Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

clarify separation of batch vs admin roles #4229

Merged
merged 3 commits into from
May 26, 2021
Merged

clarify separation of batch vs admin roles #4229

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9863712
clarify separation of batch vs admin roles
scottkurz May 20, 2021
f0718b9
Code review changes
scottkurz May 25, 2021
66ec18f
More code review fixes
scottkurz May 25, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 24 additions & 2 deletions modules/ROOT/pages/admin-center.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ image::ui_login.png[The Admin Center login screen,align="center"]

== Select tools from the Toolbox

After you log in to Admin Center, the browser displays the **Toolbox**, which contains tools such as the **Server Config** and **Explore** tools and a bookmark to link:https://openliberty.io[openliberty.io]. The following screen capture shows the Admin Center **Toolbox**:
After you log in to�Admin Center, the browser displays the **Toolbox**, which contains tools such as the **Server Config** and **Explore** tools and a bookmark to link:https://openliberty.io[openliberty.io]. The following screen capture shows the Admin Center **Toolbox**:

image::ui_toolbox.png[align="center"]

Expand Down Expand Up @@ -128,14 +128,36 @@ You can add more resource metrics to the **Monitor** view by selecting the **Edi
[#batch]
=== Manage Java batch jobs with the Java Batch tool

If you configure the feature:batchManagement[display=Batch Management] feature, you can access the **Java Batch** tool. With this tool, you can view the progress and status of your Java batch jobs, manage their instances, and view their log files. The following screen capture shows the **Java Batch** tool:
If you configure�the feature:batchManagement[display=Batch Management] feature, you can access the **Java Batch** tool. With this tool, you can view the progress and status of your Java batch jobs, manage their instances, and view their log files. The following screen capture shows the **Java Batch** tool:

image::ui_javaBatchTool.png[align="center"]

Each batch job has an **Actions** icon, which you can select to stop, restart, or purge the job, and a **View Logs** icon, which you can select to view the job logs. To view details and metrics for a batch job, hover over the **Batch Job Name** and select an option from the tooltip menu.

If batch jobs or job logs are on remote servers, link:/guides/cors.html[configure cross origin region sharing (CORS)] on each remote server. CORS enables Admin Center to request job information from remote servers.

The Batch Management feature requires custom authorization to view and manage batch jobs. To use the Java Batch tool, you must configure a `com.ibm.ws.batch` custom authorization role, in addition to the reader or administrator role that is required to access the Admin Center. The following server.xml example shows configuration for a user, `wanda`, who is granted the administrator management role and the batchAdmin custom authorization role:

[source,xml]
----
<administrator-role>
<user>wanda</user>
</administrator-role>

<authorization-roles id="com.ibm.ws.batch">
<security-role name="batchAdmin">
<user name="wanda"/>
</security-role>
</authorization-roles>
----
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also want to clarify- even a user in the reader role can edit batch jobs if they have the proper com.ibm.ws.batch auth? I thought that reader role gave you read-only access to the Admin center tools- is that not the case with Java Batch?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, this was exactly the nuance I was trying to illustrate. I think it makes sense to basically defer to batch's custom auth here but let me also tag @mbroz2 to clarify if this is truly the intended design.

Copy link
Member

@mbroz2 mbroz2 May 20, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reader-role is not an Admin Center concept, but rather a Liberty one (aka, it's applied to all (well almost all) APIs, including Admin Center ones, unless the API uses their own set of authorization, like batch).
I would expect a user to be be able to have the 'reader' role and the 'batchAdmin' role, allowing them to view all the tools in admin center, but also perform batch admin job operations in the java batch tool.... but that's only true if no other/non-java-batch APIs are called that would do anything other then a GET operation (except for the Admin Center user preferences API, which is allowed to do POST/PUT/DELETE for reader role). I'm guessing there aren't, but @kinueng or @k8vance88 could confirm. One way to test this would be to just run the Admin Center Java Batch FAT tests, and change the user's role from (what I'm guessing is) admin to reader.

Of course the cheapest route is to simply change the example to asign the batchadmin user to the admin role instead of the reader role :)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thx @mbroz2. Yeah, if we just want the sample snippet to help a single developer copy/paste working config we probably just want to use the admin role. I don't think you need 'admin' for anything purely batch related but it can be useful e.g. for ibm/api/validation.

I was trying to capture the angle "what is the minimum auth required?" for users trying to use the roles in a fine-grained manner.

Maybe a good compromise would be to show the sample snippet with admin role but mention in a sentence that you can use reader-role for batch operations.


With this configuration, the user has authorization to view and manage any configured Java batch jobs.

The `batchAdmin` role can also be combined with a more restrictive Liberty management role by assigning 'wanda' to `reader-role`. This combination still allows full access to the Java Batch tool but provides read-only access to other Admin Center resources.

However, if no custom batch authorization role is configured, even a user in the administrator management role cannot view or manage Java batch jobs. For more information, see https://www.ibm.com/docs/en/was-liberty/nd?topic=liberty-securing-batch-environment[Securing the Liberty batch environment].


[#openid]
=== Administer Open ID Connect Provider tasks with the OpenID Connect (OIDC) tools

Expand Down