RBAC system with custom roles integrated with AWX #45

AlanCoding · 2023-12-08T21:47:51Z

This rewrites the roles system inside of AWX and moves them here, to this library, so that ideally we can connect it to other apps. I want to be very clear that this is mainly an object-role system. I added functionality to handle system-wide permissions, but this is a different sub-system.

AWX patch to use this - ansible/awx#14735

The only reason this is possible at all is because most of the AWX gnarly permission logic exists on a layer of business logic fairly well-separated from the internals of the RBAC system. It's mainly the internals that this offers (although it tacked on a simple API), for object-roles - roles to things. Those things can be in a shallow hierarchy... which is just organizations right now. Inheritance of permissions from more than 1 parent resource has some basic tests, but isn't expected to be used yet.

Right now this is fully functional in AWX, with only 2-3 known integration test failures due to sacrifices that were knowingly made.

TODO:

Add views for this new system. Current blocker is that basic details of the API contract are not be agreed on yet. The AWX branch offers a compatibility layer with the old roles system.
Add content_type to RoleDefinition. This will be used for validation of permissions, because listing some permissions require listing other permissions, and most permissions are only valid for a certain model (or a parent of that model).
Fix unit tests in AWX. The compatibility layer currently doesn't do this for us.
Reconcile the team & organization members relationship that already exists in Gateway compatible with this. The role system, today, handles this by putting users in a pre-created team member role. If the role is the source of truth, then we need to add some ORM shortcuts to more easily access it.
Very large item - migrate galaxy_ng to this system like the AWX migration. This would have to go along with the introduction of an organization model, without organizations this entire system is useless. Ping @cutwater
Add to the AWX migration - split the organization admin role into 2 with 1 dealing with orgs / teams / user management, and the other dealing with AWX objects alone. This role will then be migrated into Gateway itself (not ansible_base). Oh yeah, and also convert Gateway to this system... I don't think it has a permissions system right now. Not doing this
Can we give this a name? DAB RBAC

ansible_base/management/commands/RBAC_checks.py

ansible_base/migrations/_managed_definitions.py

newswangerd

This looks great. I'd like to merge the resource registry and then update this to integrate with the resource registry system. I think once we do that, I'm happy to merge this PR.

ansible_base/models/rbac.py

docs/rbac.md

ansible_base/rbac/models.py

ansible_base/rbac/caching.py

john-westcott-iv

I've not combed over every file but wanted to get a start ont he comments. One general question is the layout of the files inside rbac. FIrst there is an api directory but there are some things not in there like caching and evaluations. The other thing is we have many classes in single views/serializers/modles files. I much prefer a directory with seperate files if possible. But those are kind of personal preferences.

If you want to stick with this layout for this PR I am ok with that but maybe we want to have a "standard" layout for apps in DAB in general?

ansible_base/lib/dynamic_config/dynamic_settings.py

ansible_base/lib/utils/models.py

ansible_base/lib/utils/views/django_app_api.py

docs/apps/rbac.md

ansible_base/rbac/models.py

newswangerd · 2024-03-14T20:45:08Z

I'm going to go ahead and approve this, though I do think we need to have more conversations around the permissions model.

AlanCoding · 2024-03-15T03:34:36Z

Does it make more sense to use a foreign key now that we have a concrete permission model?

I wanted to do that before today, but workload from other rebasing and other fixes kept me from it. Described in #222

AlanCoding · 2024-03-15T20:09:55Z

@john-westcott-iv AlanCoding#4 is ready, in that it is passing tests

If you want to stick with this layout for this PR I am ok with that but maybe we want to have a "standard" layout for apps in DAB in general?

I think it's a pretty clear practice that models.py is common, but with multiple categories, beyond a certain scale you can consider a models/ folder. That PR does that. I'm not super convinced that it is better, but I'm okay with it. I can push it here before merge if people want that.

Key features are - support of resource tree permission inheritance - support for grouping users into teams - efficient generation of querysets - endpoints for RBAC models, permission classes Added feature for tracking roles with relationships Added feature to manage singleton permissions Add util for assigning permissions in migrations add util for creating permissions in custom model Use null content_type to identify system roles From review Use shared method for add permission determination Make the RBAC_checks command more pretty give non-zero exit code if issues are identified Use " instead of ' for block strings Add model to test parent names not matching model

Fix bug with stale org-obj evaluations from review Be more consistent with ContentType usage Fix test failure from rebase due to postgres and flake8

Avoid database .get for unsaved objects in pre_save discovered via eda-server testing

Fix RBAC_checks management command when the thing it is doing is disabled by settings addition: Add another setting for disabling custom system role creation

Add plus integration docs for this new feature Add tests for using unauthenticated client with some views

Assure that user viewset has minimal functionailty with generic permission class

…mission

* Initial add of permission model * Add an early exit for permission creation method

Adopt new created and modified fields in CommonModel after rebase - supporting changes

sonarqubecloud · 2024-03-18T13:48:47Z

Quality Gate passed

Issues
30 New issues
0 Accepted issues

Measures
0 Security Hotspots
90.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

cutwater reviewed Dec 11, 2023

View reviewed changes

ansible_base/management/commands/RBAC_checks.py Outdated Show resolved Hide resolved

ansible_base/management/commands/RBAC_checks.py Outdated Show resolved Hide resolved

ansible_base/migrations/_managed_definitions.py Outdated Show resolved Hide resolved

AlanCoding force-pushed the django_permissions branch 2 times, most recently from 4f3c75f to 1c550f0 Compare December 14, 2023 18:56

AlanCoding mentioned this pull request Dec 20, 2023

Replace RBAC internals with lib from django-ansible-base ansible/awx#14735

Closed

newswangerd reviewed Jan 5, 2024

View reviewed changes

ansible_base/models/rbac.py Outdated Show resolved Hide resolved

ansible_base/models/rbac.py Outdated Show resolved Hide resolved

docs/rbac.md Outdated Show resolved Hide resolved

AlanCoding mentioned this pull request Jan 9, 2024

Re-organize code to separate apps versus library content #61

Closed

AlanCoding force-pushed the django_permissions branch 2 times, most recently from 4909e55 to 752e0c6 Compare January 16, 2024 14:40

AlanCoding mentioned this pull request Jan 18, 2024

[RBAC] Support permission inheritance for resources with many-to-many with organizations #78

Open

AlanCoding force-pushed the django_permissions branch 2 times, most recently from e94da3c to ba61e3b Compare January 19, 2024 00:28

AlanCoding mentioned this pull request Jan 19, 2024

[RBAC] Feature to include permissions of external resources, with no corresponding local model #80

Open

AlanCoding force-pushed the django_permissions branch 4 times, most recently from 74ad61a to 858d130 Compare January 23, 2024 18:28

newswangerd reviewed Jan 23, 2024

View reviewed changes

ansible_base/rbac/models.py Show resolved Hide resolved

newswangerd reviewed Jan 23, 2024

View reviewed changes

ansible_base/rbac/models.py Show resolved Hide resolved

newswangerd reviewed Jan 23, 2024

View reviewed changes

ansible_base/rbac/models.py Outdated Show resolved Hide resolved

cutwater reviewed Jan 24, 2024

View reviewed changes

ansible_base/rbac/caching.py Outdated Show resolved Hide resolved

ansible_base/rbac/caching.py Outdated Show resolved Hide resolved

ansible_base/rbac/caching.py Outdated Show resolved Hide resolved

AlanCoding force-pushed the django_permissions branch 4 times, most recently from 3140eb5 to 8d36bee Compare January 26, 2024 03:46

AlanCoding changed the title ~~[PoC] RBAC system with custom roles integrated with AWX~~ RBAC system with custom roles integrated with AWX Jan 26, 2024

AlanCoding force-pushed the django_permissions branch 4 times, most recently from 5cf23f3 to 90381bb Compare January 31, 2024 15:24

john-westcott-iv changed the title ~~RBAC system with custom roles integrated with AWX~~ [WIP] RBAC system with custom roles integrated with AWX Feb 1, 2024

This was referenced Mar 12, 2024

Set filter backends at view level for DAB views #212

Merged

AWX Community Meeting Agenda - March 2024 ansible/awx#14969

Closed

AlanCoding force-pushed the django_permissions branch from 3291b92 to a71608f Compare March 14, 2024 14:10

relrod mentioned this pull request Mar 14, 2024

ImmutableModel mixin #218

Closed

Dostonbek1 approved these changes Mar 14, 2024

View reviewed changes

AlanCoding force-pushed the django_permissions branch from 743621b to 2dd921c Compare March 14, 2024 18:59

fosterseth approved these changes Mar 14, 2024

View reviewed changes

john-westcott-iv reviewed Mar 14, 2024

View reviewed changes

newswangerd approved these changes Mar 14, 2024

View reviewed changes

ansible_base/rbac/models.py Show resolved Hide resolved

ansible_base/rbac/models.py Show resolved Hide resolved

AlanCoding mentioned this pull request Mar 18, 2024

[RBAC] Make examples in rbac.md for client usage fully complete #226

Open

AlanCoding added 14 commits March 18, 2024 09:36

Fix bugs from review, rebase in evaluations

d0b973e

Fix bug with stale org-obj evaluations from review Be more consistent with ContentType usage Fix test failure from rebase due to postgres and flake8

Add hack to address AWX schema failures

12b032a

Support limited assignment methods for teams - for AWX

6493078

Avoid database .get for unsaved objects in pre_save discovered via eda-server testing

Add more validation settings

cc588ff

Fix RBAC_checks management command when the thing it is doing is disabled by settings addition: Add another setting for disabling custom system role creation

Apply filter backends to RBAC views

408b30a

Add system for related object checks in an API

712501c

Add plus integration docs for this new feature Add tests for using unauthenticated client with some views

Raise error for unregistered models and fix corresponding bugs

23b1baf

Assure that user viewset has minimal functionailty with generic permission class

Review comment about sets and linter fix

ad2434a

Assignment permission check alternative where model has no change per…

7360f2e

…mission

Convert DAB RBAC to using its own concrete permission model (#3)

3ea789b

* Initial add of permission model * Add an early exit for permission creation method

Check same obj permissions for assignment and revoking

e96bfba

Code style changes from review

d7689ab

Adopt new created and modified fields in CommonModel after rebase - supporting changes

Update docs syntax and other things from review comments

9516031

AlanCoding force-pushed the django_permissions branch from 417b825 to 9516031 Compare March 18, 2024 13:44

AlanCoding merged commit d45d5a1 into ansible:devel Mar 18, 2024
7 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

RBAC system with custom roles integrated with AWX #45

RBAC system with custom roles integrated with AWX #45

AlanCoding commented Dec 8, 2023 •

edited

Loading

newswangerd left a comment

john-westcott-iv left a comment

newswangerd commented Mar 14, 2024

AlanCoding commented Mar 15, 2024

AlanCoding commented Mar 15, 2024

sonarqubecloud bot commented Mar 18, 2024

RBAC system with custom roles integrated with AWX #45

RBAC system with custom roles integrated with AWX #45

Conversation

AlanCoding commented Dec 8, 2023 • edited Loading

newswangerd left a comment

Choose a reason for hiding this comment

john-westcott-iv left a comment

Choose a reason for hiding this comment

newswangerd commented Mar 14, 2024

AlanCoding commented Mar 15, 2024

AlanCoding commented Mar 15, 2024

sonarqubecloud bot commented Mar 18, 2024

Quality Gate passed

AlanCoding commented Dec 8, 2023 •

edited

Loading