...
Code Block |
---|
/** * SecurityChecker checks the ownership and access control to objects within */ public interface SecurityChecker extends Adapter { ... /** * Checks if the account can access the object. * * @param caller * account to check against. * @param entity * object that the account is trying to access. * @param accessType * * @param action * * @return true if access allowed. false if this adapter cannot provide permission. * @throws PermissionDeniedException * if this adapter is suppose to authenticate ownership and the check failed. */ boolean checkAccess(Account caller, ControlledEntity entity, AccessType accessType, String action) throws PermissionDeniedException; .... } /** * Enumeration type for AccessType */ public enum AccessType { ModifyProject, OperateEntry, UseEntry } |
Example: A domainAdmin registers a template T and allows a regular user of the domain to launch a VM using that template.
Entity: TemplateT
Principal1: domainAdmin, Access allowed: OperateEntry (operate access since he can invoke delete/updatepermissions operations on the template)
Principal2: normal domain user, Access allowed: UseEntry (the user can only list the template and use it for launching VM)
The IAM implementation will check if a given user is permitted to invoke the given 'action' / 'accesstype' on the given resource by looking at the account's groups and the associated policies of those groups.
In phase I, all the permissions attached to any policy are by default explicit 'Allow' permissions. As of now 'Deny' permissions cannot be added.
Thus For given user, resource and given api name/accessType, default permission is 'deny', then run through this:
...
...