Commit Graph

9 Commits

Author SHA1 Message Date
3c6477529c Merge pull request #18769 from runcom/docs-auth-1
docs: extend: authorization.md: add a note about confidential stuff in Err
Upstream-commit: eaf7932fafdfdbcefa3be3ccacab016938969cf4
Component: engine
2015-12-19 14:53:25 +01:00
d63981ab4d authZ: more fixes
- fix naming and formatting
- provide more context when erroring auth
- do not capitalize errors
- fix wrong documentation
- remove ugly remoteError{}

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Upstream-commit: 5a64c8027ecd2bebe773c9abd2e73c2fd7d23de1
Component: engine
2015-12-18 16:29:01 +01:00
7d0507241f docs: extend: authorization.md: add a note about confidential stuff in Err
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Upstream-commit: 1e28f04fec70affd8fae57f4bdd23a84853f4efc
Component: engine
2015-12-18 11:28:28 +01:00
98eeaeab93 pkg: authorization: add Err to tweak response status code
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Upstream-commit: 46e3a249a1971f8697ca338c9b02e27d36ddab12
Component: engine
2015-12-17 11:08:47 +01:00
f09e1890f6 Change authz plugin argument name
Signed-off-by: Liron Levin <liron@twistlock.com>
Upstream-commit: de4ffdfe488494c9c300a785ad4f2263c6182988
Component: engine
2015-12-11 20:59:15 +02:00
a88be4a01d Fixing documentation comments by @thaJeztah
Signed-off-by: Dima Stopel <dima@twistlock.com>
Upstream-commit: b7af5bcd20b64e7481538490a0ee1d844f5a462e
Component: engine
2015-12-11 07:03:58 +02:00
1c96ff9a0b Fixing documentation according to comments by @moxiegirl and @thaJeztah
Signed-off-by: Dima Stopel <dima@twistlock.com>
Upstream-commit: 8cc0892269fb532f117aadc0e8acf7a173fe4e1b
Component: engine
2015-12-08 17:34:15 +02:00
2491643ccf Docker authorization plug-in infrastructure enables extending the functionality of the Docker daemon with respect to user authorization. The infrastructure enables registering a set of external authorization plug-in. Each plug-in receives information about the user and the request and decides whether to allow or deny the request. Only in case all plug-ins allow accessing the resource the access is granted.
Each plug-in operates as a separate service, and registers with Docker
through general (plug-ins API)
[https://blog.docker.com/2015/06/extending-docker-with-plugins/]. No
Docker daemon recompilation is required in order to add / remove an
authentication plug-in. Each plug-in is notified twice for each
operation: 1) before the operation is performed and, 2) before the
response is returned to the client. The plug-ins can modify the response
that is returned to the client.

The authorization depends on the authorization effort that takes place
in parallel [https://github.com/docker/docker/issues/13697].

This is the official issue of the authorization effort:
https://github.com/docker/docker/issues/14674

(Here)[https://github.com/rhatdan/docker-rbac] you can find an open
document that discusses a default RBAC plug-in for Docker.

Signed-off-by: Liron Levin <liron@twistlock.com>
Added container create flow test and extended the verification for ps
Upstream-commit: 75c353f0ad73bd83ed18e92857dd99a103bb47e3
Component: engine
2015-12-08 17:34:15 +02:00
db09b58def Adding authorization subsystem documentation
Signed-off-by: Dima Stopel <dima@twistlock.com>
Upstream-commit: 630f695fb1c26ffba03df1cb5059bf592df44e81
Component: engine
2015-12-08 17:32:17 +02:00