Add OS-ENDPOINT-POLICY extension

Identity v3 extension

Change-Id: Ib800c513ca4668bdda9662b91a698d5209e315e6
Closes-Bug: #1532218
This commit is contained in:
Diane Fleming
2016-01-17 18:30:52 -06:00
parent ed3adf1b11
commit 0529661bc2
8 changed files with 488 additions and 22 deletions

View File

@@ -18,33 +18,111 @@
<itemizedlist role="compact">
<listitem>
<para>
<link xlink:href="http://developer.openstack.org/api-ref-identity-v3-ext.html#identity_v3_OS-INHERIT-ext">
OS-INHERIT extension (OS-INHERIT)
</link>
</para>
</listitem>
<listitem>
<link xlink:href="http://developer.openstack.org/api-ref-identity-v3-ext.html#identity_v3_OS-ENDPOINT-POLICY-ext">
OS-ENDPOINT-POLICY extension (OS-ENDPOINT-POLICY)
</link>
</para>
</listitem>
<listitem>
<para>
<link xlink:href="http://developer.openstack.org/api-ref-identity-v3-ext.html#identity_v3_OS-INHERIT-ext">
OS-INHERIT extension (OS-INHERIT)
</link>
</para>
</listitem>
<listitem>
<para>
<link xlink:href="http://developer.openstack.org/api-ref-identity-v3-ext.html#identity_v3_OS-KDS-ext">
Key Distribution Server (KDS) extension (OS-KDS)
</link>
</para>
</listitem>
<listitem>
<para>
<link xlink:href="http://developer.openstack.org/api-ref-identity-v3-ext.html#identity_v3_OS-KDS-ext">
Key Distribution Server (KDS) extension (OS-KDS)
</link>
</para>
</listitem>
<listitem>
<para>
<link xlink:href="http://developer.openstack.org/api-ref-identity-v3-ext.html#identity_v3_OS-OAUTH1-ext">
OAuth extension (OS-OAUTH1)
</link>
</para>
</para>
</listitem>
<listitem>
<para>
<para>
<link xlink:href="http://developer.openstack.org/api-ref-identity-v3-ext.html#identity_v3_OS-TRUST-ext">
Trust extension (OS-TRUST)
</link>
</para>
</listitem>
</itemizedlist>
</para>
</listitem>
</itemizedlist>
<section xml:id="identity_v3_OS-ENDPOINT-POLICY-ext">
<title>OS-ENDPOINT-POLICY extension (OS-ENDPOINT-POLICY)</title>
<para>
Creates, verifies, and deletes associations between service
endpoints and policies. Such associations enable an endpoint to
request its policy.
</para>
<para>
To create, check, or delete an association, you reference a policy by its ID in
the Identity server.
</para>
<para>
The extension supports these associations:
</para>
<orderedlist>
<listitem>
<para>
A policy and endpoint association.
</para>
</listitem>
<listitem>
<para>
A policy and service-type endpoint in a region association.
</para>
</listitem>
<listitem>
<para>
A policy and service-type endpoint association.
</para>
</listitem>
</orderedlist>
<para>
This order reflects policies in their most to least-specific order.
</para>
<para>
When an endpoint requests the appropriate policy for itself, the
extension finds the policy by traversing the ordered sequence of
methods of association. The extension shows the policy for the
first association that it finds.
</para>
<para>
If the region of the endpoint has a parent, the extension examines
the region associations up the region tree in ascending order. For
region associations, the extension examines any parent regions in
ascending order. The extension does not combine polices.
</para>
<wadl:resources xmlns:wadl="http://wadl.dev.java.net/2009/02">
<wadl:resource href="../wadls/identity-api/src/v3/wadl/OS-ENDPOINT-POLICY-v3.wadl#endpoints">
<wadl:method href="#listPolicyEndpointAssociations"/>
</wadl:resource>
<wadl:resource href="../wadls/identity-api/src/v3/wadl/OS-ENDPOINT-POLICY-v3.wadl#policy">
<wadl:method href="#showPolicyForEndpoint"/>
<wadl:method href="#checkPolicyForEndpoint"/>
</wadl:resource>
<wadl:resource href="../wadls/identity-api/src/v3/wadl/OS-ENDPOINT-POLICY-v3.wadl#endpoint_id">
<wadl:method href="#associatePolicyAndEndpoint"/>
<wadl:method href="#getPolicyAndEndpointAssociation"/>
<wadl:method href="#deletePolicyAndEndpointAssociation"/>
</wadl:resource>
<wadl:resource href="../wadls/identity-api/src/v3/wadl/OS-ENDPOINT-POLICY-v3.wadl#region_id">
<wadl:method href="#associatePolicyAndServiceRegion"/>
<wadl:method href="#getPolicyAndServiceRegionAssociation"/>
<wadl:method href="#deletePolicyAndServiceRegionAssociation"/>
</wadl:resource>
<wadl:resource href="../wadls/identity-api/src/v3/wadl/OS-ENDPOINT-POLICY-v3.wadl#service_id">
<wadl:method href="#associatePolicyAndService"/>
<wadl:method href="#getPolicyAndServiceAssociation"/>
<wadl:method href="#deletePolicyAndServiceAssociation"/>
</wadl:resource>
</wadl:resources>
</section>
<section xml:id="identity_v3_OS-INHERIT-ext">
<title>OS-INHERIT extension (OS-INHERIT)</title>
<para>
@@ -382,3 +460,4 @@ Trust extension (OS-TRUST)
</wadl:resources>
</section>
</chapter>

View File

@@ -1411,6 +1411,36 @@
</para>
</wadl:doc>
</param>'>
<!ENTITY endpoint-nextResponseParameter '
<param name="next" style="plain" type="xsd:string"
xmlns="http://wadl.dev.java.net/2009/02" required="false">
<wadl:doc xmlns:wadl="http://wadl.dev.java.net/2009/02"
xmlns="http://docbook.org/ns/docbook" xml:lang="EN">
<para>
The <code>next</code> relative link for the <code>endpoint</code> resource.
</para>
</wadl:doc>
</param>'>
<!ENTITY endpoint-previousResponseParameter '
<param name="previous" style="plain" type="xsd:string"
xmlns="http://wadl.dev.java.net/2009/02" required="false">
<wadl:doc xmlns:wadl="http://wadl.dev.java.net/2009/02"
xmlns="http://docbook.org/ns/docbook" xml:lang="EN">
<para>
The <code>previous</code> relative link for the <code>endpoint</code> resource.
</para>
</wadl:doc>
</param>'>
<!ENTITY endpoint-selfResponseParameter '
<param name="self" style="plain" type="xsd:string"
xmlns="http://wadl.dev.java.net/2009/02" required="false">
<wadl:doc xmlns:wadl="http://wadl.dev.java.net/2009/02"
xmlns="http://docbook.org/ns/docbook" xml:lang="EN">
<para>
The <code>self</code> relative link for the <code>endpoint</code> resource.
</para>
</wadl:doc>
</param>'>
<!ENTITY endpoints-linksResponseParameter '
<param name="links" style="plain" type="xsd:dict"
xmlns="http://wadl.dev.java.net/2009/02" required="true">
@@ -1421,6 +1451,36 @@
</para>
</wadl:doc>
</param>'>
<!ENTITY endpoints-nextResponseParameter '
<param name="next" style="plain" type="xsd:string"
xmlns="http://wadl.dev.java.net/2009/02" required="true">
<wadl:doc xmlns:wadl="http://wadl.dev.java.net/2009/02"
xmlns="http://docbook.org/ns/docbook" xml:lang="EN">
<para>
The <code>next</code> relative link for the <code>endpoints</code> resource.
</para>
</wadl:doc>
</param>'>
<!ENTITY endpoints-previousResponseParameter '
<param name="previous" style="plain" type="xsd:string"
xmlns="http://wadl.dev.java.net/2009/02" required="true">
<wadl:doc xmlns:wadl="http://wadl.dev.java.net/2009/02"
xmlns="http://docbook.org/ns/docbook" xml:lang="EN">
<para>
The <code>previous</code> relative link for the <code>endpoints</code> resource.
</para>
</wadl:doc>
</param>'>
<!ENTITY endpoints-selfResponseParameter '
<param name="self" style="plain" type="xsd:string"
xmlns="http://wadl.dev.java.net/2009/02" required="true">
<wadl:doc xmlns:wadl="http://wadl.dev.java.net/2009/02"
xmlns="http://docbook.org/ns/docbook" xml:lang="EN">
<para>
The <code>self</code> relative link for the <code>endpoints</code> resource.
</para>
</wadl:doc>
</param>'>
<!ENTITY endpoint-nameResponseParameter '
<param name="name" style="plain" required="true"
type="xsd:string" xmlns="http://wadl.dev.java.net/2009/02">
@@ -1754,6 +1814,16 @@
<!-- ************************************ -->
<!-- POLICY RESPONSE PARAMETERS -->
<!-- ************************************ -->
<!ENTITY policy-blobResponseParameter '
<param name="blob" style="plain" type="xsd:string"
xmlns="http://wadl.dev.java.net/2009/02" required="true">
<wadl:doc xmlns:wadl="http://wadl.dev.java.net/2009/02"
xmlns="http://docbook.org/ns/docbook" xml:lang="EN">
<para>
The policy rule set itself, as a serialized blob.
</para>
</wadl:doc>
</param>'>
<!ENTITY policy-idResponseParameter '
<param name="id" style="plain" type="xsd:string"
xmlns="http://wadl.dev.java.net/2009/02" required="true">
@@ -1815,6 +1885,22 @@
</para>
</wadl:doc>
</param>'>
<!ENTITY policy-typeResponseParameter '
<param name="type" style="plain" type="xsd:string"
xmlns="http://wadl.dev.java.net/2009/02" required="true">
<wadl:doc xmlns:wadl="http://wadl.dev.java.net/2009/02"
xmlns="http://docbook.org/ns/docbook" xml:lang="EN">
<para>
The MIME media type of the serialized policy blob. From the
perspective of the Identity API, a policy blob can be based on any
technology. In OpenStack, the <code>policy.json</code> blob
(<code>type="application/json"</code>) is the conventional
solution. However, you might want to use an alternative policy
engine that uses a different policy language type. For example,
<code>type="application/xacml+xml"</code>.
</para>
</wadl:doc>
</param>'>
<!ENTITY policy-user_idResponseParameter '
<param name="user_id" style="plain" type="xsd:string"
xmlns="http://wadl.dev.java.net/2009/02" required="true">

View File

@@ -0,0 +1,29 @@
{
"endpoints": [
{
"id": "1",
"interface": "public",
"links": {
"self": "http://identity:35357/v3/endpoints/1"
},
"region": "north",
"service_id": "9242e05f0c23467bbd1cf1f7a6e5e596",
"url": "http://identity:35357/"
},
{
"id": "1",
"interface": "internal",
"links": {
"self": "http://identity:35357/v3/endpoints/1"
},
"region": "south",
"service_id": "9242e05f0c23467bbd1cf1f7a6e5e596",
"url": "http://identity:35357/"
}
],
"links": {
"next": null,
"previous": null,
"self": "http://identity:35357/v3/OS-ENDPOINT-POLICY/policies/13c92821e4c4476a878d3aae7444f52f/endpoints"
}
}

View File

@@ -0,0 +1,14 @@
{
"policy": {
"blob": {
"foobar_user": [
"role:compute-user"
]
},
"id": "13c92821e4c4476a878d3aae7444f52f",
"links": {
"self": "http://identity:35357/v3/policies/13c92821e4c4476a878d3aae7444f52f"
},
"type": "application/json"
}
}

View File

@@ -0,0 +1,258 @@
<?xml version="1.0" encoding="UTF-8"?>
<!-- (C) 2015-2016 OpenStack Foundation, All Rights Reserved -->
<!--*******************************************************-->
<!-- Import Common XML Entities -->
<!-- -->
<!-- You can resolve the entities with xmllint -->
<!-- -->
<!-- xmllint -noent OS-OS-ENDPOINT-POLICY-v3.wadl -->
<!--*******************************************************-->
<!DOCTYPE application [
<!ENTITY % common SYSTEM "../common.ent">
%common;
<!ENTITY % common_project SYSTEM "../../../../common_project.ent">
%common_project;
]>
<application xmlns="http://wadl.dev.java.net/2009/02"
xmlns:wadl="http://wadl.dev.java.net/2009/02"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:identity="http://docs.openstack.org/identity/api/v3"
xmlns:capi="http://docs.openstack.org/common/api/v1.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:db="http://docbook.org/ns/docbook"
xmlns:csapi="http://docs.openstack.org/identity/api/v3"
xmlns:xsdxt="http://docs.rackspacecloud.com/xsd-ext/v1.0"
xsi:schemaLocation="http://docs.openstack.org/identity/api/v3 ../xsd/api.xsd
http://docs.openstack.org/common/api/v1.0 ../xsd/api-common.xsd
http://wadl.dev.java.net/2009/02 http://www.w3.org/Submission/wadl/wadl.xsd">
<grammars>
<include href="../xsd/api.xsd"/>
<include href="../xsd/api-common.xsd"/>
</grammars>
<!--*******************************************************-->
<!-- All Resources -->
<!--*******************************************************-->
<resources base="http://localhost:5000" xml:id="OS-OS-ENDPOINT-POLICY-v3">
<resource id="versions-inherit-v3" path="//v3">
<resource id="policies" path="policies">
<resource id="policy_id" path="{policy_id}">
&policy_idTemplateParameter;
<resource id="OS-ENDPOINT-POLICY" path="OS-ENDPOINT-POLICY">
<resource id="endpoints" path="endpoints">
<method href="#listPolicyEndpointAssociations"/>
<resource id="endpoint_id" path="{endpoint_id}">
&endpoint_idTemplateParameter;
<method href="#associatePolicyAndEndpoint"/>
<method href="#getPolicyAndEndpointAssociation"/>
<method href="#deletePolicyAndEndpointAssociation"/>
</resource>
</resource>
<resource id="services" path="services">
<resource id="service_id" path="{service_id}">
&service_idTemplateParameter;
<method href="#associatePolicyAndService"/>
<method href="#getPolicyAndServiceAssociation"/>
<method href="#deletePolicyAndServiceAssociation"/>
</resource>
<resource id="regions" path="regions">
<resource id="region_id" path="{region_id}">
&region_idTemplateParameter;
<method href="#associatePolicyAndServiceRegion"/>
<method href="#getPolicyAndServiceRegionAssociation"/>
<method href="#deletePolicyAndServiceRegionAssociation"/>
</resource>
</resource>
</resource>
<resource id="policy" path="policy">
<method href="#showPolicyForEndpoint"/>
<method href="#checkPolicyForEndpoint"/>
</resource>
</resource>
</resource>
</resource>
</resource>
</resources>
<!--*******************************************************-->
<!-- All Methods -->
<!--*******************************************************-->
<method name="GET" id="listPolicyEndpointAssociations">
<wadl:doc xml:lang="EN" xmlns="http://docbook.org/ns/docbook"
title="List policy and service endpoint associations">
<para role="shortdesc">
Lists all the endpoints that are currently associated with a
policy through any of the association methods.
</para>
</wadl:doc>
<response status="200">
<representation mediaType="application/json">
<wadl:doc xmlns="http://docbook.org/ns/docbook" xml:lang="EN">
<xsdxt:code
href="../samples/OS-ENDPOINT-POLICY/policy-endpoint-associations-list-response.json"/>
</wadl:doc>
&endpointsObjectParameter;
&endpoint-idResponseParameter;
&endpoint-interfaceResponseParameter;
&endpoint-linksResponseParameter;
&endpoint-nextResponseParameter;
&endpoint-previousResponseParameter;
&endpoint-selfResponseParameter;
&endpoint-regionResponseParameter;
&endpoint-service_idResponseParameter;
&endpoint-urlResponseParameter;
&endpoints-linksResponseParameter;
&endpoints-nextResponseParameter;
&endpoints-previousResponseParameter;
&endpoints-selfResponseParameter;
</representation>
</response>
</method>
<method name="GET" id="showPolicyForEndpoint">
<wadl:doc xml:lang="EN" xmlns="http://docbook.org/ns/docbook"
title="Show policy for endpoint">
<para role="shortdesc">
Shows a policy for an endpoint.
</para>
<para>
The extension finds the policy by traversing the ordered
sequence of methods of association. The extension shows the
policy for the first association that it finds. If the region
of the endpoint has a parent, the extension examines the
region associations up the region tree in ascending order.
</para>
</wadl:doc>
<response status="200">
<representation mediaType="application/json">
<wadl:doc xmlns="http://docbook.org/ns/docbook" xml:lang="EN">
<xsdxt:code
href="../samples/OS-ENDPOINT-POLICY/policy-show-response.json"/>
</wadl:doc>
&policyObjectParameter;
&policy-blobResponseParameter;
&policy-idResponseParameter;
&policy-linksResponseParameter;
&policy-typeResponseParameter;
</representation>
</response>
</method>
<method name="HEAD" id="checkPolicyForEndpoint">
<wadl:doc xml:lang="EN" xmlns="http://docbook.org/ns/docbook"
title="Check policy and service endpoint association">
<para role="shortdesc">
Checks whether a policy is associated with an endpoint.
</para>
</wadl:doc>
<response status="200"/>
</method>
<!-- policy and endpoint associations -->
<method name="PUT" id="associatePolicyAndEndpoint">
<wadl:doc xml:lang="EN" xmlns="http://docbook.org/ns/docbook"
title="Associate policy and endpoint">
<para role="shortdesc">
Associates a policy and an endpoint.
</para>
<para>
If an association already exists between the endpoint and
another policy, this call replaces that association.
</para>
</wadl:doc>
<response status="204"/>
</method>
<method name="GET" id="getPolicyAndEndpointAssociation">
<wadl:doc xml:lang="EN" xmlns="http://docbook.org/ns/docbook"
title="Verify a policy and endpoint association">
<para role="shortdesc">
Verifies an association between a policy and an endpoint.
</para>
<para>
A &HEAD; version of this API is also supported.
</para>
</wadl:doc>
<response status="204"/>
</method>
<method name="DELETE" id="deletePolicyAndEndpointAssociation">
<wadl:doc xml:lang="EN" xmlns="http://docbook.org/ns/docbook"
title="Delete a policy and endpoint association">
<para role="shortdesc">
Deletes an association between a policy and an endpoint.
</para>
</wadl:doc>
<response status="204"/>
</method>
<!-- Policy and any endpoint of a given service type associations -->
<method name="PUT" id="associatePolicyAndService">
<wadl:doc xml:lang="EN" xmlns="http://docbook.org/ns/docbook"
title="Associate policy and service-type endpoint">
<para role="shortdesc">
Associates a policy and any endpoint of a service type.
</para>
<para>
If an association already exists between the endpoint of a
service type and another policy, this call replaces that
association.
</para>
</wadl:doc>
<response status="204"/>
</method>
<method name="GET" id="getPolicyAndServiceAssociation">
<wadl:doc xml:lang="EN" xmlns="http://docbook.org/ns/docbook"
title="Verify a policy and service-type endpoint association">
<para role="shortdesc">
Verifies an association between a policy and an endpoint of a
service type.
</para>
<para>
A &HEAD; version of this API is also supported.
</para>
</wadl:doc>
<response status="204"/>
</method>
<method name="DELETE" id="deletePolicyAndServiceAssociation">
<wadl:doc xml:lang="EN" xmlns="http://docbook.org/ns/docbook"
title="Delete a policy and service-type endpoint association">
<para role="shortdesc">
Deletes an association between a policy and an endpoint of a
service type.
</para>
</wadl:doc>
<response status="204"/>
</method>
<!-- Policy and endpoint of a service type in a region associations -->
<method name="PUT" id="associatePolicyAndServiceRegion">
<wadl:doc xml:lang="EN" xmlns="http://docbook.org/ns/docbook"
title="Associate policy and service-type endpoint in a region">
<para role="shortdesc">
Associates a policy and an endpoint of a service type in a region.
</para>
<para>
If an association already exists between the service in a
region and another policy, this call replaces that
association.
</para>
</wadl:doc>
<response status="204"/>
</method>
<method name="GET" id="getPolicyAndServiceRegionAssociation">
<wadl:doc xml:lang="EN" xmlns="http://docbook.org/ns/docbook"
title="Verify a policy and service-type endpoint in a region association">
<para role="shortdesc">
Verifies an association between a policy and service-type
endpoint in a region.
</para>
<para>
A &HEAD; version of this API is also supported.
</para>
</wadl:doc>
<response status="204"/>
</method>
<method name="DELETE" id="deletePolicyAndServiceRegionAssociation">
<wadl:doc xml:lang="EN" xmlns="http://docbook.org/ns/docbook"
title="Delete a policy and service-type endpoint in a region association">
<para role="shortdesc">
Deletes an association between a policy and service-type
endpoint in a region.
</para>
</wadl:doc>
<response status="204"/>
</method>
</application>

View File

@@ -5,7 +5,7 @@
<!-- -->
<!-- You can resolve the entities with xmllint -->
<!-- -->
<!-- xmllint -noent OS-INHERIT.wadl -->
<!-- xmllint -noent OS-INHERIT-v3.wadl -->
<!--*******************************************************-->
<!DOCTYPE application [
<!ENTITY % common SYSTEM "../common.ent">

View File

@@ -1,11 +1,11 @@
<?xml version="1.0" encoding="UTF-8"?>
<!-- (C) 2015-2016 OpenStack Foundation, All Rights Reserved -->
<!-- (C) 2015-2016 OpenStack Foundation, All Rights Reserved -->
<!--*******************************************************-->
<!-- Import Common XML Entities -->
<!-- -->
<!-- You can resolve the entities with xmllint -->
<!-- -->
<!-- xmllint -noent OS-INHERIT.wadl -->
<!-- xmllint -noent OS-KDS-v3 .wadl -->
<!--*******************************************************-->
<!DOCTYPE application [
<!ENTITY % common SYSTEM "../common.ent">

View File

@@ -5,7 +5,7 @@
<!-- -->
<!-- You can resolve the entities with xmllint -->
<!-- -->
<!-- xmllint -noent OS-OAUTH1.wadl -->
<!-- xmllint -noent OS-OAUTH1-v3.wadl -->
<!--*******************************************************-->
<!DOCTYPE application [
<!ENTITY % common SYSTEM "../common.ent">