{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/origin/issues/8393","repository_url":"https://api.github.com/repos/openshift/origin","labels_url":"https://api.github.com/repos/openshift/origin/issues/8393/labels{/name}","comments_url":"https://api.github.com/repos/openshift/origin/issues/8393/comments","events_url":"https://api.github.com/repos/openshift/origin/issues/8393/events","html_url":"https://github.com/openshift/origin/pull/8393","id":146417950,"number":8393,"title":"scoped tokens","user":{"login":"deads2k","id":8225098,"avatar_url":"https://avatars.githubusercontent.com/u/8225098?v=3","gravatar_id":"","url":"https://api.github.com/users/deads2k","html_url":"https://github.com/deads2k","followers_url":"https://api.github.com/users/deads2k/followers","following_url":"https://api.github.com/users/deads2k/following{/other_user}","gists_url":"https://api.github.com/users/deads2k/gists{/gist_id}","starred_url":"https://api.github.com/users/deads2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deads2k/subscriptions","organizations_url":"https://api.github.com/users/deads2k/orgs","repos_url":"https://api.github.com/users/deads2k/repos","events_url":"https://api.github.com/users/deads2k/events{/privacy}","received_events_url":"https://api.github.com/users/deads2k/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/openshift/origin/labels/api-approved","name":"api-approved","color":"0e8a16"},{"url":"https://api.github.com/repos/openshift/origin/labels/needs-rebase","name":"needs-rebase","color":"cccccc"}],"state":"open","locked":false,"assignee":{"login":"sgallagher","id":739555,"avatar_url":"https://avatars.githubusercontent.com/u/739555?v=3","gravatar_id":"","url":"https://api.github.com/users/sgallagher","html_url":"https://github.com/sgallagher","followers_url":"https://api.github.com/users/sgallagher/followers","following_url":"https://api.github.com/users/sgallagher/following{/other_user}","gists_url":"https://api.github.com/users/sgallagher/gists{/gist_id}","starred_url":"https://api.github.com/users/sgallagher/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sgallagher/subscriptions","organizations_url":"https://api.github.com/users/sgallagher/orgs","repos_url":"https://api.github.com/users/sgallagher/repos","events_url":"https://api.github.com/users/sgallagher/events{/privacy}","received_events_url":"https://api.github.com/users/sgallagher/received_events","type":"User","site_admin":false},"milestone":null,"comments":27,"created_at":"2016-04-06T20:05:51Z","updated_at":"2016-05-09T18:05:32Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/openshift/origin/pulls/8393","html_url":"https://github.com/openshift/origin/pull/8393","diff_url":"https://github.com/openshift/origin/pull/8393.diff","patch_url":"https://github.com/openshift/origin/pull/8393.patch"},"body":"This demonstrates how scopes could be attached to a user token and then filtered by an authorizer that wraps our existing authorizer.  It creates: \r\n 1. `special:whoami` - call users/~ to prove identity\r\n 2. `special:access-check` - call self-SARs to check access of the user (not the token)\r\n 3. `clusterrole:<clusterrole name>:<namespace to allow the cluster role, * means all>` - allows access based on cluster role rules, but only within the specified namespace.  (I might make that a comma-delimited list.)\r\n\r\nIf we like the general approach, I can finish off the list:\r\n - [x] unit tests\r\n - [x] integration tests that create scoped tokens\r\n\r\nAnd do the followups:\r\n - [ ] make SARs scope aware\r\n - [ ] make TSARs for checking a token\r\n - [ ] add the other two scope types (namespace-wide and cluster-wide explicit)\r\n\r\n - [ ] tighten clusterrole/role name validation to the set of characters allowed in scope names? may not be possible... failing validation on one role would prevent the entire policy from being persisted\r\n - [ ] expand scope evaluator interface to provide human descriptions for scopes (used in grant flow)\r\n - [ ] expand scope evaluator interface to provide validation (used when requesting scopes or validating a user-created token)\r\n - [ ] prevent escalating resources from being included by default:\r\nremove *, secrets, oauthtokens, oauthauthorizationtokens, etc\r\n - [ ] decide how a scope that grants a role including escalating resources would be specified\r\n\r\n@pweil- @liggitt @smarterclayton \r\n@jwforres @jimmidyson @stefwalter you guys knew people who were looking to get openshift API tokens to perform actions for a user, right?"},"comment":{"url":"https://api.github.com/repos/openshift/origin/issues/comments/217941656","html_url":"https://github.com/openshift/origin/pull/8393#issuecomment-217941656","issue_url":"https://api.github.com/repos/openshift/origin/issues/8393","id":217941656,"user":{"login":"openshift-bot","id":1779249,"avatar_url":"https://avatars.githubusercontent.com/u/1779249?v=3","gravatar_id":"","url":"https://api.github.com/users/openshift-bot","html_url":"https://github.com/openshift-bot","followers_url":"https://api.github.com/users/openshift-bot/followers","following_url":"https://api.github.com/users/openshift-bot/following{/other_user}","gists_url":"https://api.github.com/users/openshift-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/openshift-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/openshift-bot/subscriptions","organizations_url":"https://api.github.com/users/openshift-bot/orgs","repos_url":"https://api.github.com/users/openshift-bot/repos","events_url":"https://api.github.com/users/openshift-bot/events{/privacy}","received_events_url":"https://api.github.com/users/openshift-bot/received_events","type":"User","site_admin":false},"created_at":"2016-05-09T18:05:31Z","updated_at":"2016-05-09T18:05:31Z","body":"Evaluated for origin merge up to 25425f605e5abd6fc21bfe8fe63d902b2e9d688c"}}