<div dir="ltr"><div class="gmail_default" style="font-family:georgia,serif">you can also talk to jeff cantrill who implemented the flow for the eclipse tooling.<br><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 15, 2016 at 11:29 AM, Ricardo Martinelli de Oliveira <span dir="ltr"><<a href="mailto:rmartine@redhat.com" target="_blank">rmartine@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>Ben,<br><br></div>Yes, sorry for not mentioned that we already discussed this. To be honest, only step 2 was unclear to me and still is. <br><br></div>I'll take a look again at the Fabric8 code to see how they are handling this and I'll send a reply to confirm if that helped or not.<br><br><br></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 15, 2016 at 12:23 PM, Ben Parees <span dir="ltr"><<a href="mailto:bparees@redhat.com" target="_blank">bparees@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_default" style="font-family:georgia,serif"><br></div><div class="gmail_extra"><br><div class="gmail_quote"><span>On Fri, Apr 15, 2016 at 10:41 AM, Ricardo Martinelli de Oliveira <span dir="ltr"><<a href="mailto:rmartine@redhat.com" target="_blank">rmartine@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>David,<br><br></div>For Project request workflow I see no problems with it, but for application creation (either from the s2i images and templates) is the main concern from my viewpoint since the templates are in openshift project. I tried to develop the app creation part and I had some problems with template processing because hitting the template endpoint causes Permission issues.<br><br></div>Could you please explains how to do that?<br></div></blockquote></span><div><br><div class="gmail_default" style="font-family:georgia,serif">I thought we discussed this on IRC, so i'm not sure what issue you're having?<br><br></div><div class="gmail_default" style="font-family:georgia,serif">Your client needs to:<br></div><div class="gmail_default" style="font-family:georgia,serif">1) retrieve the template object from the openshift namespace (Everyone has view access, not a problem)<br></div><div class="gmail_default" style="font-family:georgia,serif">2) post the template (with parameter values if supplied by the user) to the processedTemplates endpoint in the user's namespace<br></div><div class="gmail_default" style="font-family:georgia,serif">3) you'll get back a processed template which is basically a list of api objects<br></div><div class="gmail_default" style="font-family:georgia,serif">4) your client needs to iteratively make a create api call on each api object.<br><br></div><div class="gmail_default" style="font-family:georgia,serif">we've implemented this flow 2-3 times (CLI, web console, eclipse tooling, maybe fabric too), so there ought to be somewhere you can borrow it from. <br></div><br> </div><div><div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 15, 2016 at 9:01 AM, David Eads <span dir="ltr"><<a href="mailto:deads@redhat.com" target="_blank">deads@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">We currently have an endpoint where a user can request a project: <a href="https://docs.openshift.org/latest/admin_guide/managing_projects.html#selfprovisioning-projects" target="_blank">https://docs.openshift.org/latest/admin_guide/managing_projects.html#selfprovisioning-projects</a>. It works by using this endpoint: <a href="https://docs.openshift.org/latest/rest_api/openshift_v1.html#create-a-projectrequest" target="_blank">https://docs.openshift.org/latest/rest_api/openshift_v1.html#create-a-projectrequest</a>. If you have access (on by default), then the user is escalated and a project is created on their behalf by the system. The shape of the project is determined by the cluster-admin through the use of a template. If you try the client-side command with `--loglevel=8`, you can see the details of the request.<div><br></div><div>I think that flow is what your issue is talking about. However, if you're interested in general impersonation there is a pull (<a href="https://github.com/openshift/origin/pull/8006" target="_blank">https://github.com/openshift/origin/pull/8006</a>) that adds a `Impersonate-User` header for requests. If that header is set to "bob", then the authenticated users is checked to see if they have rights to "impersonate" the "users" named "bob". If they are allowed, then the user context of the request is changed to "bob" and the request is checked. That gives perfect impersonation for the API server, but I think its unlikely that the users you're impersonating will be allowed to create projects directly.</div></div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Apr 14, 2016 at 8:36 PM, Andrew Lee Rubinger <span dir="ltr"><<a href="mailto:alr@redhat.com" target="_blank">alr@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Thanks!<div><br></div><div>David, would you mind advising how we might go about handling $subject?</div><div><br>S,</div><div>ALR</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Apr 14, 2016 at 8:24 PM, Ben Parees <span dir="ltr"><<a href="mailto:bparees@redhat.com" target="_blank">bparees@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">Might be better to ask on the openshift dev list, but i'm told David Eads is working on this so you could ping him directly as well. <br></p>
<p dir="ltr">Ben Parees | OpenShift</p>
<div class="gmail_quote"><div><div>On Apr 14, 2016 20:11, "Andrew Lee Rubinger" <<a href="mailto:alr@redhat.com" target="_blank">alr@redhat.com</a>> wrote:<br type="attribution"></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><div dir="ltr">So the Catapult project will be creating OpenShift projects for its users.<div><br></div><div>At the moment we're doing this by logging in *as* the user, but really what we want to do is create projects *on behalf of* users.</div><div><br></div><div>Clayton advises that we're unlikely to be granted cluster-admin rights to OpenShift Online (or even in some dedicated instance we run), so perhaps we need some other role that has permissions to create projects and a rolebinding to the user in question.</div><div><br></div><div>Associated Catapult issue is:</div><div><br></div><div> <a href="https://github.com/redhat-kontinuity/catapult/issues/18" target="_blank">https://github.com/redhat-kontinuity/catapult/issues/18</a></div><div><br></div><div>Thoughts from the OpenShift team?</div><div><br></div><div>S,</div><div>ALR</div></div>
<br></div></div>_______________________________________________<br>
kontinuity-dev-public mailing list<br>
<a href="mailto:kontinuity-dev-public@redhat.com" target="_blank">kontinuity-dev-public@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/kontinuity-dev-public" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/kontinuity-dev-public</a><br>
<br></blockquote></div>
</blockquote></div><br></div>
</blockquote></div><br></div>
</div></div><br>_______________________________________________<br>
kontinuity-dev-public mailing list<br>
<a href="mailto:kontinuity-dev-public@redhat.com" target="_blank">kontinuity-dev-public@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/kontinuity-dev-public" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/kontinuity-dev-public</a><br>
<br></blockquote></div><br></div>
</div></div><br>_______________________________________________<br>
kontinuity-dev-public mailing list<br>
<a href="mailto:kontinuity-dev-public@redhat.com" target="_blank">kontinuity-dev-public@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/kontinuity-dev-public" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/kontinuity-dev-public</a><br>
<br></blockquote></div></div></div><span><font color="#888888"><br><br clear="all"><br>-- <br><div><div dir="ltr">Ben Parees | OpenShift<br><br></div></div>
</font></span></div></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div dir="ltr">Ben Parees | OpenShift<br><br></div></div>
</div>