{"action":"created","comment":{"url":"https://api.github.com/repos/buildbot/buildbot/pulls/comments/87715621","pull_request_review_id":8317435,"id":87715621,"diff_hunk":"@@ -476,17 +476,71 @@ Here is a configuration that is known to work (Apache 2.4.10 / Debian 8), direct\n Authorization rules\n ~~~~~~~~~~~~~~~~~~~\n \n+The authorization framework in Buildbot is very generic and flexible.\n+Drawback is that it is not very obvious for new comers.\n+The 'simple' example will however allow you to easily start by implementing an admins-have-all-rights setup.\n+\n+Please carefully read the following documentation to understand how to setup authorization in Buildbot.\n+\n+Authorization framework is tightly coupled to the REST API.\n+Authorization framework only works for HTTP, not for other means of interaction like IRC or try scheduler.\n+It allows or denies access to the REST APIs according to rules.\n+\n+.. blockdiag::\n+\n+    blockdiag {\n+      User -> AuthenticatedUser [label = Auth];\n+      AuthenticatedUser -> \"RoleMatcher\" -> Role <- \"EndpointMatcher\" <- \"REST API Endpoint\"\n+\n+      User  [shape = actor];\n+      AuthenticatedUser  [shape = actor];\n+      RoleMatcher [shape = diamond];\n+      EndpointMatcher [shape = diamond];\n+    }\n+\n+- Roles is a label that you give to a user.\n+  It is similar to the notion of group, but with more flexibility.\n+  For an example of how it is different to group, there is the ``owner`` role, which can be given to a user for a build that he is at the origin.\n+\n+- Endpoint matchers associates role requirements to REST API endpoints.\n+\n+- Role matchers associates authenticated users to roles.\n+\n+.. py:class:: buildbot.www.authz.Authz(allowRules=[], roleMatcher=[], stringsMatcher=util.fnmatchStrMatcher)\n+\n+    :param allowRules: List of EndpointMatchers processed in order for each endpoint grant request.\n+    :param roleMatcher: List of RoleMatchers\n+    :param stringsMatcher: Selects algorithm used to make string comparaison.\n+       can be :py:class:`util.fnmatchStrMatcher` or :py:class:`util.reStrMatcher` from ``from buildbot.plugins import util``\n+\n+    :py:class:`Authz` needs to be configured in ``c['www']['authz']``\n+\n Endpoint matchers\n +++++++++++++++++\n \n Endpoint matchers are responsible for creating rules to match REST endpoints, and requiring roles for them.\n-The following sequence is implemented by each EndpointMatcher class\n+Endpoint matchers are process in the order they are configured.","path":"master/docs/manual/cfg-www.rst","position":48,"original_position":48,"commit_id":"bd21e05133df3a985107ab5528d3f33c67b33a81","original_commit_id":"bd21e05133df3a985107ab5528d3f33c67b33a81","user":{"login":"Lekensteyn","id":164530,"avatar_url":"https://avatars.githubusercontent.com/u/164530?v=3","gravatar_id":"","url":"https://api.github.com/users/Lekensteyn","html_url":"https://github.com/Lekensteyn","followers_url":"https://api.github.com/users/Lekensteyn/followers","following_url":"https://api.github.com/users/Lekensteyn/following{/other_user}","gists_url":"https://api.github.com/users/Lekensteyn/gists{/gist_id}","starred_url":"https://api.github.com/users/Lekensteyn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Lekensteyn/subscriptions","organizations_url":"https://api.github.com/users/Lekensteyn/orgs","repos_url":"https://api.github.com/users/Lekensteyn/repos","events_url":"https://api.github.com/users/Lekensteyn/events{/privacy}","received_events_url":"https://api.github.com/users/Lekensteyn/received_events","type":"User","site_admin":false},"body":"\"are processed in\"","created_at":"2016-11-13T16:24:55Z","updated_at":"2016-11-13T16:30:33Z","html_url":"https://github.com/buildbot/buildbot/pull/2499#discussion_r87715621","pull_request_url":"https://api.github.com/repos/buildbot/buildbot/pulls/2499","_links":{"self":{"href":"https://api.github.com/repos/buildbot/buildbot/pulls/comments/87715621"},"html":{"href":"https://github.com/buildbot/buildbot/pull/2499#discussion_r87715621"},"pull_request":{"href":"https://api.github.com/repos/buildbot/buildbot/pulls/2499"}}},"pull_request":{"url":"https://api.github.com/repos/buildbot/buildbot/pulls/2499","id":93477202,"html_url":"https://github.com/buildbot/buildbot/pull/2499","diff_url":"https://github.com/buildbot/buildbot/pull/2499.diff","patch_url":"https://github.com/buildbot/buildbot/pull/2499.patch","issue_url":"https://api.github.com/repos/buildbot/buildbot/issues/2499","number":2499,"state":"open","locked":false,"title":"Introduction text for the authorization framework","user":{"login":"tardyp","id":109859,"avatar_url":"https://avatars.githubusercontent.com/u/109859?v=3","gravatar_id":"","url":"https://api.github.com/users/tardyp","html_url":"https://github.com/tardyp","followers_url":"https://api.github.com/users/tardyp/followers","following_url":"https://api.github.com/users/tardyp/following{/other_user}","gists_url":"https://api.github.com/users/tardyp/gists{/gist_id}","starred_url":"https://api.github.com/users/tardyp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tardyp/subscriptions","organizations_url":"https://api.github.com/users/tardyp/orgs","repos_url":"https://api.github.com/users/tardyp/repos","events_url":"https://api.github.com/users/tardyp/events{/privacy}","received_events_url":"https://api.github.com/users/tardyp/received_events","type":"User","site_admin":false},"body":"blockdiag looks like this:\r\n\r\n![image](https://cloud.githubusercontent.com/assets/109859/20247013/4a8c1a64-a9c3-11e6-8d87-f196ff5c8698.png)\r\n","created_at":"2016-11-13T16:04:20Z","updated_at":"2016-11-13T16:30:33Z","closed_at":null,"merged_at":null,"merge_commit_sha":"4f060c4b1407a1b4b0b20ffbc8c786513d41dfe1","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/buildbot/buildbot/pulls/2499/commits","review_comments_url":"https://api.github.com/repos/buildbot/buildbot/pulls/2499/comments","review_comment_url":"https://api.github.com/repos/buildbot/buildbot/pulls/comments{/number}","comments_url":"https://api.github.com/repos/buildbot/buildbot/issues/2499/comments","statuses_url":"https://api.github.com/repos/buildbot/buildbot/statuses/bd21e05133df3a985107ab5528d3f33c67b33a81","head":{"label":"tardyp:authzdoc","ref":"authzdoc","sha":"bd21e05133df3a985107ab5528d3f33c67b33a81","user":{"login":"tardyp","id":109859,"avatar_url":"https://avatars.githubusercontent.com/u/109859?v=3","gravatar_id":"","url":"https://api.github.com/users/tardyp","html_url":"https://github.com/tardyp","followers_url":"https://api.github.com/users/tardyp/followers","following_url":"https://api.github.com/users/tardyp/following{/other_user}","gists_url":"https://api.github.com/users/tardyp/gists{/gist_id}","starred_url":"https://api.github.com/users/tardyp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tardyp/subscriptions","organizations_url":"https://api.github.com/users/tardyp/orgs","repos_url":"https://api.github.com/users/tardyp/repos","events_url":"https://api.github.com/users/tardyp/events{/privacy}","received_events_url":"https://api.github.com/users/tardyp/received_events","type":"User","site_admin":false},"repo":{"id":930175,"name":"buildbot","full_name":"tardyp/buildbot","owner":{"login":"tardyp","id":109859,"avatar_url":"https://avatars.githubusercontent.com/u/109859?v=3","gravatar_id":"","url":"https://api.github.com/users/tardyp","html_url":"https://github.com/tardyp","followers_url":"https://api.github.com/users/tardyp/followers","following_url":"https://api.github.com/users/tardyp/following{/other_user}","gists_url":"https://api.github.com/users/tardyp/gists{/gist_id}","starred_url":"https://api.github.com/users/tardyp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tardyp/subscriptions","organizations_url":"https://api.github.com/users/tardyp/orgs","repos_url":"https://api.github.com/users/tardyp/repos","events_url":"https://api.github.com/users/tardyp/events{/privacy}","received_events_url":"https://api.github.com/users/tardyp/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/tardyp/buildbot","description":"Python-based continuous integration testing framework; send pull requests for your patches!","fork":true,"url":"https://api.github.com/repos/tardyp/buildbot","forks_url":"https://api.github.com/repos/tardyp/buildbot/forks","keys_url":"https://api.github.com/repos/tardyp/buildbot/keys{/key_id}","collaborators_url":"https://api.github.com/repos/tardyp/buildbot/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/tardyp/buildbot/teams","hooks_url":"https://api.github.com/repos/tardyp/buildbot/hooks","issue_events_url":"https://api.github.com/repos/tardyp/buildbot/issues/events{/number}","events_url":"https://api.github.com/repos/tardyp/buildbot/events","assignees_url":"https://api.github.com/repos/tardyp/buildbot/assignees{/user}","branches_url":"https://api.github.com/repos/tardyp/buildbot/branches{/branch}","tags_url":"https://api.github.com/repos/tardyp/buildbot/tags","blobs_url":"https://api.github.com/repos/tardyp/buildbot/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/tardyp/buildbot/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/tardyp/buildbot/git/refs{/sha}","trees_url":"https://api.github.com/repos/tardyp/buildbot/git/trees{/sha}","statuses_url":"https://api.github.com/repos/tardyp/buildbot/statuses/{sha}","languages_url":"https://api.github.com/repos/tardyp/buildbot/languages","stargazers_url":"https://api.github.com/repos/tardyp/buildbot/stargazers","contributors_url":"https://api.github.com/repos/tardyp/buildbot/contributors","subscribers_url":"https://api.github.com/repos/tardyp/buildbot/subscribers","subscription_url":"https://api.github.com/repos/tardyp/buildbot/subscription","commits_url":"https://api.github.com/repos/tardyp/buildbot/commits{/sha}","git_commits_url":"https://api.github.com/repos/tardyp/buildbot/git/commits{/sha}","comments_url":"https://api.github.com/repos/tardyp/buildbot/comments{/number}","issue_comment_url":"https://api.github.com/repos/tardyp/buildbot/issues/comments{/number}","contents_url":"https://api.github.com/repos/tardyp/buildbot/contents/{+path}","compare_url":"https://api.github.com/repos/tardyp/buildbot/compare/{base}...{head}","merges_url":"https://api.github.com/repos/tardyp/buildbot/merges","archive_url":"https://api.github.com/repos/tardyp/buildbot/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/tardyp/buildbot/downloads","issues_url":"https://api.github.com/repos/tardyp/buildbot/issues{/number}","pulls_url":"https://api.github.com/repos/tardyp/buildbot/pulls{/number}","milestones_url":"https://api.github.com/repos/tardyp/buildbot/milestones{/number}","notifications_url":"https://api.github.com/repos/tardyp/buildbot/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/tardyp/buildbot/labels{/name}","releases_url":"https://api.github.com/repos/tardyp/buildbot/releases{/id}","deployments_url":"https://api.github.com/repos/tardyp/buildbot/deployments","created_at":"2010-09-22T09:33:50Z","updated_at":"2016-08-26T15:38:20Z","pushed_at":"2016-11-13T16:02:51Z","git_url":"git://github.com/tardyp/buildbot.git","ssh_url":"git@github.com:tardyp/buildbot.git","clone_url":"https://github.com/tardyp/buildbot.git","svn_url":"https://github.com/tardyp/buildbot","homepage":"http://buildbot.net","size":41292,"stargazers_count":4,"watchers_count":4,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":4,"default_branch":"master"}},"base":{"label":"buildbot:master","ref":"master","sha":"c978557b74eeeb9ad19005e4092be43a2dddae3a","user":{"login":"buildbot","id":324515,"avatar_url":"https://avatars.githubusercontent.com/u/324515?v=3","gravatar_id":"","url":"https://api.github.com/users/buildbot","html_url":"https://github.com/buildbot","followers_url":"https://api.github.com/users/buildbot/followers","following_url":"https://api.github.com/users/buildbot/following{/other_user}","gists_url":"https://api.github.com/users/buildbot/gists{/gist_id}","starred_url":"https://api.github.com/users/buildbot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/buildbot/subscriptions","organizations_url":"https://api.github.com/users/buildbot/orgs","repos_url":"https://api.github.com/users/buildbot/repos","events_url":"https://api.github.com/users/buildbot/events{/privacy}","received_events_url":"https://api.github.com/users/buildbot/received_events","type":"Organization","site_admin":false},"repo":{"id":760165,"name":"buildbot","full_name":"buildbot/buildbot","owner":{"login":"buildbot","id":324515,"avatar_url":"https://avatars.githubusercontent.com/u/324515?v=3","gravatar_id":"","url":"https://api.github.com/users/buildbot","html_url":"https://github.com/buildbot","followers_url":"https://api.github.com/users/buildbot/followers","following_url":"https://api.github.com/users/buildbot/following{/other_user}","gists_url":"https://api.github.com/users/buildbot/gists{/gist_id}","starred_url":"https://api.github.com/users/buildbot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/buildbot/subscriptions","organizations_url":"https://api.github.com/users/buildbot/orgs","repos_url":"https://api.github.com/users/buildbot/repos","events_url":"https://api.github.com/users/buildbot/events{/privacy}","received_events_url":"https://api.github.com/users/buildbot/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/buildbot/buildbot","description":"Python-based continuous integration testing framework; your pull requests are more than welcome!","fork":false,"url":"https://api.github.com/repos/buildbot/buildbot","forks_url":"https://api.github.com/repos/buildbot/buildbot/forks","keys_url":"https://api.github.com/repos/buildbot/buildbot/keys{/key_id}","collaborators_url":"https://api.github.com/repos/buildbot/buildbot/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/buildbot/buildbot/teams","hooks_url":"https://api.github.com/repos/buildbot/buildbot/hooks","issue_events_url":"https://api.github.com/repos/buildbot/buildbot/issues/events{/number}","events_url":"https://api.github.com/repos/buildbot/buildbot/events","assignees_url":"https://api.github.com/repos/buildbot/buildbot/assignees{/user}","branches_url":"https://api.github.com/repos/buildbot/buildbot/branches{/branch}","tags_url":"https://api.github.com/repos/buildbot/buildbot/tags","blobs_url":"https://api.github.com/repos/buildbot/buildbot/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/buildbot/buildbot/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/buildbot/buildbot/git/refs{/sha}","trees_url":"https://api.github.com/repos/buildbot/buildbot/git/trees{/sha}","statuses_url":"https://api.github.com/repos/buildbot/buildbot/statuses/{sha}","languages_url":"https://api.github.com/repos/buildbot/buildbot/languages","stargazers_url":"https://api.github.com/repos/buildbot/buildbot/stargazers","contributors_url":"https://api.github.com/repos/buildbot/buildbot/contributors","subscribers_url":"https://api.github.com/repos/buildbot/buildbot/subscribers","subscription_url":"https://api.github.com/repos/buildbot/buildbot/subscription","commits_url":"https://api.github.com/repos/buildbot/buildbot/commits{/sha}","git_commits_url":"https://api.github.com/repos/buildbot/buildbot/git/commits{/sha}","comments_url":"https://api.github.com/repos/buildbot/buildbot/comments{/number}","issue_comment_url":"https://api.github.com/repos/buildbot/buildbot/issues/comments{/number}","contents_url":"https://api.github.com/repos/buildbot/buildbot/contents/{+path}","compare_url":"https://api.github.com/repos/buildbot/buildbot/compare/{base}...{head}","merges_url":"https://api.github.com/repos/buildbot/buildbot/merges","archive_url":"https://api.github.com/repos/buildbot/buildbot/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/buildbot/buildbot/downloads","issues_url":"https://api.github.com/repos/buildbot/buildbot/issues{/number}","pulls_url":"https://api.github.com/repos/buildbot/buildbot/pulls{/number}","milestones_url":"https://api.github.com/repos/buildbot/buildbot/milestones{/number}","notifications_url":"https://api.github.com/repos/buildbot/buildbot/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/buildbot/buildbot/labels{/name}","releases_url":"https://api.github.com/repos/buildbot/buildbot/releases{/id}","deployments_url":"https://api.github.com/repos/buildbot/buildbot/deployments","created_at":"2010-07-06T17:56:53Z","updated_at":"2016-11-12T16:58:11Z","pushed_at":"2016-11-13T16:04:20Z","git_url":"git://github.com/buildbot/buildbot.git","ssh_url":"git@github.com:buildbot/buildbot.git","clone_url":"https://github.com/buildbot/buildbot.git","svn_url":"https://github.com/buildbot/buildbot","homepage":"http://buildbot.net","size":91146,"stargazers_count":2436,"watchers_count":2436,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":991,"mirror_url":null,"open_issues_count":19,"forks":991,"open_issues":19,"watchers":2436,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/buildbot/buildbot/pulls/2499"},"html":{"href":"https://github.com/buildbot/buildbot/pull/2499"},"issue":{"href":"https://api.github.com/repos/buildbot/buildbot/issues/2499"},"comments":{"href":"https://api.github.com/repos/buildbot/buildbot/issues/2499/comments"},"review_comments":{"href":"https://api.github.com/repos/buildbot/buildbot/pulls/2499/comments"},"review_comment":{"href":"https://api.github.com/repos/buildbot/buildbot/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/buildbot/buildbot/pulls/2499/commits"},"statuses":{"href":"https://api.github.com/repos/buildbot/buildbot/statuses/bd21e05133df3a985107ab5528d3f33c67b33a81"}}}}
{"actor":{"display_login":"Lekensteyn"}}