Project

Profile

Help

Story #8940

Add RBAC content guard to pulpcore

Added by gerrod 4 months ago. Updated about 2 months ago.

Status:
CLOSED - CURRENTRELEASE
Priority:
Normal
Assignee:
Category:
-
Sprint/Milestone:
Start date:
Due date:
% Done:

100%

Estimated time:
Platform Release:
Groomed:
No
Sprint Candidate:
No
Tags:
Sprint:
Quarter:

Description

Background

Content guards are added to distributions and are used to protect who can download (and view) content available in that distribution from the content app. Users create content guard instances with specific settings for each distribution they want to protect. RBAC in Pulp is provided by Django and DRF and currently has no relation to content guards, so users can protect who can manage content in Pulp using RBAC, but not who can download it. There is a need for an RBAC enabled content guard that protects content based on RBAC permissions.

Implementation

Add a new RBAC content guard that would ship by default in pulpcore. The access policy for these content guard instances should be customizable by the user and if not set should default to the policy used by the distribution. Some requests go through a plugin's extended REST API first and then redirect to the content app, so an option to authorized requests based on redirection origin should be added to the content guard.


Related issues

Related to Pulp - Story #8951: Add authentication to content appCLOSED - CURRENTRELEASE

<a title="Actions" class="icon-only icon-actions js-contextmenu" href="#">Actions</a>

Associated revisions

Revision 19234ff6 View on GitHub
Added by gerrod about 2 months ago

Add RBAC content guard

fixes: #8940

History

#1 Updated by bmbouter 4 months ago

AccessPolicies are global, but allow for object level permissions to be checked. So what if the permission was named can_download or dowload and it had object-level permissions relating an instance of a distribution with a ContentGuard? Or maybe it should be on the content guard itself ..... ?

#2 Updated by daviddavis 4 months ago

  • Sprint/Milestone set to 3.15.0

#3 Updated by gerrod 4 months ago

Talking it over with bmbouter, I think the best implementation would be to add a new permission called can_download to the RBAC content guard that will determine if a user can download content from a distribution. When creating an RBAC content guard you would specify the users and groups to receive the can_download permission for that instance of the guard. Then that content guard can be added to any distribution where you want those set of users to be able to download from.

The RBAC content guard would preform authentication and authorization for requests to the content app. It would create a 'fake' DRF view that would convert the aiohttp request to a django request and use the view's authentication and authorization methods defined by DRF settings. Example from container plugin (https://github.com/pulp/pulp_container/blob/master/pulp_container/app/authorization.py#L158) The authentication check will go through each authentication class one by one till the user is found. Then authorization will do a permission check on the user to see if they have the can_download permission for that content guard.

Additional fields that could be added to content guard:

#4 Updated by gerrod 4 months ago

  • Related to Story #8951: Add authentication to content app added

#5 Updated by gerrod 4 months ago

With #8951 this content-guard should only do the permission check and use the authentication coming from the middleware.

#6 Updated by gerrod 3 months ago

  • Status changed from NEW to ASSIGNED

#7 Updated by pulpbot 3 months ago

  • Status changed from ASSIGNED to POST

#8 Updated by gerrod about 2 months ago

  • Status changed from POST to MODIFIED
  • % Done changed from 0 to 100

#9 Updated by pulpbot about 2 months ago

  • Status changed from MODIFIED to CLOSED - CURRENTRELEASE

Please register to edit this issue

Also available in: Atom PDF