retspen/webvirtmgr — pull request #323 by daniviga (2014-05-28 12:44:47+00:00)
Title: Basic VMs access control

This PR is proof of concept of adding access control on VMs to webvirtmgr.

Use case:
- There are admin accounts which have full control (network, storage, hypervisor)
- You need to grant access to a specific non-admin user only for a set of virtual machines. These users can start, stop, modify and access the console of a VM. They cannot delete it, add new instances nor edit the hypervisor settings (i.e. add/remove storage and network pools)

How it is implemented:
- Enabling the Django admin interface
- Adding a Many-to-Many relation in the instance model between instance and users
- Adding an instance admin view

![screen shot 2014-05-28 at 14 41 14](https://cloud.githubusercontent.com/assets/1818657/3104305/67d2b746-e665-11e3-925f-7aa94c87f88c.png)

How it works
- The "Staff" (and superusers) users have full control on the installation
- Using the Django admin interface you can add new users. You have to leave the created user without the "Staff" flag
- In the Django interface, under the "Instances" view you can assign the newly created users to a specific VM

All the features and the VMs for which a normal user doesn't have permission are hidden in the interface. If the user tries to access them directly (for example using the URL) he will get a 403 response.

**As admin user**

![admin_user_login](https://cloud.githubusercontent.com/assets/1818657/3104321/96125d32-e665-11e3-8ed7-aafdbce3b739.png)

![admin_user](https://cloud.githubusercontent.com/assets/1818657/3104324/9a71541e-e665-11e3-8178-4f9ff5acebcd.png)

**As normal user**

![normal_user_login](https://cloud.githubusercontent.com/assets/1818657/3104308/758e1fa6-e665-11e3-9ba7-be17775f5788.png)

![normal_user](https://cloud.githubusercontent.com/assets/1818657/3104309/7704b570-e665-11e3-93a7-f480b8b6d445.png)

This is just a proof of concept (I'm not a developer), but it works. The users and acl management is very simple; but it can be expanded further and maybe moved from the Django admin interface to a custom view in the application.

Feel free to discard, merge or move the code to a custom branch.