...
New API's
CloudStack currently has a domain-tree based implementation of access checks, namely com.cloud.acl.DomainChecker. This implementation is based on an adapter interface of Cloudstack - org.apache.cloudstack.acl.SecurityChecker that defines the basic ACL IAM interface to check ownership and access control to objects within the account/ domain.
...
Code Block |
---|
/** * QuerySelector returns granted domain, or account or resources for caller. */ public interface QuerySelector extends Adapter { ... /** * List granted domains for the caller, given a specific entity type. * * @param caller account to check against. * @param entityType entity type * @return list of domain Ids granted to the caller account. */ List<Long> getAuthorizedDomains(Account caller, String entityType); /** * List granted accounts for the caller, given a specific entity type. * * @param caller account to check against. * @param entityType entity type * @return list of domain Ids granted to the caller account. */ List<Long> getAuthorizedAccounts(Account caller, String entityType); /** * List granted resources for the caller, given a specific entity type. * * @param caller account to check against. * @param entityType entity type * @return list of domain Ids granted to the caller account. */ List<Long> getAuthorizedResources(Account caller, String entityType); /** * Check if this account is associated with a policy with scope of ALL * @param caller account to check * @param action action. * @return true if this account is attached with a policy for the given action of ALL scope. */ boolean isGrantedAll(Account caller, String action); /** * List of ACLIAM group the given account belongs to * @param accountId account id. * @return ACLIAM group names */ List<String> listAclGroupsByAccountlistIAMGroupsByAccount(long accountId); |
By invoking these QuerySelector APIs, CloudStack API engine can pre-construct proper SQL where clause to achieve proper row filter for accessibility control.
...
...
Currently CloudStack provides different response views for Root admin and non-root user, some response fields are only visible to root admin. Basically we have provided two static response views (Full view and Restricted view), domain admin will also a User view. With new IAM service introduced, we should also allow customers to be able to specify what view should be applied to the new Acl IAM group when they are creating a new customized Acl IAM group, for example, customer care group. To achieve that, we will implement as follows:
We will separate all current both admin and user allowed API commands to two classes: API for admin and API for user. For example, previous ListVMsCmd will be splitted into two classes: ListVMsCmdByAdmin and ListVMsCmd.
Code Block |
---|
@APICommand(name = "listVirtualMachines", description = "List the virtual machines owned by the account.", responseObject = UserVmResponse.class, responseView = ResponseView.Restricted) public class ListVMsCmd extends BaseListTaggedResourcesCmd { ...... } @APICommand(name = "listVirtualMachines", description = "List the virtual machines owned by the account.", responseObject = UserVmResponse.class, responseView = ResponseView.Full) public class ListVMsCmdByAdmin extends ListVMsCmd { ///////////////////////////////////////////////////// //////////////// API parameters ///////////////////// ///////////////////////////////////////////////////// @Parameter(name=ApiConstants.HOST_ID, type=CommandType.UUID, entityType=HostResponse.class, description="the host ID") private Long hostId; @Parameter(name=ApiConstants.POD_ID, type=CommandType.UUID, entityType=PodResponse.class, description="the pod ID") private Long podId; @Parameter(name=ApiConstants.STORAGE_ID, type=CommandType.UUID, entityType=StoragePoolResponse.class, description="the storage ID where vm's volumes belong to") private Long storageId; } |
Note that ListVMsCmdByAdmin and ListVMsCmd are sharing the same API name "listVirtualMachines". From client perspective, this is transparent to them, CloudStack API client will still just invoke previous listVirtualMachine API, and CloudStack API server will internally consult with IAM plugin to determine the group associated with the invoking user and then determine which internal Cmd class to be invoked. There is a new attribute "responseView" introduced for @APICommand annoation, which can be used to instruct CloudStack to generate different response view. By separating the command class into admin cmd class and user cmd class, we can also restrict valid input parameters for different account. For example, in this case, when Admin invokes listVirtualMachine api, he/she can pass hostId, podId and storageId, which parameters are not applicable for end user.
...
When user creates a customized policy, he can specify a source policy from list of default policies. Then we will create new mapping between these default policy permission entries and the new policy in acliam_policy_permission_map table.
...
id | account_name | uuid | domain_id |
---|---|---|---|
2 | admin | 1c5afd64-482b-11e3-86f3-8118f47f9f9f | 1 |
3 | domainAdmin | 929d172c-b95e-4b86-9474-9789072c9bdb | 2 |
4 | domainUserA | f96ddb47-d3c0-4360-a9cd-613d631c8333 | 2 |
acliam_group
id | name | description | uuid | path | removed | created |
---|---|---|---|---|---|---|
1 | REGULAR_USER | Domain user group | d283d4f0-31f0-11e3-ad37-80f85ce25918 | / | NULL | 2013-10-10 14:13:34 |
2 | ADMIN | Root admin group | d283de28-31f0-11e3-ad37-80f85ce25918 | / | NULL | 2013-10-10 14:13:34 |
3 | DOMAIN_ADMIN | Domain admin group | d283e6e8-31f0-11e3-ad37-80f85ce25918 | / | NULL | 2013-10-10 14:13:34 |
acliam_group_account_map
id | group_id | account_id | removed | created |
---|---|---|---|---|
2 | 2 | 2 | NULL | 2013-10-10 14:13:34 |
3 | 3 | 3 | NULL | 2013-10-11 00:14:54 |
4 | 1 | 4 | NULL | 2013-10-11 00:19:55 |
acliam_policy
id | name | description | uuid | path | removed | created | policy_type |
---|---|---|---|---|---|---|---|
1 | REGULAR_USER | Domain user role | d2838dce-31f0-11e3-ad37-80f85ce25918 | / | NULL | 2013-10-10 14:13:34 | Static |
2 | ADMIN | Root admin role | d2839c56-31f0-11e3-ad37-80f85ce25918 | / | NULL | 2013-10-10 14:13:34 | Static |
3 | DOMAIN_ADMIN | Domain admin role | d283a7f0-31f0-11e3-ad37-80f85ce25918 | / | NULL | 2013-10-10 14:13:34 | Static |
6 | RESOURCE_OWNER | Resource owner role | d283c794-31f0-11e3-ad37-80f85ce25918 | / | NULL | 2013-10-10 14:13:34 | Dynamic |
acliam_group_policy_map
id | group_id | policy_id | removed | created |
---|---|---|---|---|
1 | 1 | 1 | NULL | 2013-10-10 14:13:34 |
2 | 2 | 2 | NULL | 2013-10-10 14:13:34 |
3 | 3 | 3 | NULL | 2013-10-10 14:13:34 |
acliam_permission
id | action | resource_type | scope_id | scope | access_type | permission | removed | created |
---|---|---|---|---|---|---|---|---|
1 | startVirtualMachine | VirtualMachine | NULL | ALL | NULL | Allow | NULL | 2013-10-10 14:13:34 |
2 | startVirtualMachine | VirtualMachine | $domainId | Domain | NULL | Allow | NULL | 2013-10-10 14:13:34 |
3 | startVirtualMachine | VirtualMachine | $accountId | Account | NULL | Allow | NULL | 2013-10-10 14:13:34 |
acliam_policy_permission_map
id | policy_id | permission_id | removed | created |
---|---|---|---|---|
1 | 6 | 3 | NULL | 2013-10-10 14:13:34 |
2 | 2 | 1 | NULL | 2013-10-10 14:13:34 |
3 | 3 | 2 | NULL | 2013-10-10 14:13:34 |
...
...
A Domain admin wants to create a 'Service Desk' group for his domain and allow 'ready only' access to the group for all VMs and Volumes within the Domain.
Steps:
...