5984e34862
Adding file based RBAC engine for Horizon using copies of nova and keystone policy.json files Policy engine builds on top of oslo incubator policy.py, fileutils was also pulled from oslo incubator as a dependency of policy.py When Horizon runs and a policy check is made, a path and mapping of services to policy files is used to load the rules into the policy engine. Each check is mapped to a service type and validated. This extra level of mapping is required because the policy.json files may each contain a 'default' rule or unqualified (no service name include) rule. Additionally, maintaining separate policy.json files per service will allow easier syncing with the service projects. The engine allows for compound 'and' checks at this time. E.g., the way the Create User action is written, multiple APIs are called to read data (roles, projects) and more are required to update data (grants, user). Other workflows e.g., Edit Project, should have separate save actions per step as they are unrelated. Only the applicable policy checks to that step were added. The separating unrelated steps saves will should be future work. The underlying engine supports more rule types that are used in the underlying policy.json files. Policy checks were added for all actions on tables in the Identity Panel only. And the service policy files imported are limited in this commit to reduce scope of the change. Additionally, changes were made to the base action class to add support or setting policy rules and an overridable method for determining the policy check target. This reduces the need for redundant code in each action policy check. Note, the benefit Horizon has is that the underlying APIs will correct us if we get it wrong, so if a policy file is not found for a particular service, permission is assumed and the actual API call to the service will fail if the action isn't authorized for that user. Finally, adding documentation regarding policy enforcement. Implements: blueprint rbac Change-Id: I4a4a71163186b973229a0461b165c16936bc10e5
131 lines
4.2 KiB
Python
131 lines
4.2 KiB
Python
import logging
|
|
|
|
from django.core.urlresolvers import reverse # noqa
|
|
from django.utils.http import urlencode # noqa
|
|
from django.utils.translation import ugettext_lazy as _ # noqa
|
|
|
|
from horizon import tables
|
|
|
|
from openstack_dashboard import api
|
|
from openstack_dashboard.api import keystone
|
|
|
|
LOG = logging.getLogger(__name__)
|
|
|
|
|
|
class ViewMembersLink(tables.LinkAction):
|
|
name = "users"
|
|
verbose_name = _("Modify Users")
|
|
url = "horizon:admin:projects:update"
|
|
classes = ("ajax-modal", "btn-edit")
|
|
policy_rules = (("identity", "identity:list_users"),
|
|
("identity", "identity:list_roles"))
|
|
|
|
def get_link_url(self, project):
|
|
step = 'update_members'
|
|
base_url = reverse(self.url, args=[project.id])
|
|
param = urlencode({"step": step})
|
|
return "?".join([base_url, param])
|
|
|
|
|
|
class ViewGroupsLink(tables.LinkAction):
|
|
name = "groups"
|
|
verbose_name = _("Modify Groups")
|
|
url = "horizon:admin:projects:update"
|
|
classes = ("ajax-modal", "btn-edit")
|
|
|
|
def allowed(self, request, project):
|
|
return keystone.VERSIONS.active >= 3
|
|
|
|
def get_link_url(self, project):
|
|
step = 'update_group_members'
|
|
base_url = reverse(self.url, args=[project.id])
|
|
param = urlencode({"step": step})
|
|
return "?".join([base_url, param])
|
|
|
|
|
|
class UsageLink(tables.LinkAction):
|
|
name = "usage"
|
|
verbose_name = _("View Usage")
|
|
url = "horizon:admin:projects:usage"
|
|
classes = ("btn-stats",)
|
|
policy_rules = (("compute", "compute_extension:simple_tenant_usage:show"),)
|
|
|
|
|
|
class CreateProject(tables.LinkAction):
|
|
name = "create"
|
|
verbose_name = _("Create Project")
|
|
url = "horizon:admin:projects:create"
|
|
classes = ("btn-launch", "ajax-modal",)
|
|
policy_rules = (('identity', 'identity:create_project'),)
|
|
|
|
def allowed(self, request, project):
|
|
return api.keystone.keystone_can_edit_project()
|
|
|
|
|
|
class UpdateProject(tables.LinkAction):
|
|
name = "update"
|
|
verbose_name = _("Edit Project")
|
|
url = "horizon:admin:projects:update"
|
|
classes = ("ajax-modal", "btn-edit")
|
|
policy_rules = (('identity', 'identity:update_project'),)
|
|
|
|
def allowed(self, request, project):
|
|
return api.keystone.keystone_can_edit_project()
|
|
|
|
|
|
class ModifyQuotas(tables.LinkAction):
|
|
name = "quotas"
|
|
verbose_name = "Modify Quotas"
|
|
url = "horizon:admin:projects:update"
|
|
classes = ("ajax-modal", "btn-edit")
|
|
policy_rules = (('compute', "compute_extension:quotas:update"),)
|
|
|
|
def get_link_url(self, project):
|
|
step = 'update_quotas'
|
|
base_url = reverse(self.url, args=[project.id])
|
|
param = urlencode({"step": step})
|
|
return "?".join([base_url, param])
|
|
|
|
|
|
class DeleteTenantsAction(tables.DeleteAction):
|
|
data_type_singular = _("Project")
|
|
data_type_plural = _("Projects")
|
|
policy_rules = (("identity", "identity:delete_project"),)
|
|
|
|
def allowed(self, request, project):
|
|
return api.keystone.keystone_can_edit_project()
|
|
|
|
def delete(self, request, obj_id):
|
|
api.keystone.tenant_delete(request, obj_id)
|
|
|
|
|
|
class TenantFilterAction(tables.FilterAction):
|
|
def filter(self, table, tenants, filter_string):
|
|
""" Really naive case-insensitive search. """
|
|
# FIXME(gabriel): This should be smarter. Written for demo purposes.
|
|
q = filter_string.lower()
|
|
|
|
def comp(tenant):
|
|
if q in tenant.name.lower():
|
|
return True
|
|
return False
|
|
|
|
return filter(comp, tenants)
|
|
|
|
|
|
class TenantsTable(tables.DataTable):
|
|
name = tables.Column('name', verbose_name=_('Name'))
|
|
description = tables.Column(lambda obj: getattr(obj, 'description', None),
|
|
verbose_name=_('Description'))
|
|
id = tables.Column('id', verbose_name=_('Project ID'))
|
|
enabled = tables.Column('enabled', verbose_name=_('Enabled'), status=True)
|
|
|
|
class Meta:
|
|
name = "tenants"
|
|
verbose_name = _("Projects")
|
|
row_actions = (ViewMembersLink, ViewGroupsLink, UpdateProject,
|
|
UsageLink, ModifyQuotas, DeleteTenantsAction)
|
|
table_actions = (TenantFilterAction, CreateProject,
|
|
DeleteTenantsAction)
|
|
pagination_param = "tenant_marker"
|