Re: [libvirt-users] Libvirt access control drivers

On Fri, May 11, 2018 at 04:26:36PM +0300, Anastasiya Ruzhanskaya wrote: > Excuse me for renewing this discussion, but I am curious if you would add > new module, which will be able to process users not based on unix > processes, from where do you plan to get usernames? I mean, virt-manager > could give them, as there is authentication in GUI, but for example when > using oVirt, none of the usernames reach libvirt through the communication > between server and nodes. The identity attributes would have to use information that libvirt acquires from its authentication modules. When using TLS, if client certificates are requested by libvirtd, then we can check the x509 cert distinguished name field. When using SASL, if the SASL mechanism returns a username, we can check that. NB, we would *not* be trying to check the end user that oVirt knows about, rather we are authenticating oVirt itself. To check end users defined by the higher level mgmt app would require an extra set of functionality in the public API, to allow oVirt to do user impersonation with libvirt. eg libvirt would first authenticate ovirt, ovirt would then sya it wants to impersonate "fred" and from there all APIs get checked against "fred". This gets pretty difficult though, because oVirt and most similar mgmt apps generally only have a single connection to libvirt but are doing work for 100's of different users on it. So in reality it is not very practical for libvirt to try to validate ovirt's users. Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/ dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/ dberrange :|