How-to: write custom authorization code
Thanks for the info.
I will pass the code along once I get something working.
Joseph Boyer Jr
Enterprise Technology Services
Liquidnet Holdings, Inc.
T +1 646.660.8352
C +1 646.284.8394
From: firstname.lastname@example.org [mailto:email@example.com] On Behalf Of Michael DeHaan
Sent: Tuesday, June 10, 2008 4:42 PM
To: Fedora/Linux Management Tools
Subject: Re: [et-mgmt-tools] How-to: write custom authorization code
Joseph Boyer Jr. wrote:
> I would like to write an update to the authorization code where a user
> only has access to add a system and run cobbler sync via the webGUI.
That should be doable. The rest of the links in the WebUI (presently)
would be still visible but would generate "access denied" messages when
clicked upon. In other words, you can still read the other data, but
in most places you get a warning that you can't edit them and the button
to save is missing. This should be ok.
(In the future, I want to create a simple page that allows the user only
access to do certain things, and to present them less fields. Details
TBD and I'll ask the list as that is getting fleshed out -- I'm various
non-web RFEs first.)
> I have a requirement where distros, repos, and profiles are created
> and maintained by engineering (full access) and support (read/write to
> systems, read-only everything else) will be performing install.
> Any pointers where to start would be most appreciated.
This shouldn't be too hard.
modules/authz_ownership.py is a system that denies operations based on
the username of the user and whether he is or is not in certain "groups"
or is otherwise explicitly listed anywhere you see --owner in the
command line or Web app. you want to create a new module
"authz_mypolicy.py" based on this, but modify the "authorize()" function
to do your bidding.
You can see it returns 1 (let me in) or 0 (don't let me in) in certain
You want to modify this, and check to see if they are in the admin group
to allow everything (return 1), and if they are a user, only permit
certain resources such as "new_system", and "sync". You will see the
admin logic is already there, so in that case you don't have too much to
Basically instead of checking for the ownership on the object if the
user is not an admin, you want to skip that check and then make
additional checks on the name of the operation they want to perform --
"new_system", "save_system", "sync", etc
The exact names of all the methods gating access are listed in remote.py
This is all done at the authorization layer, your authentication layer
is seperate from this and does not need to be modified.
Once you have the authz_mypolicy.py installed in
/usr/lib/python2.X/site-packages/cobbler/modules, you just need to
change the authz option in /etc/cobbler/modules.conf to point to your
Let me know if I can be of any further help and if the above makes sense.
You probably want to join #cobbler for development discussions if you
> *Joseph Boyer Jr*
> *Enterprise Technology Services** **
> **Liquidnet Holdings, Inc.*
> *_Joseph.Boyer_firstname.lastname@example.org <mailto:email@example.com>*
> *T** * +1 646.660.8352
> *C ** *+1 646.284.8394
> et-mgmt-tools mailing list
et-mgmt-tools mailing list
et-mgmt-tools mailing list