Controlling public access of resources in a secure distributed storage system
A method for controlling public access of resources in a secure distributed storage system using an API level model. A request to access a volume is checked for authentication. If the request does not include an authentication token ID, a guest role is created and assigned to the requestor. The guest role can only access public volumes or owned volumes that specifically allow public access. The guest role can be updated using API management.
1. A method comprising:
receiving a request, from a user, to access a volume;
determining, via an authentication module, that the request does not include a valid token ID;
in response to determining that the request does not include a valid token ID, creating a user info object with a role of “guest” and setting a guest Boolean to “true”;
determining, via an authorization module, that the role of guest is allowed to access the volume in the manner presented in the request;
in response to determining that the role of guest is allowed to access the volume, determining whether the volume is owned or public;
in response to determining that the volume is owned, giving access to the volume for the role of guest only if the volume is specified by the owner to give public access, otherwise denying the request;
in response to determining that the volume is public, giving access to the volume only if the role of guest is allowed to access the volume in the manner presented in the request, otherwise denying the request.
2. The method recited in claim 1 , wherein the volume has an owner and the volume includes an ownership object that identifies the owner.
3. The method recited in claim 2 , wherein the ownership object includes a public Boolean to display if the volume is public or not.
4. The method recited in claim 1 , wherein the volume is public and any user is authorized to access, mutate, or delete the volume.
5. The method recited in claim 1 , wherein the role of guest is changeable by an administrator through API management to give or remove certain access rights, including creating public volumes.
6. The method recited in claim 1 , wherein the request is to create the volume, the guest Boolean is set to true, the request passes the authorization module, and the volume is created without an owner and specified as public.
7. The method recited in claim 1 , wherein a volume that is not owned is considered public.
8. A computing system comprising:
a processor; and
memory, the memory storing instructions to cause the processor to perform a method, the method comprising:
receiving a request, from a user, to access a volume;
checking, via an authentication module, whether the request includes a valid token ID;
if the request does not include a valid token ID, creating a user info object with a role of “guest” and setting a guest Boolean to “true”;
determining, via an authorization module, whether the role of guest is allowed to access the volume in the manner presented in the request;
if the request passes the authorization module, determining whether the volume is owned or public;
if the volume is owned, giving access to the volume for the guest role only if the volume is specified by the owner to give public access, otherwise denying the request;
if the volume is public, giving access to the volume only if the role of guest is allowed to access the volume in the manner presented in the request, otherwise denying the request;
if the request does not pass the authorization module, denying the request to access the volume.
9. The system recited in claim 8 , wherein if the volume has an owner, the volume includes an ownership object that identifies the owner.
10. The system recited in claim 9 , wherein the ownership object includes a public Boolean to display if the volume is public or not.
11. The system recited in claim 8 , wherein if the volume is public, any user has authorization to access, mutate, or delete the volume.
12. The system recited in claim 8 , wherein the role of public is changeable by an administrator through API management to give or remove certain access rights, including creating public volumes.
13. The system recited in claim 8 , wherein if the request is to create the volume, the guest Boolean is set to true, and the request passes the authorization module, then the volume is created without an owner and the volume is specified as public.
14. The system recited in claim 8 , wherein a volume is considered public if the volume is not owned.
15. One or more non-transitory machine-readable media having instructions stored thereon for performing a method, the method comprising:
receiving a request, from a user, to access a volume;
checking, via an authentication module, whether the request includes a valid token ID;
if the request does not include a valid token ID, creating a user info object with a role of “guest” and setting a guest Boolean to “true”;
determining, via an authorization module, whether the role of guest is allowed to access the volume in the manner presented in the request;
if the request passes the authorization module, determining whether the volume is owned or public;
if the volume is owned, giving access to the volume for the guest role only if the volume is specified by the owner to give public access, otherwise denying the request;
if the volume is public, giving access to the volume only if the role of guest is allowed to access the volume in the manner presented in the request, otherwise denying the request;
if the request does not pass the authorization module, denying the request to access the volume.
16. The one or more non-transitory computer readable media recited in claim 15 , wherein if the volume has an owner, the volume includes an ownership object that identifies the owner.
17. The one or more non-transitory computer readable media recited in claim 16 , wherein the ownership object includes a public Boolean to display if the volume is public or not.
18. The one or more non-transitory computer readable media recited in claim 15 , wherein if the volume is public, any user has authorization to access, mutate, or delete the volume.
19. The one or more non-transitory computer readable media recited in claim 15 , wherein the role of guest is changeable by an administrator through API management to give or remove certain access rights, including creating public volumes.
20. The one or more non-transitory computer readable media recited in claim 15 , wherein if the request is to create the volume, the guest Boolean is set to true, and the request passes the authorization module, then the volume is created without an owner and the volume is specified as public.