© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
67d34a1
(Get the code!)
Don't think it'll work by just tweaking policy.json. The way our authorization model works, we are essentially doing policy checks prior to backend actions.
https:/
https:/
In this case, we are matching the incoming credential against the query filter. In other words, the target object hasn't been retrieved yet.
Because Oslo policy engine can only do plain attribute matches. It does not know anything about objects and their relationships. In other words, to use oslo policy the way it is implemented right now, the consumer (in this case, the API code) would have to interpret the object relations for the target object and flatten them into meta data (key-value pairs) before feeding them to the enforce method.
Otherwise, we would have to change the Oslo policy to take object relationship into consideration. Or we would have to pass the filters to the backend and then filter the result on the way out.