{"action":"created","issue":{"url":"https://api.github.com/repos/eclipse/smarthome/issues/579","repository_url":"https://api.github.com/repos/eclipse/smarthome","labels_url":"https://api.github.com/repos/eclipse/smarthome/issues/579/labels{/name}","comments_url":"https://api.github.com/repos/eclipse/smarthome/issues/579/comments","events_url":"https://api.github.com/repos/eclipse/smarthome/issues/579/events","html_url":"https://github.com/eclipse/smarthome/issues/579","id":120137665,"number":579,"title":"Add support for conditional access based on user role","user":{"login":"kaikreuzer","id":3244965,"avatar_url":"https://avatars.githubusercontent.com/u/3244965?v=3","gravatar_id":"","url":"https://api.github.com/users/kaikreuzer","html_url":"https://github.com/kaikreuzer","followers_url":"https://api.github.com/users/kaikreuzer/followers","following_url":"https://api.github.com/users/kaikreuzer/following{/other_user}","gists_url":"https://api.github.com/users/kaikreuzer/gists{/gist_id}","starred_url":"https://api.github.com/users/kaikreuzer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kaikreuzer/subscriptions","organizations_url":"https://api.github.com/users/kaikreuzer/orgs","repos_url":"https://api.github.com/users/kaikreuzer/repos","events_url":"https://api.github.com/users/kaikreuzer/events{/privacy}","received_events_url":"https://api.github.com/users/kaikreuzer/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/eclipse/smarthome/labels/Core","name":"Core","color":"207de5"},{"url":"https://api.github.com/repos/eclipse/smarthome/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":20,"created_at":"2015-12-03T10:23:49Z","updated_at":"2016-05-23T14:19:32Z","closed_at":null,"body":"migrated from Bugzilla [#423548](https://bugs.eclipse.org/bugs/show_bug.cgi?id=423548)\nstatus NEW severity *enhancement* in component *Core* for *---*\nReported in version *unspecified* on platform *PC*\nAssigned to: Project Inbox\n\nOn 2013-12-08 15:16:18 -0500, Kai Kreuzer wrote:\n\n> Migrated from https://code.google.com/p/openhab/issues/detail?id=387\n\nOn 2015-09-25 03:52:04 -0400, Kai Kreuzer wrote:\n\n> Some input from my side what I see should be covered. There are multiple levels of access control that can be addressed:\n> \n> 1. Global access control as it is done in openHAB 1 (see https://github.com/openhab/openhab/wiki/Security#authentication). I.e. for any access to the runtime, the user needs credentials and is then assigned a role.\n> JAAS is probably a good option here. Note that the solution has to work in general for any OSGi HttpService, it must not be specific to Jetty (while in openHAB 2, we can add a Jetty-specific configuration for JAAS then).\n> \n> 2. Restrict certain urls and/or http verbs for certain roles. See the example discussed in https://www.eclipse.org/forums/index.php/t/1068387/.\n> \n> 3. Restrict access on certain data, e.g. return a HTTP 403 when my kids try to access localhost:8080/classicui/app?sitemap=admin. This could be implemented in phases, the most important resource would be sitemaps, then come items, things, rules, etc. But in general this mechanism should be available on all resources. Configuration of such restrictions should not only be by resource name, but possibly also by type/tag, e.g. do not grant access to any item that is tagged as \"security\".\n> \n> 4. Filter data within requests, i.e. if I do not have rights for sitemap \"admin\" (see 3), the REST url /rest/sitemaps should not even list it. Sitemaps that refer to items that I am not allowed to access should filter out these widgets automatically.\n> \n> 5. Check implications on automation rules. Normally, rules are executed by the system and not the user. But we could imagine that a trigger was caused by some user (e.g. an item state change) and thus the rule could be regarded to be executed on behalf of this user - then again, the permissions should be checked and e.g. sending commands to restricted items must be blocked.\n> \n> Does anybody has further ideas/requirements?\n\n"},"comment":{"url":"https://api.github.com/repos/eclipse/smarthome/issues/comments/220993749","html_url":"https://github.com/eclipse/smarthome/issues/579#issuecomment-220993749","issue_url":"https://api.github.com/repos/eclipse/smarthome/issues/579","id":220993749,"user":{"login":"digitaldan","id":1903737,"avatar_url":"https://avatars.githubusercontent.com/u/1903737?v=3","gravatar_id":"","url":"https://api.github.com/users/digitaldan","html_url":"https://github.com/digitaldan","followers_url":"https://api.github.com/users/digitaldan/followers","following_url":"https://api.github.com/users/digitaldan/following{/other_user}","gists_url":"https://api.github.com/users/digitaldan/gists{/gist_id}","starred_url":"https://api.github.com/users/digitaldan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/digitaldan/subscriptions","organizations_url":"https://api.github.com/users/digitaldan/orgs","repos_url":"https://api.github.com/users/digitaldan/repos","events_url":"https://api.github.com/users/digitaldan/events{/privacy}","received_events_url":"https://api.github.com/users/digitaldan/received_events","type":"User","site_admin":false},"created_at":"2016-05-23T14:19:32Z","updated_at":"2016-05-23T14:19:32Z","body":"> Could AuthenticatedHttpContext simply be a service itself\r\n\r\n@kaikreuzer are you thinking it would be a service in an existing bundle, or be its own standalone bundle?"}}
{"actor":{"display_login":"digitaldan"}}