{"action":"opened","issue":{"url":"https://api.github.com/repos/vmware/vic/issues/6464","repository_url":"https://api.github.com/repos/vmware/vic","labels_url":"https://api.github.com/repos/vmware/vic/issues/6464/labels{/name}","comments_url":"https://api.github.com/repos/vmware/vic/issues/6464/comments","events_url":"https://api.github.com/repos/vmware/vic/issues/6464/events","html_url":"https://github.com/vmware/vic/issues/6464","id":260830293,"number":6464,"title":"Reduce friction around use of operations credentials","user":{"login":"zjs","id":408880,"avatar_url":"https://avatars2.githubusercontent.com/u/408880?v=4","gravatar_id":"","url":"https://api.github.com/users/zjs","html_url":"https://github.com/zjs","followers_url":"https://api.github.com/users/zjs/followers","following_url":"https://api.github.com/users/zjs/following{/other_user}","gists_url":"https://api.github.com/users/zjs/gists{/gist_id}","starred_url":"https://api.github.com/users/zjs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zjs/subscriptions","organizations_url":"https://api.github.com/users/zjs/orgs","repos_url":"https://api.github.com/users/zjs/repos","events_url":"https://api.github.com/users/zjs/events{/privacy}","received_events_url":"https://api.github.com/users/zjs/received_events","type":"User","site_admin":false},"labels":[{"id":317677446,"url":"https://api.github.com/repos/vmware/vic/labels/area/apis","name":"area/apis","color":"f9d0c4","default":false},{"id":318105044,"url":"https://api.github.com/repos/vmware/vic/labels/area/cli","name":"area/cli","color":"f9d0c4","default":false},{"id":320394508,"url":"https://api.github.com/repos/vmware/vic/labels/area/ux","name":"area/ux","color":"f9d0c4","default":false},{"id":327809115,"url":"https://api.github.com/repos/vmware/vic/labels/component/vic-machine","name":"component/vic-machine","color":"d4c5f9","default":false},{"id":310959984,"url":"https://api.github.com/repos/vmware/vic/labels/kind/enhancement","name":"kind/enhancement","color":"bfd4f2","default":false},{"id":680163399,"url":"https://api.github.com/repos/vmware/vic/labels/team/foundation","name":"team/foundation","color":"c2e0c6","default":false},{"id":680163695,"url":"https://api.github.com/repos/vmware/vic/labels/team/lifecycle","name":"team/lifecycle","color":"c2e0c6","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-09-27T02:51:07Z","updated_at":"2017-09-27T02:51:07Z","closed_at":null,"author_association":"MEMBER","body":"Because a VCH must be able to interact with vSphere for a variety of operations on behalf of its users (which may not be vSphere administrators), it requires access to a set of vSphere credentials.\r\n\r\nWhen using the vic-machine CLI, the default behavior is to persist the credentials which were used for the VCH creation itself. Alternatively, administrators may [supply a set of \"operations credentials\"](https://vmware.github.io/vic-product/assets/files/html/1.2/vic_vsphere_admin/vch_installer_options.html#specify-different-user-accounts-for-vch-deployment-and-operation-). \r\n\r\nThis default option cannot be supported for API consumers using a session to authenticate, including the UI. As baseline functionality, we can require that operations credentials are supplied when authenticating with the API in this way. An administrator may chose to supply their own credentials as the operations credentials if they wish to mimic the CLI's default behavior.\r\n\r\nRequiring administrators to supply operations credentials works, but is likely to be a point of friction. Beyond the basic inconvenience of treating more information as required in the wizard, an operations user needs to have a [non-trivial set of permissions](https://vmware.github.io/vic-product/assets/files/html/1.2/vic_vsphere_admin/set_up_ops_user.html) which introduces an additional source of user error.\r\n\r\nSupport for automatically creating a per-VCH solution user and assigning it the correct permissions seems like the best way to address these pain points. This design also has other advantages: solution users are the accepted mechanism for machine-to-machine interaction, solution users authenticate using a certificate instead of a password, and this would allow us to follow the principle of least privilege by default.\r\n\r\nHowever, issuing requests as a solution user is believed to present significant technical challenges due to immature golang support for SOAP and SAML.\r\n\r\nAs an interim solution, we can:\r\n\r\n1. Introduce logic to validate that supplied operations credentials have the necessary permissions, so that missing permissions can be identified early and clearly.\r\n2. Allow administrators to have vic-machine attempt to automatically grant any missing permissions, so that permissions can be granted corrected quickly and easily.\r\n3. Support automatically creating a non-solution user on behalf of the administrator, and granting it a minimal set of permissions, to further reduce the work required of the administrator.\r\n\r\nEach of these items builds on the previous, and all three act as building blocks towards the ideal (solution user) design described above. Each of these items would be useful for UI, API, and CLI. We can attempt to implement as many of these items as possible in the time available."}}
{"actor":{"display_login":"zjs"}}