Include/Exclude option in "Set API host access to resources" page

Plural

Hi Marcin,

In Security->API hosts->Set access we can choose the job resources we want the user to access. If any new resource is created, we need to come here to reconfigure this access list. A use case for this is a user that is responsible for restoring files related with projects. There are other jobs related with departments, but they are more or less static. Every time a new project backup job is created, it's necessary to re-configure the list.
If we have an option to choose when the selected jobs are to be included or excluded from the ACL, the administrator just needs to choose the jobs excluded from the ACL, in this case the department related jobs. That way, all new project jobs are automatically included in the ACL, so no need for re-configuration.

Best regards,
Rui

gani

Hi Rui,

Thanks for describing this idea.

Yes, this can be useful function, I think. The only technical problem I see for now is that this Set access function creates the Bacula Console ACLs that does not support excludes. I mean that Bacula ACLs require defining Bacula resources that will be used, not resources that will not be used.

We will check how it could be solved.

Thanks.

Best regards,
Marcin Haba (gani)

Plural

HI Marcin,

For the exclude option, I think you can reverse the selected jobs in the code and write the reverse as alowed resources in the ACLs.
When reading the ACLs to display in the list you just need to read the flag and reverse them again.

What do you thing?

Best regards,
Rui

gani

Hi Rui,

Thanks for explaining it. I am not sure if I understand it well. To see it clearer I have two questions for that:

1) what do you mean by automatically included in the ACL? When does it happen? Bacularis does not save Bacula ACL configuration automatically without any action.

2) write the reverse as allowed resources in the ACLs - If I save excluded resources in ACLs, then they will be included, not excluded as in this example below:

I have three jobs: AAA, BBB and CCC. I want to include BBB so I save in the ACLs excluded AAA and CCC:

Console {
   Name = "XYZ"
   JobAcl = "AAA"
   JobAcl = "CCC"
   ...
   ....etc.
}

If user account will use this Console ACLs, this user will have access to AAA and CCC instead to BBB. I can reverse this list to display BBB on the web interface, but it does not change that included are AAA and CCC instead BBB. Bacularis uses Console ACLs not only to store configuration, but it uses these Bacula ACLs function in practice to limit resources on the Bacula level.

Thanks in advance for answering and help.

Best regards,
Marcin Haba (gani)

Plural

Hi Marvin,

1) what do you mean by automatically included in the ACL? When does it happen? Bacularis does not save Bacula ACL configuration automatically without any action.

You are right. Can that be done when the job resource is created? Because in this case we want all the jobs besides the excluded ones to be added to the ACLs.

gani 2) write the reverse as allowed resources in the ACLs - If I save excluded resources in ACLs, then they will be included, not excluded as in this example below:

In the PHP code you need to read AAA, BBB and CCC as a list, compare then with the excluded ones (in your example AAA and CCC) and keep the remaining ones (in your example BBB) in a list. Then you write that list to ACLs.

So, what I propose is a feature that uses the Bacularis PHP code to invert the excluded resources to included ones and write them as ACLs.

Best regards,
Rui

gani

Hi Rui,

OK, thanks for answers.

Plural You are right. Can that be done when the job resource is created? Because in this case we want all the jobs besides the excluded ones to be added to the ACLs.

Yes, this seems to be a good place for that. We need some time to consider this function. In any case I see this need for adding new jobs to Console ACLs.

Plural In the PHP code you need to read AAA, BBB and CCC as a list, compare then with the excluded ones (in your example AAA and CCC) and keep the remaining ones (in your example BBB) in a list. Then you write that list to ACLs.

OK. Originally I understood you that you propose to save the exclude list to Console ACLs and it caused my wrong understanding. So, the idea is about saving the exclude list somewhere (outside ACLs).

Also for me this can be useful function. I will let know here if anything move in this topic from our side.

Thanks.

Best regards,
Marcin Haba (gani)

Plural

Hi Marcin,

gani So, the idea is about saving the exclude list somewhere (outside ACLs).

Correct me if I'm wrong. The exclude list always consists of resources that are NOT saved as ACLs in the Console. If you can read and list all resources, the excluded ones are those that do not have JobAcl configured in the Console resource.

For example, if you have the following Console resource:

Console {
   Name = "XYZ"
   JobAcl = "BBB"
   ...
   ....etc.
}

And you have Job resources "AAA","BBB" and "CCC".
In PHP code you create two lists (arrays) and you get both acls and jobs. I'm more a Python guy, but I go to try to give you an example in PHP. Let's say that you have a getAcls method that reads the acls for the specific API host, a getJobs method to read the Job resources and a boolean called "excluding" that represents the necessary flag.

$acls = getAcls("some_api_host"); // ["BBB"]
$jobs = getJobs(); // ["AAA","BBB","CCC"]

if (excluding) {
  $excludes = array_diff($acls,$jobs); // ["AAA","CCC"] use this to select the values in the list
else {
  // Perform the normal selection of included items, i.e., the ACLs array.
}

By doing this, you don’t need to save the excluded items anywhere, because they are the difference between all job resources and the JobACL resources.

Best regards,
Rui

gani

Hi Rui,

Thanks for your example and answer. It looks to be easy with this type of excluding. In my opinion it can be a good example for a single application which manages local configuration. I was thinking a bit about it and below you can find my thoughts.

In Bacularis, that is a network solution, regardless if Bacula configuration is local or remote, the communication goes through the API hosts. In the resource access matter this approach means that if we want to know to what jobs API host "AAA" is allowed, we ask this "AAA" host for that and "AAA" answers.

Now, remembering about it, when we look at these two lines:

$acls = getAcls("some_api_host"); // ["BBB"]
$jobs = getJobs(); // ["AAA","BBB","CCC"]

this is a place where we need two requests using two different API hosts:

getAcls("some_api_host") uses API host some_api_host
getJobs() uses the current administrative communication API host that user use

I have two worrying about it:

if we have more hosts to update the access, it would mean iterating over API hosts for sending requests. In Bacularis we don't use this type of iterating.
if the criteria to update access with excludes in host is the exclude flag and user will set this flag on API hosts which work with different Directors, it can cause that jobs from main host ($jobs) may not exists on these hosts. The same rule is for all hosts - if we want to know what resources this host have, we need to call it and ask it. We don't know what are resources on API host in advance.

I am still thinking about this idea and for now I am not seeing other ways than giving user a choice what API host settings he would like to update and what jobs to exclude (it can be a regular expression or static names).

Summing up, I don't see problem with your example, but I am seeing an implementation problem with fitting it to Bacularis.

What do you thing about it?

Best regards,
Marcin Haba (gani)

Plural

Hi Marcin,

Yes, you are right. I didn’t express myself very well. Consider this instead:

  $acls = getAcls("XYZ"); // ["BBB"]

Here, you retrieve the ACLs for the Console resource named 'XYZ'.

To configure the ACLs, you can follow the same approach, implementing this approach in the setJobResourceAccess method within the Security.php module. You'll need to create an array of job names by iterating through $result->output.

Best regards,

gani

Hi Rui,

Thanks for your response and analysis. I see that you came to the interesting point of the Bacularis algorithms :-)

In this line:

$acls = getAcls("XYZ"); // ["BBB"]

the web interface does not know XYZ because the web interface does not store the Console name related to API host. The ACLs are realized by Bacula, so to get allowed jobs the web interface needs to ask the API host for allowed jobs:

$jobs = getJobs('some_restricted_host'); // ["BBB"]

In the setJobResourceAccess() in Security.php we can see the ACLs setting where ACLs are not edited but each time prepared from scratch. The name is not here known either, we just send the newly prepared config to API host and on the API side this is saved and assigned to the API user account. Setting ACLs is fine because this way the ACLs are configured, but to get the ACLs they need to be processed and returned by Bacula. Bacula has the algorithm to process them.

The API hosts are the crucial for working with Bacula configuration. This Bacularis part is designed in this way to let users work with Bacula resources without any direct relation between Bacularis users and Bacula resources. User just need to log in and all the "magic" with allowed resources is done behind the scene on the API side.

Best regards,
Marcin Haba (gani)

Plural

HI Marcin,

I understand that the API acts as a proxy for the Bacula resources.
To populate the "API host jobs" list in the web interface, I think you do the following:

Get the API login used by the API host from /etc/bacularis/Web/hosts.conf
Get the dedicated bconsole config file for that API login with API call /api/v3/basic/users/{username} key bconsole_cfg_path
Get the Console resource name from the dedicated bconsole config file
Get the Console resource with the API call /api/v3/config/dir/Console/{resource_name} and the JobAcl key

To get the initial jobs list, you call /api/v3/config/dir/Job.

I'm rigth?

Best regards,
Rui

gani

Hi Rui,

I am afraid that this procedura is not possible to do. To populate the API host jobs we need to send request to API with a question something like: "What jobs do you share?" and the API host will respond.

The bconsole_cfg_path on the API side is very important because for each user request this file is used with restricted Bconsole where ACLs are applied by Bacula:

bconsole -c /path/to/restricted/bconsole.conf

This is dedicated Bconsole file used for all the user requests to API hosts. API does not analyze bconsole_cfg_path and it should not do it, the same as it should not provide interface to read it.

Best regards,
Marcin Haba (gani)

Plural

HI Marcin,

Thank you for clarifying that.

Best regards,
Rui