rackerlabs/otter — pull request #434 by RackerWilliams (2013-10-18 16:36:31+00:00)
Title: Initial RBAC role annotations.

About the patch
=============

Started the process of setting rax:roles attributes -- these will be used by Repose to add RBAC capabilities to the API. You should complete the process and let the Repose team know when you're done.

How rax:roles works
================

```rax:roles``` is an attribute that can be added to a resource or a method. The attribute denotes what which roles have access to a resource or method. It can contain the name of one or more roles separated by whitespace. There is a special role named ```#all``` this means anyone can access the resource or method.

When added to a resource the role has access to that resource all of its methods and sub-resources.

Example:

````xml

````

Will give you:

Method	URI	admin	autoscale:admin	observer

GET	v1	X	X

GET	v1/foo	X	X	X

PUT	v1/bar	X	X

About Roles
==========

All products must support the Global Admin ( ```admin```) and Global Observer (```observer```) roles. A global admin has access to all API calls (but is bound to a single tenant). A global observer can read data, but cannot create, delete, or otherwise modify resources.

Aside from the global roles you must support the following product specific roles:

```autoscale:admin``` : like global ```admin``` but the privileged is specific to the auto scale api.
```autoscale:observer``` : like global ```observer``` but specific to only the auto scale api.
```autoscale:creator``` : may create auto scale resources, but not necessarily delete them
```autoscale:service-admin``` : this is an optional role, it should allow access to the API across tenants. Only users with the right to administrate the auto scale service should have these roles.

It's important that you make sure product specific roles get created in global auth.

What's Next
==========

We are still working on adding ```rax:roles``` capabilities in Repose. Once those capabilities are added you can use this WADL directly. In the interim, you can supply this WADL to the repose team and we'll use that to generate configs that will work with Repose today.