[[chef-dev]] ACL/permission support in chef-server

[Tollef Fog Heen < >]

Hi all,

I'm looking at implementing permission support in chef-server and would
like to run the design by the list.

While I'd like to have something that works the same way as the opscode
API, that API isn't public and as far as I can see, there's no way to
edit permissions except through the web UI, so my concern isn't that
deep.  That said, I think it's important the permission models match, so
if people use both the platform and chef-server, they won't be confused
about how features work where.

The model seems to be an additive one, ie you can add permissions, but
you can't remove them, and a client has the union of all permissions
given to the recursive set of groups they are a member of.

My idea is to store the permissions of an object in the object itself,
so you'll have something along the lines of:

{
…
  "permissions": {
    "group[foo]": [
      "read",
      "update",
      "grant"
    ],
    "client[bar]": [
      "read",
      "update",
      "delete",
      "grant"
    ]
  },
  "chef_type": "node"
}

The chef server configuration will grow a few new configuration options,
one is default_permissions, the other is override_permissions.  The
former will set permissions for objects if the permission hash is empty
or missing, the latter will always be added to objects.

In addition, permissions for creating and listing clients, nodes, data
bags, data bag items and so on will be set in the configuration.

As you can see, we need some group support for this, this is simply a
group of clients.  Groups can have clients and other groups as members.
The member graph is a DAG.  In addition to whatever admin-defined groups
exist, there are three more magic groups:

 - admins: contains all clients with admin: yes
 - users: contains all clients
 - self: contains the client with the same name as the object.

Searches will be handled by a filter in the chef server, solr won't need
to know about permissions.

How does this sound to everybody?  I'd particularly value input from
people with experience from the platform so I can make sure the designs
are compatible.

Best regards,
-- 
Tollef Fog Heen
UNIX is user friendly, it's just picky about who its friends are