SUI specific RBAC list

[chriskacerguis]

The current RBAC system feature list doesn't map well to the SUI; and in various chats with SUI parties we really need to expand the system, however that's going to take more time and resources (e.g. we will need Ops UI work to "control" the RBAC).

So, I'd like to propose the following:

1. As we build out the new UX we "attach" a new "feature" to each and everything.
2. We will build an abstraction layer which will "translate" the existing features to the new feature or features.
3. We will adjust the abstraction layer once there are resources to tackle the necessary "backend" / Ops UI work.

Thoughts?

BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1497728

[chriskacerguis]

/cc @Loicavenel @gtanzillo @Fryguy @gmcculloug @dclarizio @AllenBW

[dclarizio]

So, I'd like to propose the following:

1. As we build out the new UX we "attach" a new "feature" to each and everything.

We can (and do) do this in existing RBAC, unless I don't fully understand.

2. We will build an abstraction layer which will "translate" the existing features to the new feature or features.

This is because we want to try to keep using the OPS service features for SUI?

3. We will adjust the abstraction layer once there are resources to tackle the necessary "backend" / Ops UI work.

Not sure what backend/OPS UI work you mean, adding the RBAC features? Because that's quite simple actually.

Another proposal . . . how about we simply make a Service UI section in the existing RBAC that more closely matches the features required there. If/when we remove the Service section from the OPS UI, we simply remove the old service related RBAC features.

[chriskacerguis]

We can (and do) do this in existing RBAC, unless I don't fully understand.

So, what I mean is brand new feature "names" not trying to sledgehammer existing ones.

This is because we want to try to keep using the OPS service features for SUI?

I didn't want to create work that cannot be done this release for other teams.

Not sure what backend/OPS UI work you mean, adding the RBAC features? Because that's quite simple actually.

Yes, I wasn't sure how to add new features.

how about we simply make a Service UI section in the existing RBAC that more closely matches the features required there

That's what I would like to do in the long run, the abstraction layer was how do we get from where we are at today to a new set of features without creating lots of work outside the team.

[AllenBW]

Yes please to a UI/Service section in existing RBAC. This'll save the "guessing which feature does what in the service ui" for admins everywhere also make gating functionality easier for the devs (no more trying to map functionality against in place permissions). As in intermediary, an abstraction layer that maybe "bulk" maps functionality makes sense. Ultimately, who do we gotta see about gettin' some of of those product feature sections (or zones? not sure what the sub collections are called).

[dclarizio]

@AllenBW as long as we follow the pattern with the low level grouping, like having the View/Operate/Modify sub-trees so the admins can easily turn on sets of features, I see no reason not to add a new top level section called "Service UI" (feature ID sui). Perhaps all sub features below that will be sui_*. If we can map them all out, we can add them prior to adding the checks, since no one will be using them.

Let's get some feedback/buy in from PM . . . @Loicavenel @bascar @jonnyfiveiq

[jonnyfiveiq]

absolutely the ServiceUI should be in RBAC, and this should be configured in the RBAC control in the OpsUI. thanks

On 22 Aug 2017, at 16:04, Dan Clarizio ***@***.***> wrote: @AllenBW <https://github.com/allenbw> as long as we follow the pattern with the low level grouping, like having the View/Operate/Modify sub-trees so the admins can easily turn on sets of features, I see no reason not to add a new top level section called "Service UI" (feature ID sui). Perhaps all sub features below that will be sui_*. If we can map them all out, we can add them prior to adding the checks, since no one will be using them. Let's get some feedback/buy in from PM . . . @Loicavenel <https://github.com/loicavenel> @bascar <https://github.com/bascar> @jonnyfiveiq <https://github.com/jonnyfiveiq> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#882 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AB_NPexwlsXA41iVdz2FKrcBHwwM8Vyfks5sazREgaJpZM4O-57s>.

Many Thanks, JOHN HARDY CLOUDFORMS SENIOR PRINCIPAL PRODUCT MANAGER Red Hat [email protected] M: +44-(0)7770-676866 www.cloudformsnow.com <http://www.cloudformsnow.com/> TRIED. TESTED. TRUSTED.

[Loicavenel]

Here is a write-up on the subject.. https://docs.google.com/document/d/10p69nnTT7dG0hnCBCJkcapjlxVd08J0A2QRX054B_08/edit

[chriskacerguis]

@dclarizio or @martinpovolny or @himdel how do we add a new role / product feature?

/cc @chalettu @Loicavenel

[Loicavenel]

@chriskacerguis there are 2 things here, is to update Roles with SUI features like described here: https://docs.google.com/document/d/10p69nnTT7dG0hnCBCJkcapjlxVd08J0A2QRX054B_08/edit
And then or we create a new out-of-the-box Group + Role just for SUI or we update existing one

[dclarizio]

@chriskacerguis
Hey, we just went through this for the API section!

You gotta do this:
ManageIQ/manageiq#16021

and this:
ManageIQ/manageiq-ui-classic#2230

Let me or @h-kataria know if you need any assistance

[chriskacerguis]

Thanks @dclarizio

[chriskacerguis]

@chalettu so let's start with adding a "Self Service" top level, then for right now add the following:

• Show Help Menu
• Show UI Switcher

[Loicavenel]

@chriskacerguis Great..

[chalettu]

PR For ManageIQ repo.
ManageIQ/manageiq#16068

[chalettu]

PR for classic-ui modifications. ManageIQ/manageiq-ui-classic#2260

[chalettu]

Screen shot of new feature tree.

[Loicavenel]

@chriskacerguis For Help Menu, this was already for OPS UI.. We should use the same place.

[chriskacerguis]

So in talking with @chalettu we need to rework the RBAC module in the SUI.

@chalettu Wondering if we should make the RBAC module an NPM lib? Thoughts?

[chalettu]

@chriskacerguis , should we close this since we now have the ability implemented where we can have RBAC permissions defined for SUI?

[chriskacerguis]

@chalettu yeah, I was going to leave it open to rework the whole thing, but I think we should make a new issue.