awx icon indicating copy to clipboard operation
awx copied to clipboard

Replace RBAC internals with lib from django-ansible-base

Open AlanCoding opened this issue 2 years ago • 0 comments

SUMMARY

This makes use of https://github.com/ansible/django-ansible-base/pull/45

The main points of that RBAC system are to:

  • Natively associate a list of permissions with a role, whereas it tends to be taken as obvious today, like, of course update_role gives update permission and read permission.
  • Allow roles with user-selected permissions, like, allow a user to create and edit a project without being able to update it.
  • Open the door for more fine-grained permissions, specifically the "add" permission right now, which would allow a user to add a project, for example, without also giving the user the ability to edit and update all projects in an organization.
  • Open the door for creating custom roles in the future.
  • Allow using the same RBAC system other apps, aside from AWX.

The last points here will not be exposed through the API until new endpoints are added. That is what I will work on next, but first I want to get tests cleaned up with the ORM layer integration, which is why this is being oped up initially.

ISSUE TYPE
  • New or Enhanced Feature
COMPONENT NAME
  • API
ADDITIONAL INFORMATION

Initially this is being done in a backward compatible way with the current roles API. I want to formally document the few backward incompatible things.

  • the system admin and auditor role no longer exist. Now it only uses the user flags (we pretty much did anyway)
  • access list is artificial, made from the new models, to look like the old models. Some things will be slightly different.

AlanCoding avatar Dec 20 '23 21:12 AlanCoding