Matthew Edmonds and Lance Bragstad discuss the advantages and disadvantages of implementing custom Role Based Access Control in OpenStack today. This presentation also includes plans for improving RBAC experience in OpenStack.

1. Matthew Edmonds (edmondsw)
Lance Bragstad (lbragstad)
Custom RBAC
Can I do that?

2. What is RBAC?
How does OpenStack implement RBAC?
Customizing RBAC in your deployment
The future of access control

3. What is RBAC?
How does OpenStack implement RBAC?
Customizing RBAC in your deployment
The future of access control

4. RBAC is a method of regulating access to an object
based on the roles of individual users

5. What is RBAC?
Permissions are attached to predefined roles
Roles are assigned to users or groups
Roles are evaluated with request context

6. What is RBAC?
Permissions are attached to predefined roles
Roles are assigned to users or groups
Roles are evaluated with request context

7. What is RBAC?
Permissions are attached to predefined roles
Roles are assigned to users or groups
Roles are evaluated with request context

8. What is RBAC?
How does OpenStack implement RBAC?
Customizing RBAC in your deployment
The future of access control

9. How does OpenStack implement RBAC?
Attaching permissions to roles
Assigning roles to users
Evaluating requests

10. openstack role create manager

11. "identity:create_service": "role:manager"

12. policy.DocumentedRuleDefault(
name='identity:create_service',
check_str='role:manager',
description='Create service',
operations=[{'method': 'POST','path': '/v3/services'}]
)

13. How does OpenStack implement RBAC?
Attaching permissions to roles
Assigning roles to users
Evaluating requests

14. openstack role add
--project development
--user alice
manager

15. How does OpenStack implement RBAC?
Attaching permissions to roles
Assigning roles to users
Evaluating requests

16. What is RBAC?
How does OpenStack implement RBAC?
Customizing RBAC in your deployment
The future of access control

17. Customizing RBAC in your deployment
Finding policy settings
Policy syntax
Choosing which role to customize
Selecting which policy to customize

18. Usually in /etc/<service>/policy.json
Could be a yaml file
CONF.oslo_policy.policy_file
CONF.oslo_policy.policy_dirs

19. oslopolicy-sample-generator
--namespace <service>
--output-file policy-sample.yaml
oslopolicy-policy-generator
--namespace <service>
--output-file policy-merged.yaml

20. Customizing RBAC in your deployment
Finding policy settings
Policy syntax
Choosing which role to customize
Selecting which policy to customize

21. "!" # none
"@" # any
"" # any
"<context_attr>:<target_attr>" # match

22. "(...)" # grouping
"not ..." # logical NOT
"... and ..." # logical AND
"... or ..." # logical OR

23. Customizing RBAC in your deployment
Finding policy settings
Policy syntax
Choosing which role to customize
Selecting which policy to customize

24. admin # everywhere

25. admin # everywhere
Issues:
1. Hardcoded admin checks
2. Can operate outside assigned scope

26. _member_ # keystone
Member # horizon

27. _member_ # keystone
Member # horizon
Issues:
1. Implemented as a catch-all

28. service # keystone
ResellerAdmin # swift

29. service # keystone
ResellerAdmin # swift
Issues:
1. Qualify as “member”
2. ResellerAdmin permissions are hardcoded

30. <your_thing> # do whatcha wanna do

31. <your_thing> # do whatcha wanna do
Issues:
1. Qualify as “member”
2. Hardcoded admin checks

32. Customizing RBAC in your deployment
Finding policy settings
Policy syntax
Choosing which role to customize
Selecting which policy to customize

33. Read the description (if available)
Check the code
Take a guess

34. Multiple APIs can be protected with one policy
One API can be protected with multiple policies
One API can call another API

35. PUT /v3/roles/{prior_role_id}/implies/{implies_role_id}

36. What is RBAC?
How does OpenStack implement RBAC?
Customizing RBAC in your deployment
The future of access control

37. Registering defaults
Documenting policies
Deprecating policies
Granular and consistent policy names
Implementing system-scoped tokens
Associating scope to policies
Service tokens
Defining default roles

38. Community goals
Project tags

39. Who benefits from all this?

41. https://goo.gl/B2QpYf
https://goo.gl/dkV8Pn