Account for actions that require admin role

[dchandekstark]

Some REST methods are authorized only to users having ROLE_ADMIN for the account. See https://wiki.duraspace.org/display/DURACLOUDDOC/DuraCloud+Security.

Seems like it would be convenient to allow for configuring both a ROLE_USER account and/or a ROLE_ADMIN account.

/cc @bbranan

[bbranan]

It's true that certain actions are only available to administrative users. It's not clear to me what you are suggesting here. Are you saying that there are some of the admin-only calls you would like to see extended to allow those with user-role to perform, or perhaps that you'd like to be able to administer users via the REST API? Or maybe I'm reading this wrong and this is an update you plan to make to the ruby client?

[dchandekstark]

@bbranan This is just an update to the Ruby client, sorry for the confusion. I had not realized, based on the REST docs alone, that some requests would be forbidden to "normal" users. This issue is for thinking about whether there should be some way to reflect this information in the client, on which question I thought you might have an opinion or insight. :)

[bbranan]

Ah, ok, thanks for the clarification. There are a few ways you could make this kind of information known to the users of your client. The simplest would be documentation, of course. Going beyond that a bit, for the calls which require administrative access, you could capture any unauthorized (401) or forbidden (403) responses and make sure to include in the error messages being passed back that admin access is needed. Going much further than this would likely require making some assumptions about how the client will be used.

[dchandekstark]

@bbranan May I assume that 403 would be the response code if the client authenticates successfully but is not authorized to perform the action? Since this client always sends an authorization header, the HTTP spec says 401 means the authentication failed.

[bbranan]

Yes, you should expect that 401 responses are returned when credentials are invalid or missing and 403 responses are returned when credentials are valid but the user is not authorized to perform an action. If you find a case where this does not hold, please let us know.