Admin API for IAM users, groups and policies

[yauhen-matsiushonak]

Hi!

I have a question about Admin API and its mapping to mc CLI interface for IAM users, groups and policy listing. Now "user list" returns list of "user info" objects as response (which includes policies and group membership), while "policy/group list" return just list of policy/group names without any details. How do you think, is this reasonable to make "policy/group list" to behave the same as "user list"? MinIO stores IAM objects in cache and there should not be a big performance impact on building group/policy list + details, instead of just list of names for API response. However, this can add value for some client applications/scripts made on top of mc, and make API and command-line interfaces more consistent.

Now if a client application or admin needs to get list of all policies and all objects assigned to these policies, it/he/she has to get list of names first and then call "get info" for each entry in order to request all policies/groups details. So this will require (N + 1) API calls to server. However, if API endpoint can provide list + info in singe request, we can reduce this number to 1.

If this sounds reasonable to you, I can make necessary code changes. However, I would need some guidance for API versioning and we can discuss backwards compatibility here.

Also, please let me know if I need to provide more details and examples for this discussion. Thank you so much in advance!