#960 feat(UAC): change default ownership to admins for externally created resources #2137

ricardona · 2018-08-07T16:02:06Z

This change includes GUI, rest API, DB and migration

The default ownership will be:

Container <without ownership> --> Admin
Container <with ownership>    --> Public/Private

Closes #960

…sources

Deprecated AdministratorsOnly js and go backend

Update swagger definition changing AdministratorsOnly to Public

…tions On stacks, containers networks, services , tasks and volumes.

The administrator resources are deleted and Public resources are now managed by admins

deviantony

Thanks a lot for this @ricardona and sorry for the late review.

Small changes required and a question, see my comments.

api/bolt/migrator/migrator.go

app/portainer/services/api/resourceControlService.js

api/http/proxy/containers.go

deviantony

@ricardona I've request other changes, mainly to make the codebase a bit more easier to read. Please have look at my comments.

api/http/handler/stacks/stack_delete.go

api/http/handler/stacks/stack_file.go

api/http/handler/stacks/stack_inspect.go

api/http/handler/stacks/stack_migrate.go

api/http/handler/stacks/stack_update.go

api/http/proxy/access_control.go

api/http/proxy/containers.go

api/http/security/authorization.go

deviantony

LGTM

deviantony · 2018-08-18T08:42:52Z

@ncresswell played with this a bit, looks OK. Thing to note: all public resources will be updated to administrator restricted (be it default policy or assigned by the user).

deviantony

Found an issue with Swarm related resources, they seem to be declared as public in the table views (services, configs, secrets) whereas they have a different access control policy assigned.

See the screenshots below:

deviantony

LGTM

deviantony · 2018-08-19T05:57:36Z

Thanks @ricardona 👍

WTFKr0 · 2018-10-02T13:08:42Z

Hi

We just migrated to 1.19.2 and, as expected, all our resources have migrated to admin only instead of public (we deploy apps outside of portainer)
I look for a parameter to change this behavior (default to public)
Is there a such parameter ?
Our use of portainer is to have an only portainer instance managing many clusters
Admin may have access to all clusters, but users get access only to certain endpoints
Users accessing a endpoint have all access on that endpint, so public is fine

As a workaroud, i'll soon write a batch process to change admin ownership to public, so that newly deployed apps are set to public

Thanx

deviantony · 2018-10-02T19:10:49Z

I look for a parameter to change this behavior (default to public)
Is there a such parameter ?

There is none.

Although, we're planning on introducing UAC related labels in the next release, see: #1257 (comment)

Would that be of any help to you?

WTFKr0 · 2018-10-02T20:40:04Z

Yes it should be nice with that
The API allow me to be very efficient, I just code my batch in few minutes to get what I want
So it's fine for me for now, just waiting for labels 😃
Thanx

ricardona · 2018-10-03T13:45:37Z

Our use of portainer is to have an only portainer instance managing many clusters
Admin may have access to all clusters, but users get access only to certain endpoints
Users accessing a endpoint have all access on that endpint, so public is fine

@WTFKr0 Your use case is similar to #2190 Segregate logically Portainer resources using projects and it will be included in the next release too. Could that help?

@deviantony #1257 and #2190 are trying to solve the same problem "declare access privileges in the compose file or from docker CLI". Does that mean that one should be discarded?

deviantony · 2018-10-03T20:36:12Z

@ricardona I don't think so.

#1257 aims to provide the ability to set-up access control policies via labels.

#2190 aims to introduce a new project entity as well as enhance Portainer views to support project visualization.

from: portainer/portainer#2137 (comment)

* EE-3915 ui fixes on docker container pages * Update createcontainer.html Update label

Ricardo Cardona Ramirez and others added 6 commits August 2, 2018 12:22

#960 feat(UAC): change ownership to admins for externally created res…

edc31ca

…sources

feat(UAC): change ownership to admins for externally created resources

ba33701

Deprecated AdministratorsOnly js and go backend

#960 feat(UAC): remove AdministratorsOnly property and minor GUI fixes

77af5a4

Update swagger definition changing AdministratorsOnly to Public

#960 feat(UAC): fix create resource with access control data

9c8e5f4

#960 feat(UAC): authorization of non-admin users for restricted opera…

bba8940

…tions On stacks, containers networks, services , tasks and volumes.

#960 feat(UAC): database migration to version 14

482ad1b

The administrator resources are deleted and Public resources are now managed by admins

deviantony added the contrib/func-review-in-progress label Aug 8, 2018

deviantony self-requested a review August 13, 2018 16:44

Merge branch 'develop' into develop

b35b319

deviantony requested changes Aug 13, 2018

View reviewed changes

api/bolt/migrator/migrator.go Outdated Show resolved Hide resolved

app/portainer/services/api/resourceControlService.js Outdated Show resolved Hide resolved

api/http/proxy/containers.go Show resolved Hide resolved

deviantony added changes-required Waiting for an update of the contributor and removed contrib/func-review-in-progress labels Aug 13, 2018

#960 feat(UAC): small fixes from PR #2137

354270c

deviantony requested changes Aug 14, 2018

View reviewed changes

#960 feat(UAC): improve the readability of the source code

c79dafd

deviantony added contrib/tech-review-in-progress and removed changes-required Waiting for an update of the contributor labels Aug 15, 2018

deviantony approved these changes Aug 15, 2018

View reviewed changes

deviantony added contrib/tests-in-progress breaking-changes This pull request introduces breaking changes and removed contrib/tech-review-in-progress labels Aug 15, 2018

deviantony added this to the 1.19.2 milestone Aug 15, 2018

deviantony added changes-required Waiting for an update of the contributor and removed contrib/tech-review-approved labels Aug 18, 2018

deviantony requested changes Aug 18, 2018

View reviewed changes

feat(UAC) fix displayed ownership for Swarm related resources (#960)

bf803a5

deviantony added contrib/tech-review-in-progress and removed breaking-changes This pull request introduces breaking changes changes-required Waiting for an update of the contributor labels Aug 19, 2018

deviantony approved these changes Aug 19, 2018

View reviewed changes

deviantony added contrib/ready-to-merge breaking-changes This pull request introduces breaking changes and removed contrib/tech-review-in-progress labels Aug 19, 2018

deviantony merged commit e1e263d into portainer:develop Aug 19, 2018

deviantony mentioned this pull request Aug 19, 2018

Default ownership for externally created ressources #960

Closed

ncresswell added this to Portainer Release 1.19.2 in Roadmap Aug 20, 2018

deviantony removed this from Portainer Release 1.19.2 in Roadmap Aug 20, 2018

olljanat mentioned this pull request Sep 17, 2018

Service Access Control via Labels #1257

Closed

WTFKr0 mentioned this pull request Oct 2, 2018

Suspecting Memory Leak in portainer #2318

Closed

opera443399 added a commit to opera443399/ops that referenced this pull request Oct 15, 2018

feat(docker-ui-portainer): howto use API to change service ACL

52116bb

from: portainer/portainer#2137 (comment)

olljanat mentioned this pull request Oct 31, 2018

feat(uac): allow user select default ownership for resources #2424

Closed

xAt0mZ pushed a commit that referenced this pull request Aug 25, 2022

Fix(UI) UI fixes on docker container screens EE-3915 (#2137)

1eb59d7

* EE-3915 ui fixes on docker container pages * Update createcontainer.html Update label

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

#960 feat(UAC): change default ownership to admins for externally created resources #2137

#960 feat(UAC): change default ownership to admins for externally created resources #2137

ricardona commented Aug 7, 2018 •

edited

Loading

deviantony left a comment

deviantony left a comment

deviantony left a comment

deviantony commented Aug 18, 2018

deviantony left a comment •

edited

Loading

deviantony left a comment

deviantony commented Aug 19, 2018

WTFKr0 commented Oct 2, 2018 •

edited

Loading

deviantony commented Oct 2, 2018

WTFKr0 commented Oct 2, 2018

ricardona commented Oct 3, 2018

deviantony commented Oct 3, 2018

#960 feat(UAC): change default ownership to admins for externally created resources #2137

#960 feat(UAC): change default ownership to admins for externally created resources #2137

Conversation

ricardona commented Aug 7, 2018 • edited Loading

deviantony left a comment

Choose a reason for hiding this comment

deviantony left a comment

Choose a reason for hiding this comment

deviantony left a comment

Choose a reason for hiding this comment

deviantony commented Aug 18, 2018

deviantony left a comment • edited Loading

Choose a reason for hiding this comment

deviantony left a comment

Choose a reason for hiding this comment

deviantony commented Aug 19, 2018

WTFKr0 commented Oct 2, 2018 • edited Loading

deviantony commented Oct 2, 2018

WTFKr0 commented Oct 2, 2018

ricardona commented Oct 3, 2018

deviantony commented Oct 3, 2018

ricardona commented Aug 7, 2018 •

edited

Loading

deviantony left a comment •

edited

Loading

WTFKr0 commented Oct 2, 2018 •

edited

Loading