search

AdaptiveScale / lxdui

LXDUI is a web UI for the native Linux container technology LXD/LXC
Apache License 2.0
730 stars 155 forks source link

Question: Users with rights to control only certain containers? #142

Closed wexi79 closed 6 years ago

wexi79 commented 6 years ago

Hello,

is it possible to define which containers a user added to the web UI can control? For example so that the user admin has full control of all containers, user A only sees and can control containerA, user B can see and control containerB1 and cotainerB2 and so on...

vhajdari commented 6 years ago

LXD doesn't have an authorization mechanism as of yet, so at the moment you can do anything LXD allows you to, and this will continue to be the case as long as LXC (CLI) is used.

Role based access controls (RBAC) are on the roadmap and will include selectible authentication providers which will allow you to control access through the UI.

But keep in mind that if the user has access to the host where they can use LXC they'll be able to control the containers directly, thus bypassing the RBAC of the UI. For RBAC you'll have to use the UI and limit access to the host and which uses have access to the LXC command.

On Tue, May 22, 2018, 11:32 PM wexi79 notifications@github.com wrote:

Hello,

is it possible to define which containers a user added to the web UI can control? For example so that the user admin has full control of all containers, user A only sees and can control containerA, user B can see and control containerB1 and cotainerB2 and so on...

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/AdaptiveScale/lxdui/issues/142, or mute the thread https://github.com/notifications/unsubscribe-auth/AK7rQ0VK2QdX4Zj5ttyH7-5vu2tdGPm5ks5t1QKagaJpZM4UJ2H1 .

wexi79 commented 6 years ago

Thank you for the quick answer. In our setup the users that need to control only certain containers would not have shell access to the host so RBAC would do trick. We'll just have to wait then =)