2011-07-03 21:10:53 -07:00
|
|
|
# vim: tabstop=4 shiftwidth=4 softtabstop=4
|
|
|
|
|
2012-02-04 17:40:31 -06:00
|
|
|
# Copyright 2012 United States Government as represented by the
|
2011-07-03 21:10:53 -07:00
|
|
|
# Administrator of the National Aeronautics and Space Administration.
|
|
|
|
# All Rights Reserved.
|
|
|
|
#
|
2012-02-04 17:40:31 -06:00
|
|
|
# Copyright 2012 Nebula, Inc.
|
2011-07-03 21:10:53 -07:00
|
|
|
#
|
|
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
|
|
# not use this file except in compliance with the License. You may obtain
|
|
|
|
# a copy of the License at
|
|
|
|
#
|
|
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
#
|
|
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
|
|
# License for the specific language governing permissions and limitations
|
|
|
|
# under the License.
|
|
|
|
|
2011-01-12 13:43:31 -08:00
|
|
|
import logging
|
|
|
|
import os
|
|
|
|
import sys
|
2012-11-20 20:33:09 -08:00
|
|
|
import warnings
|
2011-01-12 13:43:31 -08:00
|
|
|
|
2012-08-05 12:52:21 -07:00
|
|
|
from openstack_dashboard import exceptions
|
|
|
|
|
2012-11-20 20:33:09 -08:00
|
|
|
warnings.formatwarning = lambda message, category, *args, **kwargs: \
|
|
|
|
'%s: %s' % (category.__name__, message)
|
|
|
|
|
2011-01-12 13:43:31 -08:00
|
|
|
ROOT_PATH = os.path.dirname(os.path.abspath(__file__))
|
2012-06-20 13:37:10 -07:00
|
|
|
BIN_DIR = os.path.abspath(os.path.join(ROOT_PATH, '..', 'bin'))
|
2011-01-12 13:43:31 -08:00
|
|
|
|
2012-01-04 14:46:40 -08:00
|
|
|
if ROOT_PATH not in sys.path:
|
|
|
|
sys.path.append(ROOT_PATH)
|
2011-01-12 13:43:31 -08:00
|
|
|
|
|
|
|
DEBUG = False
|
|
|
|
TEMPLATE_DEBUG = DEBUG
|
|
|
|
|
2012-04-13 21:46:04 -07:00
|
|
|
SITE_BRANDING = 'OpenStack Dashboard'
|
2011-01-12 13:43:31 -08:00
|
|
|
|
2012-06-20 00:05:08 +03:00
|
|
|
LOGIN_URL = '/auth/login/'
|
|
|
|
LOGOUT_URL = '/auth/logout/'
|
|
|
|
# LOGIN_REDIRECT_URL can be used as an alternative for
|
|
|
|
# HORIZON_CONFIG.user_home, if user_home is not set.
|
|
|
|
# Do not set it to '/home/', as this will cause circular redirect loop
|
2011-01-12 13:43:31 -08:00
|
|
|
LOGIN_REDIRECT_URL = '/'
|
|
|
|
|
2011-08-29 17:41:35 -07:00
|
|
|
MEDIA_ROOT = os.path.abspath(os.path.join(ROOT_PATH, '..', 'media'))
|
2011-01-12 13:43:31 -08:00
|
|
|
MEDIA_URL = '/media/'
|
2011-08-29 17:41:35 -07:00
|
|
|
STATIC_ROOT = os.path.abspath(os.path.join(ROOT_PATH, '..', 'static'))
|
|
|
|
STATIC_URL = '/static/'
|
2011-01-12 13:43:31 -08:00
|
|
|
|
2012-02-28 23:27:46 -08:00
|
|
|
ROOT_URLCONF = 'openstack_dashboard.urls'
|
|
|
|
|
|
|
|
HORIZON_CONFIG = {
|
2012-10-03 14:29:24 -07:00
|
|
|
'dashboards': ('project', 'admin', 'settings',),
|
|
|
|
'default_dashboard': 'project',
|
2012-10-04 15:43:40 -07:00
|
|
|
'user_home': 'openstack_dashboard.views.get_user_home',
|
2012-08-02 16:39:52 -07:00
|
|
|
'ajax_queue_limit': 10,
|
2013-03-06 16:21:12 -08:00
|
|
|
'auto_fade_alerts': {
|
|
|
|
'delay': 3000,
|
|
|
|
'fade_duration': 1500,
|
|
|
|
'types': ['alert-success', 'alert-info']
|
|
|
|
},
|
2012-08-05 12:52:21 -07:00
|
|
|
'help_url': "http://docs.openstack.org",
|
|
|
|
'exceptions': {'recoverable': exceptions.RECOVERABLE,
|
|
|
|
'not_found': exceptions.NOT_FOUND,
|
|
|
|
'unauthorized': exceptions.UNAUTHORIZED},
|
2012-02-28 23:27:46 -08:00
|
|
|
}
|
2011-01-12 13:43:31 -08:00
|
|
|
|
2013-01-29 04:35:18 -05:00
|
|
|
# Set to True to allow users to upload images to glance via Horizon server.
|
|
|
|
# When enabled, a file form field will appear on the create image form.
|
|
|
|
# See documentation for deployment considerations.
|
|
|
|
HORIZON_IMAGES_ALLOW_UPLOAD = True
|
|
|
|
|
2011-01-12 13:43:31 -08:00
|
|
|
MIDDLEWARE_CLASSES = (
|
|
|
|
'django.middleware.common.CommonMiddleware',
|
|
|
|
'django.middleware.csrf.CsrfViewMiddleware',
|
|
|
|
'django.contrib.sessions.middleware.SessionMiddleware',
|
2012-04-13 21:46:04 -07:00
|
|
|
'django.contrib.auth.middleware.AuthenticationMiddleware',
|
2011-01-12 13:43:31 -08:00
|
|
|
'django.contrib.messages.middleware.MessageMiddleware',
|
2011-10-31 11:31:05 -07:00
|
|
|
'horizon.middleware.HorizonMiddleware',
|
2011-01-12 13:43:31 -08:00
|
|
|
'django.middleware.doc.XViewMiddleware',
|
2011-06-03 14:23:25 +09:00
|
|
|
'django.middleware.locale.LocaleMiddleware',
|
2013-02-13 11:43:11 +02:00
|
|
|
'django.middleware.clickjacking.XFrameOptionsMiddleware',
|
2011-01-12 13:43:31 -08:00
|
|
|
)
|
|
|
|
|
|
|
|
TEMPLATE_CONTEXT_PROCESSORS = (
|
|
|
|
'django.core.context_processors.debug',
|
|
|
|
'django.core.context_processors.i18n',
|
|
|
|
'django.core.context_processors.request',
|
|
|
|
'django.core.context_processors.media',
|
2011-08-29 17:41:35 -07:00
|
|
|
'django.core.context_processors.static',
|
2011-01-12 13:43:31 -08:00
|
|
|
'django.contrib.messages.context_processors.messages',
|
2011-10-31 11:31:05 -07:00
|
|
|
'horizon.context_processors.horizon',
|
2012-10-04 15:43:40 -07:00
|
|
|
'openstack_dashboard.context_processors.openstack',
|
2011-01-12 13:43:31 -08:00
|
|
|
)
|
|
|
|
|
|
|
|
TEMPLATE_LOADERS = (
|
2011-12-22 19:01:46 -08:00
|
|
|
'django.template.loaders.filesystem.Loader',
|
2012-04-26 19:22:51 -07:00
|
|
|
'django.template.loaders.app_directories.Loader',
|
|
|
|
'horizon.loaders.TemplateLoader'
|
2011-01-12 13:43:31 -08:00
|
|
|
)
|
|
|
|
|
|
|
|
TEMPLATE_DIRS = (
|
|
|
|
os.path.join(ROOT_PATH, 'templates'),
|
|
|
|
)
|
|
|
|
|
2012-05-11 23:37:35 -07:00
|
|
|
STATICFILES_FINDERS = (
|
|
|
|
'compressor.finders.CompressorFinder',
|
|
|
|
'django.contrib.staticfiles.finders.AppDirectoriesFinder',
|
2011-08-29 17:41:35 -07:00
|
|
|
)
|
|
|
|
|
2012-06-20 13:37:10 -07:00
|
|
|
less_binary = os.path.join(BIN_DIR, 'less', 'lessc')
|
2012-05-11 23:37:35 -07:00
|
|
|
COMPRESS_PRECOMPILERS = (
|
|
|
|
('text/less', (less_binary + ' {infile} {outfile}')),
|
|
|
|
)
|
|
|
|
|
|
|
|
COMPRESS_CSS_FILTERS = (
|
|
|
|
'compressor.filters.css_default.CssAbsoluteFilter',
|
|
|
|
)
|
|
|
|
|
|
|
|
COMPRESS_ENABLED = True
|
|
|
|
COMPRESS_OUTPUT_DIR = 'dashboard'
|
|
|
|
COMPRESS_CSS_HASHING_METHOD = 'hash'
|
2012-06-11 14:20:32 -07:00
|
|
|
COMPRESS_PARSER = 'compressor.parser.HtmlParser'
|
2012-05-11 23:37:35 -07:00
|
|
|
|
2011-01-12 13:43:31 -08:00
|
|
|
INSTALLED_APPS = (
|
2012-02-28 23:27:46 -08:00
|
|
|
'openstack_dashboard',
|
2012-04-13 21:46:04 -07:00
|
|
|
'django.contrib.contenttypes',
|
|
|
|
'django.contrib.auth',
|
2011-01-12 13:43:31 -08:00
|
|
|
'django.contrib.sessions',
|
|
|
|
'django.contrib.messages',
|
2011-08-29 17:41:35 -07:00
|
|
|
'django.contrib.staticfiles',
|
2012-06-23 13:58:35 -07:00
|
|
|
'django.contrib.humanize',
|
2012-05-11 23:37:35 -07:00
|
|
|
'compressor',
|
2011-10-31 11:31:05 -07:00
|
|
|
'horizon',
|
2012-10-04 15:43:40 -07:00
|
|
|
'openstack_dashboard.dashboards.project',
|
|
|
|
'openstack_dashboard.dashboards.admin',
|
|
|
|
'openstack_dashboard.dashboards.settings',
|
2012-04-13 21:46:04 -07:00
|
|
|
'openstack_auth',
|
2011-01-12 13:43:31 -08:00
|
|
|
)
|
|
|
|
|
2012-04-13 21:46:04 -07:00
|
|
|
TEST_RUNNER = 'django_nose.NoseTestSuiteRunner'
|
|
|
|
AUTHENTICATION_BACKENDS = ('openstack_auth.backend.KeystoneBackend',)
|
2011-01-12 13:43:31 -08:00
|
|
|
MESSAGE_STORAGE = 'django.contrib.messages.storage.cookie.CookieStorage'
|
|
|
|
|
2012-04-11 14:04:08 -07:00
|
|
|
SESSION_ENGINE = 'django.contrib.sessions.backends.signed_cookies'
|
|
|
|
SESSION_COOKIE_HTTPONLY = True
|
2011-01-12 13:43:31 -08:00
|
|
|
SESSION_EXPIRE_AT_BROWSER_CLOSE = True
|
2012-04-11 14:04:08 -07:00
|
|
|
SESSION_COOKIE_SECURE = False
|
2013-06-20 12:52:37 +02:00
|
|
|
SESSION_TIMEOUT = 1800
|
2012-04-11 14:04:08 -07:00
|
|
|
|
2011-06-03 14:23:25 +09:00
|
|
|
gettext_noop = lambda s: s
|
|
|
|
LANGUAGES = (
|
2012-09-18 15:26:19 -07:00
|
|
|
('bg', gettext_noop('Bulgarian (Bulgaria)')),
|
|
|
|
('cs', gettext_noop('Czech')),
|
2011-06-03 14:23:25 +09:00
|
|
|
('en', gettext_noop('English')),
|
|
|
|
('es', gettext_noop('Spanish')),
|
|
|
|
('fr', gettext_noop('French')),
|
2012-09-18 15:26:19 -07:00
|
|
|
('it', gettext_noop('Italiano')),
|
2011-06-03 14:23:25 +09:00
|
|
|
('ja', gettext_noop('Japanese')),
|
2012-09-18 15:26:19 -07:00
|
|
|
('ko', gettext_noop('Korean (Korea)')),
|
|
|
|
('nl', gettext_noop('Dutch (Netherlands)')),
|
2011-10-07 14:59:48 +09:00
|
|
|
('pl', gettext_noop('Polish')),
|
2012-09-18 15:26:19 -07:00
|
|
|
('pt', gettext_noop('Portuguese')),
|
|
|
|
('pt-br', gettext_noop('Portuguese (Brazil)')),
|
2011-06-03 14:23:25 +09:00
|
|
|
('zh-cn', gettext_noop('Simplified Chinese')),
|
|
|
|
('zh-tw', gettext_noop('Traditional Chinese')),
|
|
|
|
)
|
|
|
|
LANGUAGE_CODE = 'en'
|
2011-06-02 15:23:09 +09:00
|
|
|
USE_I18N = True
|
2012-06-21 19:33:42 -07:00
|
|
|
USE_L10N = True
|
|
|
|
USE_TZ = True
|
2011-01-12 13:43:31 -08:00
|
|
|
|
2011-10-31 11:31:05 -07:00
|
|
|
OPENSTACK_KEYSTONE_DEFAULT_ROLE = 'Member'
|
|
|
|
|
2012-05-24 15:25:35 -07:00
|
|
|
DEFAULT_EXCEPTION_REPORTER_FILTER = 'horizon.exceptions.HorizonReporterFilter'
|
|
|
|
|
Adding RBAC policy system and checks for identity
Adding file based RBAC engine for Horizon using copies of nova and
keystone policy.json files
Policy engine builds on top of oslo incubator policy.py, fileutils
was also pulled from oslo incubator as a dependency of policy.py
When Horizon runs and a policy check is made, a path and mapping of
services to policy files is used to load the rules into the policy
engine. Each check is mapped to a service type and validated. This
extra level of mapping is required because the policy.json files
may each contain a 'default' rule or unqualified (no service name
include) rule. Additionally, maintaining separate policy.json
files per service will allow easier syncing with the service
projects.
The engine allows for compound 'and' checks at this time. E.g.,
the way the Create User action is written, multiple APIs are
called to read data (roles, projects) and more are required to
update data (grants, user).
Other workflows e.g., Edit Project, should have separate save
actions per step as they are unrelated. Only the applicable
policy checks to that step were added. The separating unrelated
steps saves will should be future work.
The underlying engine supports more rule types that are used in the
underlying policy.json files.
Policy checks were added for all actions on tables in the Identity
Panel only. And the service policy files imported are limited in
this commit to reduce scope of the change.
Additionally, changes were made to the base action class to add
support or setting policy rules and an overridable method for
determining the policy check target. This reduces the need for
redundant code in each action policy check.
Note, the benefit Horizon has is that the underlying APIs will
correct us if we get it wrong, so if a policy file is not found for
a particular service, permission is assumed and the actual API call
to the service will fail if the action isn't authorized for that user.
Finally, adding documentation regarding policy enforcement.
Implements: blueprint rbac
Change-Id: I4a4a71163186b973229a0461b165c16936bc10e5
2013-08-16 17:28:46 -06:00
|
|
|
POLICY_FILES_PATH = os.path.join(ROOT_PATH, "conf")
|
|
|
|
# Map of local copy of service policy files
|
|
|
|
POLICY_FILES = {
|
|
|
|
'identity': 'keystone_policy.json',
|
|
|
|
'compute': 'nova_policy.json'
|
|
|
|
}
|
|
|
|
|
2011-01-12 13:43:31 -08:00
|
|
|
try:
|
2013-07-24 16:27:01 +08:00
|
|
|
from local.local_settings import * # noqa
|
2012-02-28 23:27:46 -08:00
|
|
|
except ImportError:
|
|
|
|
logging.warning("No local_settings file found.")
|
2011-01-12 13:43:31 -08:00
|
|
|
|
Adding RBAC policy system and checks for identity
Adding file based RBAC engine for Horizon using copies of nova and
keystone policy.json files
Policy engine builds on top of oslo incubator policy.py, fileutils
was also pulled from oslo incubator as a dependency of policy.py
When Horizon runs and a policy check is made, a path and mapping of
services to policy files is used to load the rules into the policy
engine. Each check is mapped to a service type and validated. This
extra level of mapping is required because the policy.json files
may each contain a 'default' rule or unqualified (no service name
include) rule. Additionally, maintaining separate policy.json
files per service will allow easier syncing with the service
projects.
The engine allows for compound 'and' checks at this time. E.g.,
the way the Create User action is written, multiple APIs are
called to read data (roles, projects) and more are required to
update data (grants, user).
Other workflows e.g., Edit Project, should have separate save
actions per step as they are unrelated. Only the applicable
policy checks to that step were added. The separating unrelated
steps saves will should be future work.
The underlying engine supports more rule types that are used in the
underlying policy.json files.
Policy checks were added for all actions on tables in the Identity
Panel only. And the service policy files imported are limited in
this commit to reduce scope of the change.
Additionally, changes were made to the base action class to add
support or setting policy rules and an overridable method for
determining the policy check target. This reduces the need for
redundant code in each action policy check.
Note, the benefit Horizon has is that the underlying APIs will
correct us if we get it wrong, so if a policy file is not found for
a particular service, permission is assumed and the actual API call
to the service will fail if the action isn't authorized for that user.
Finally, adding documentation regarding policy enforcement.
Implements: blueprint rbac
Change-Id: I4a4a71163186b973229a0461b165c16936bc10e5
2013-08-16 17:28:46 -06:00
|
|
|
from openstack_dashboard import policy
|
|
|
|
POLICY_CHECK_FUNCTION = policy.check
|
|
|
|
|
2013-01-16 13:39:01 +01:00
|
|
|
# Add HORIZON_CONFIG to the context information for offline compression
|
|
|
|
COMPRESS_OFFLINE_CONTEXT = {
|
|
|
|
'STATIC_URL': STATIC_URL,
|
|
|
|
'HORIZON_CONFIG': HORIZON_CONFIG
|
|
|
|
}
|
2012-11-20 20:33:09 -08:00
|
|
|
|
2013-02-05 16:04:10 -08:00
|
|
|
if DEBUG:
|
|
|
|
logging.basicConfig(level=logging.DEBUG)
|