Re: [Hawkular-dev] Inventory authz workflows in Hawkular SaaS

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 05/12/2015 01:14 AM, Lukas Krejci wrote: Correct. If the name is not appropriate, I'm accepting suggestions :-) I assume you mean a tenant on the inventory side. Same as above. But correct, if you mean "tenant" on the inventory side. On the F2F, we agreed on removing this capability from the UI on a first step, to avoid unnecessary complexity. I'd suggest to also not support such scenario *now* on inventory. Let's see where it leads us and refactor appropriately once we have this actual need, instead of spending a lot of time implementing a feature that would benefit only a limited number of cases. If I understand this flow correctly, you mean that an existing user account is added to an existing organization, which is owned by a third user. If so, your assumption is then incorrect. Case: jdoe creates an org called "Acme, Inc" and invites user jsmith to the organization. During this invitation process, jdoe assigns the role "Monitor" to jsmith. Invalid, as we are removing sub-orgs. Sort of. This is done by the component, using Account's API. Basically, you have to tell accounts what are your operations and which roles are allowed for each operation. More details here: https://github.com/hawkular/hawkular-accounts#operations-and-roles Sample code: http://git.io/vUzub *How* you implement this is up to you, but I'd suggest to do it as a ServletContextListener , so that we can control the order of the initializers on Kettle via web.xml. I assume you mean: "list of all tenants". If so, you are right. Correct. Correct. Pretty much all of the above is already implemented in the current accounts code. On the UI, it's very limited, as we need some UXD love. I tried to document as much as I could at several levels: a bigger picture can be read on both the readme files and on the website. The specific "contracts" can be checked on the javadocs. And future features/existing bugs are in JIRA :) - - Juca.