[libvirt-users] Libvirt access control drivers

[Daniel P. Berrangé]

On Fri, May 11, 2018 at 04:26:36PM +0300, Anastasiya Ruzhanskaya wrote:
> Excuse me for renewing this discussion, but I am curious if you would add
> new module, which will be able to process users not based on unix
> processes, from where do you plan to get usernames? I mean, virt-manager
> could give them, as there is authentication in GUI, but for example when
> using oVirt, none of the usernames reach libvirt through the communication
> between server and nodes.

The identity attributes would have to use information that libvirt acquires
from its authentication modules.  When using TLS, if client certificates are
requested by libvirtd, then we can check the x509 cert distinguished name
field.  When using SASL,  if the SASL mechanism returns a username, we can
check that.

NB, we would *not* be trying to check the end user that oVirt knows about,
rather we are authenticating oVirt itself.

To check end users defined by the higher level mgmt app would require an
extra set of functionality in the public API, to allow oVirt to do user
impersonation with libvirt.  eg libvirt would first authenticate ovirt,
ovirt would then sya it wants to impersonate "fred" and from there all
APIs get checked against "fred".

This gets pretty difficult though, because oVirt and most similar mgmt
apps generally only have a single connection to libvirt but are doing
work for 100's of different users on it. So in reality it is not very
practical for libvirt to try to validate ovirt's users.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|