[et-mgmt-tools] How-to: write custom authorization code

[Michael DeHaan]

Joseph Boyer Jr. wrote:
>
> I would like to write an update to the authorization code where a user 
> only has access to add a system and run cobbler sync via the webGUI.
>

That should be doable.   The rest of the links in the WebUI (presently) 
would be still visible but would generate "access denied" messages when 
clicked upon.   In other words, you can still read the other data, but 
in most places you get a warning that you can't edit them and the button 
to save is missing.   This should be ok.   

(In the future, I want to create a simple page that allows the user only 
access to do certain things, and to present them less fields.    Details 
TBD and I'll ask the list as that is getting fleshed out -- I'm various 
non-web RFEs first.)


>  
>
> I have a requirement where distros, repos, and profiles are created 
> and maintained by engineering (full access) and support (read/write to 
> systems, read-only everything else) will be performing install.
>
>  
>
> Any pointers where to start would be most appreciated.
>
This shouldn't be too hard.

modules/authz_ownership.py is a system that denies operations based on 
the username of the user and whether he is or is not in certain "groups" 
or is otherwise explicitly listed anywhere you see --owner in the 
command line or Web app.   you want to create a new module 
"authz_mypolicy.py" based on this, but modify the "authorize()" function 
to do your bidding.

You can see it returns 1 (let me in) or 0 (don't let me in) in certain 
cases.

You want to modify this, and check to see if they are in the admin group 
to allow everything (return 1), and if they are a user, only permit
certain resources such as "new_system", and "sync".   You will see the 
admin logic is already there, so in that case you don't have too much to 
change.  

Basically instead of checking for the ownership on the object if the 
user is not an admin, you want to skip that check and then make 
additional checks on the name of the operation they want to perform -- 
"new_system", "save_system", "sync", etc

The exact names of all the methods gating access are listed in remote.py

This is all done at the authorization layer, your authentication layer 
is seperate from this and does not need to be modified.

Once you have the authz_mypolicy.py installed in 
/usr/lib/python2.X/site-packages/cobbler/modules, you just need to 
change the authz option in /etc/cobbler/modules.conf to point to your 
new policy.

Let me know if I can be of any further help and if the above makes sense.  

You probably want to join #cobbler for development discussions if you 
haven't already.

--Michael
>
>  
>
> Thanks!
>
> joe
>
>  
>
> *Joseph Boyer Jr*
> *Enterprise Technology Services** **
> **Liquidnet Holdings, Inc.*
> *_Joseph.Boyer_**@liquidnet.com <mailto:aengelhardtsen at liquidnet.com>*
> *T**  * +1 646.660.8352
> *C **  *+1 646.284.8394
>
>  
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> et-mgmt-tools mailing list
> et-mgmt-tools at redhat.com
> https://www.redhat.com/mailman/listinfo/et-mgmt-tools