RBAC Roles in Galaxy NG

Requirements

  • Access policies cannot be user editable.
    • Allowing users to customize the access policies is a support nightmare because:
      • there's a risk updating access policies will break the app accidentally
      • there's no way for us to provide updates for access policies that have been modified by a customer
      • access policies require fairly in depth knowledge of the app to safely update
  • Need to be able to easily define our own DEFAULT_PERMISSION_CLASSES, while still being able to take advantage of the pulp systems
  • Need to be able to create custom DRF Access Policy conditions for other pulp plugin viewsets
    • for example, we need to provide a condition for the collection upload view that checks that the user has permissions to upload to a namespace, not that the user has permissions to create collections, which may be different from how pulp_ansible wishes to check conditions
    • custom conditions will be used to check map permissions coming from other RBAC systems

Implementation plan

In an ideal world we would be able to define our own DEFAULT_PERMISSION_CLASSES, which would load a custom access policy like this:







class GalaxyAccessPolicyBase(AccessPolicyFromDB):
    def get_policy_statements(self, view):
        viewset_name = get_view_urlpattern(view)
        if viewset_name in CUSTOM_STATEMENTS:
            return CUSTOM_STATEMENTS[viewset_name]
        return view.DEFAULT_ACCESS_POLICY

This would allow us to define override access policies for other viewsets without messy database migrations, create customized condition_functions and take advantage of the default pulp access policies.

This comes with some challenges because it breaks creation_hooks, which we don't currently use (but might start using in the future) and default role definitions.

Required Changes to Pulp

  • Must have
    • Separate role definition API from Access Policy API
  • Nice to have
    • Update AutoAddObjMixin to use the DEFAULT_PERMISSION_CLASSES to load access policies for permission assignment
Select a repo