Unified model for delegations
Both assignments and trusts serve the single purpose: delegate roles on the resource to the actor.
Resource may be either project or domain, actor is a user or a group.
This blueprint proposes a new delegation model containing following information:
- trustee (user or gtoup)
- roles to be delegated
- resource (domain or project)
- usage restrictions
- source of delegation - actor, who delegates the scope
Delegation must allow to track the responsibility chain so that any delegation is always granted by some actor to another. To allow this keystone must maintain chain consistency: it must handle the cases where the chain is broken or changed.
Delegation must have an option to restrict it's usage so that it can be used for defined workflow and nothing more.
Blueprint information
- Status:
- Complete
- Approver:
- None
- Priority:
- Low
- Drafter:
- Alexander Makarov
- Direction:
- Approved
- Assignee:
- Alexander Makarov
- Definition:
- Superseded
- Series goal:
- None
- Implementation:
-
Started
- Milestone target:
- None
- Started by
- Steve Martinelli
- Completed by
- Lance Bragstad
Related branches
Related bugs
Sprints
Whiteboard
Gerrit topic: https:/
Addressed by: https:/
Unified delegation spec
Addressed by: https:/
Unified delegation model
Addressed by: https:/
Unified delegation driver
Addressed by: https:/
Unified delegation migration
Addressed by: https:/
SQLAlchemy column type for materialized path
Addressed by: https:/
Use path hybrid property in query filtering
Addressed by: https:/
Materialized path convenience wrapper
Addressed by: https:/
Unified delegation manager skeleton
Addressed by: https:/
Trust manager using unified delegation
Addressed by: https:/
Assignment manager using unified delegation
Addressed by: https:/
Unified delegation SQL driver
Addressed by: https:/
Unified delegation assignment driver
Addressed by: https:/
WIP/DNM Unified delegation trust driver
Addressed by: https:/
Delegation parent discovery function
Addressed by: https:/
OAuth1 driver for unified delegation
Addressed by: https:/
Cross API unified delegation test
(lbragstad) 19-02-15: I'm marking this as superseded based on the plan socialized on the mailing list [0]. All relevant content from this blueprint has been ported to an RFE bug report [1].
[0] http://
[1] https:/
Work Items
Work items:
Specification: DONE
Unified delegation model for SQL backend: INPROGRESS
Unified driver base: INPROGRESS
Substitute the driver for assignment: INPROGRESS
Substitute the driver for trust: INPROGRESS
Substitute manager and driver for oauth1: TODO
Unified API: TODO
Unified Manager: TODO
Migration script: TODO
Dependency tree
* Blueprints in grey have been implemented.
