_r29968645"},"pull_request":{"href":"https://api.github.com/repos/openshift/openshift-docs/pulls/341"}}},"pull_request":{"url":"https://api.github.com/repos/openshift/openshift-docs/pulls/341","id":34672166,"html_url":"https://github.com/openshift/openshift-docs/pull/341","diff_url":"https://github.com/openshift/openshift-docs/pull/341.diff","patch_url":"https://github.com/openshift/openshift-docs/pull/341.patch","issue_url":"https://api.github.com/repos/openshift/openshift-docs/issues/341","number":341,"state":"open","locked":false,"title":"Edits to authz topics.","user":{"login":"adellape","id":3442316,"avatar_url":"https://avatars.githubusercontent.com/u/3442316?v=3","gravatar_id":"","url":"https://api.github.com/users/adellape","html_url":"https://github.com/adellape","followers_url":"https://api.github.com/users/adellape/followers","following_url":"https://api.github.com/users/adellape/following{/other_user}","gists_url":"https://api.github.com/users/adellape/gists{/gist_id}","starred_url":"https://api.github.com/users/adellape/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adellape/subscriptions","organizations_url":"https://api.github.com/users/adellape/orgs","repos_url":"https://api.github.com/users/adellape/repos","events_url":"https://api.github.com/users/adellape/events{/privacy}","received_events_url":"https://api.github.com/users/adellape/received_events","type":"User","site_admin":false},"body":"@deads2k This breaks up the existing authorization topic into an Admin Guide topic <1> (showing `osadm` usage) and an Architecture topic <2> (discussing authz in general). I updated the global roles/bindings examples in <1> for what I was seeing in latest builds, as it seemed to have grown/changed quite a bit. In absence of `insecure-cluster-admin`, I wasn't sure what to use in the `remove-role-from-group` example, so I went with `system:delete-tokens` for now, but interested in thoughts there.\r\n\r\nI figure we can re-introduce an end-user-focused authz topic for the Dev Guide once they (presumably) don't have to use `osadm` to manage roles for local bindings?\r\n\r\nPTAL. Prettier versions for convenience (the rendering gets weird in GH):\r\n\r\n<1> http://file.rdu.redhat.com/~adellape/050415/authz_edits/authz_edits/admin_guide/manage_authorization_policy.html\r\n<2> http://file.rdu.redhat.com/~adellape/050415/authz_edits/authz_edits/architecture/additional_concepts/authorization.html","created_at":"2015-05-04T20:33:16Z","updated_at":"2015-05-08T19:18:37Z","closed_at":null,"merged_at":null,"merge_commit_sha":"5853b24d8d928f418c996e402c7a784c69f4dc1a","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/openshift/openshift-docs/pulls/341/commits","review_comments_url":"https://api.github.com/repos/openshift/openshift-docs/pulls/341/comments","review_comment_url":"https://api.github.com/repos/openshift/openshift-docs/pulls/comments{/number}","comments_url":"https://api.github.com/repos/openshift/openshift-docs/issues/341/comments","statuses_url":"https://api.github.com/repos/openshift/openshift-docs/statuses/fbfbbe7b684c6ba495e51377e231de21de82c798","head":{"label":"adellape:authz_edits","ref":"authz_edits","sha":"fbfbbe7b684c6ba495e51377e231de21de82c798","user":{"login":"adellape","id":3442316,"avatar_url":"https://avatars.githubusercontent.com/u/3442316?v=3","gravatar_id":"","url":"https://api.github.com/users/adellape","html_url":"https://github.com/adellape","followers_url":"https://api.github.com/users/adellape/followers","following_url":"https://api.github.com/users/adellape/following{/other_user}","gists_url":"https://api.github.com/users/adellape/gists{/gist_id}","starred_url":"https://api.github.com/users/adellape/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adellape/subscriptions","organizations_url":"https://api.github.com/users/adellape/orgs","repos_url":"https://api.github.com/users/adellape/repos","events_url":"https://api.github.com/users/adellape/events{/privacy}","received_events_url":"https://api.github.com/users/adellape/received_events","type":"User","site_admin":false},"repo":{"id":29119125,"name":"openshift-docs","full_name":"adellape/openshift-docs","owner":{"login":"adellape","id":3442316,"avatar_url":"https://avatars.githubusercontent.com/u/3442316?v=3","gravatar_id":"","url":"https://api.github.com/users/adellape","html_url":"https://github.com/adellape","followers_url":"https://api.github.com/users/adellape/followers","following_url":"https://api.github.com/users/adellape/following{/other_user}","gists_url":"https://api.github.com/users/adellape/gists{/gist_id}","starred_url":"https://api.github.com/users/adellape/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adellape/subscriptions","organizations_url":"https://api.github.com/users/adellape/orgs","repos_url":"https://api.github.com/users/adellape/repos","events_url":"https://api.github.com/users/adellape/events{/privacy}","received_events_url":"https://api.github.com/users/adellape/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/adellape/openshift-docs","description":"OpenShift Documentation","fork":true,"url":"https://api.github.com/repos/adellape/openshift-docs","forks_url":"https://api.github.com/repos/adellape/openshift-docs/forks","keys_url":"https://api.github.com/repos/adellape/openshift-docs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/adellape/openshift-docs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/adellape/openshift-docs/teams","hooks_url":"https://api.github.com/repos/adellape/openshift-docs/hooks","issue_events_url":"https://api.github.com/repos/adellape/openshift-docs/issues/events{/number}","events_url":"https://api.github.com/repos/adellape/openshift-docs/events","assignees_url":"https://api.github.com/repos/adellape/openshift-docs/assignees{/user}","branches_url":"https://api.github.com/repos/adellape/openshift-docs/branches{/branch}","tags_url":"https://api.github.com/repos/adellape/openshift-docs/tags","blobs_url":"https://api.github.com/repos/adellape/openshift-docs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/adellape/openshift-docs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/adellape/openshift-docs/git/refs{/sha}","trees_url":"https://api.github.com/repos/adellape/openshift-docs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/adellape/openshift-docs/statuses/{sha}","languages_url":"https://api.github.com/repos/adellape/openshift-docs/languages","stargazers_url":"https://api.github.com/repos/adellape/openshift-docs/stargazers","contributors_url":"https://api.github.com/repos/adellape/openshift-docs/contributors","subscribers_url":"https://api.github.com/repos/adellape/openshift-docs/subscribers","subscription_url":"https://api.github.com/repos/adellape/openshift-docs/subscription","commits_url":"https://api.github.com/repos/adellape/openshift-docs/commits{/sha}","git_commits_url":"https://api.github.com/repos/adellape/openshift-docs/git/commits{/sha}","comments_url":"https://api.github.com/repos/adellape/openshift-docs/comments{/number}","issue_comment_url":"https://api.github.com/repos/adellape/openshift-docs/issues/comments{/number}","contents_url":"https://api.github.com/repos/adellape/openshift-docs/contents/{+path}","compare_url":"https://api.github.com/repos/adellape/openshift-docs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/adellape/openshift-docs/merges","archive_url":"https://api.github.com/repos/adellape/openshift-docs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/adellape/openshift-docs/downloads","issues_url":"https://api.github.com/repos/adellape/openshift-docs/issues{/number}","pulls_url":"https://api.github.com/repos/adellape/openshift-docs/pulls{/number}","milestones_url":"https://api.github.com/repos/adellape/openshift-docs/milestones{/number}","notifications_url":"https://api.github.com/repos/adellape/openshift-docs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/adellape/openshift-docs/labels{/name}","releases_url":"https://api.github.com/repos/adellape/openshift-docs/releases{/id}","created_at":"2015-01-12T04:47:07Z","updated_at":"2015-04-29T21:31:10Z","pushed_at":"2015-05-08T18:09:09Z","git_url":"git://github.com/adellape/openshift-docs.git","ssh_url":"git@github.com:adellape/openshift-docs.git","clone_url":"https://github.com/adellape/openshift-docs.git","svn_url":"https://github.com/adellape/openshift-docs","homepage":null,"size":3503,"stargazers_count":0,"watchers_count":0,"language":"CSS","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"openshift:master","ref":"master","sha":"85d32338e13e71d52adc0a2837bc06a9de72ffb3","user":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"repo":{"id":21740844,"name":"openshift-docs","full_name":"openshift/openshift-docs","owner":{"login":"openshift","id":792337,"avatar_url":"https://avatars.githubusercontent.com/u/792337?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift","html_url":"https://github.com/openshift","followers_url":"https://api.github.com/users/openshift/followers","following_url":"https://api.github.com/users/openshift/following{/other_user}","gists_url":"https://api.github.com/users/openshift/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift/subscriptions","organizations_url":"https://api.github.com/users/openshift/orgs","repos_url":"https://api.github.com/users/openshift/repos","events_url":"https://api.github.com/users/openshift/events{/privacy}","received_events_url":"https://api.github.com/users/openshift/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/openshift/openshift-docs","description":"OpenShift Documentation","fork":false,"url":"https://api.github.com/repos/openshift/openshift-docs","forks_url":"https://api.github.com/repos/openshift/openshift-docs/forks","keys_url":"https://api.github.com/repos/openshift/openshift-docs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/openshift/openshift-docs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/openshift/openshift-docs/teams","hooks_url":"https://api.github.com/repos/openshift/openshift-docs/hooks","issue_events_url":"https://api.github.com/repos/openshift/openshift-docs/issues/events{/number}","events_url":"https://api.github.com/repos/openshift/openshift-docs/events","assignees_url":"https://api.github.com/repos/openshift/openshift-docs/assignees{/user}","branches_url":"https://api.github.com/repos/openshift/openshift-docs/branches{/branch}","tags_url":"https://api.github.com/repos/openshift/openshift-docs/tags","blobs_url":"https://api.github.com/repos/openshift/openshift-docs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/openshift/openshift-docs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/openshift/openshift-docs/git/refs{/sha}","trees_url":"https://api.github.com/repos/openshift/openshift-docs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/openshift/openshift-docs/statuses/{sha}","languages_url":"https://api.github.com/repos/openshift/openshift-docs/languages","stargazers_url":"https://api.github.com/repos/openshift/openshift-docs/stargazers","contributors_url":"https://api.github.com/repos/openshift/openshift-docs/contributors","subscribers_url":"https://api.github.com/repos/openshift/openshift-docs/subscribers","subscription_url":"https://api.github.com/repos/openshift/openshift-docs/subscription","commits_url":"https://api.github.com/repos/openshift/openshift-docs/commits{/sha}","git_commits_url":"https://api.github.com/repos/openshift/openshift-docs/git/commits{/sha}","comments_url":"https://api.github.com/repos/openshift/openshift-docs/comments{/number}","issue_comment_url":"https://api.github.com/repos/openshift/openshift-docs/issues/comments{/number}","contents_url":"https://api.github.com/repos/openshift/openshift-docs/contents/{+path}","compare_url":"https://api.github.com/repos/openshift/openshift-docs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/openshift/openshift-docs/merges","archive_url":"https://api.github.com/repos/openshift/openshift-docs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/openshift/openshift-docs/downloads","issues_url":"https://api.github.com/repos/openshift/openshift-docs/issues{/number}","pulls_url":"https://api.github.com/repos/openshift/openshift-docs/pulls{/number}","milestones_url":"https://api.github.com/repos/openshift/openshift-docs/milestones{/number}","notifications_url":"https://api.github.com/repos/openshift/openshift-docs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/openshift/openshift-docs/labels{/name}","releases_url":"https://api.github.com/repos/openshift/openshift-docs/releases{/id}","created_at":"2014-07-11T15:14:42Z","updated_at":"2015-05-07T18:26:07Z","pushed_at":"2015-05-08T17:47:22Z","git_url":"git://github.com/openshift/openshift-docs.git","ssh_url":"git@github.com:openshift/openshift-docs.git","clone_url":"https://github.com/openshift/openshift-docs.git","svn_url":"https://github.com/openshift/openshift-docs","homepage":null,"size":6911,"stargazers_count":14,"watchers_count":14,"language":"CSS","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":63,"mirror_url":null,"open_issues_count":21,"forks":63,"open_issues":21,"watchers":14,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/openshift/openshift-docs/pulls/341"},"html":{"href":"https://github.com/openshift/openshift-docs/pull/341"},"issue":{"href":"https://api.github.com/repos/openshift/openshift-docs/issues/341"},"comments":{"href":"https://api.github.com/repos/openshift/openshift-docs/issues/341/comments"},"review_comments":{"href":"https://api.github.com/repos/openshift/openshift-docs/pulls/341/comments"},"review_comment":{"href":"https://api.github.com/repos/openshift/openshift-docs/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/openshift/openshift-docs/pulls/341/commits"},"statuses":{"href":"https://api.github.com/repos/openshift/openshift-docs/statuses/fbfbbe7b684c6ba495e51377e231de21de82c798"}}}}