luci-config: fine-grained acls

luci-config: fine-grained acls

Each project/service can declare who can read its configs and see
it in service/project/ref listings. A project can do that by putting
projects/<project_id>:project.cfg file with "access" field set to a
group name defined at auth service. If not specified, only admins have
access. Same for services, except it is in services.cfg

project_access_group in acl.cfg remains the same, but service_access_group is removed.

Removed check of X-Appengine-Inbound-Appid check because it does not work.

R=sergiyb@chromium.org, vadimsh@chromium.org
BUG=#228

Committed: https://github.com/luci/luci-py/commit/28b2abd1e68e72f5ec4d1c6815263daa0aa57790

[nodir, 2015-07-07 16:31:35]

Patchset #1 (id:1) has been deleted

[nodir, 2015-07-07 16:41:30]

Patchset #1 (id:20001) has been deleted

[nodir, 2015-07-07 16:42:09]

PTAL. When this is committed, I will add project.cfg "access: all" to public
projects.

[nodir, 2015-07-07 16:43:26]

On 2015/07/07 16:42:09, nodir wrote:
> PTAL. When this is committed, I will add project.cfg "access: all" to public
> projects.

Also we will be able to remove chrome-infra-auth-dev@appspot.gserviceaccount.com
from https://chrome-infra-auth.appspot.com/auth/groups#config-service-access

[Sergiy Byelozyorov, 2015-07-07 22:48:07]

lgtm

https://codereview.chromium.org/1224913002/diff/60001/appengine/config_servic...
File appengine/config_service/README.md (right):

https://codereview.chromium.org/1224913002/diff/60001/appengine/config_servic...
appengine/config_service/README.md:96: and a GAE app with the same id, e.g.
x.appspot.com has access to `services/x`.
can we make this configurable please? e.g. cq service app is hosted on
chromium-commit-queue.appspot.com.

[Vadim Sh., 2015-07-08 14:20:34]

https://codereview.chromium.org/1224913002/diff/60001/appengine/config_servic...
File appengine/config_service/acl.py (left):

https://codereview.chromium.org/1224913002/diff/60001/appengine/config_servic...
appengine/config_service/acl.py:65: (headers or
{}).get('X-Appengine-Inbound-Appid') == service_id
it should have worked

does caller use follow_redirects=False? GAE adds X-Appengine-Inbound-Appid only
when follow_redirects=False.

https://codereview.chromium.org/1224913002/diff/60001/appengine/config_servic...
File appengine/config_service/acl.py (right):

https://codereview.chromium.org/1224913002/diff/60001/appengine/config_servic...
appengine/config_service/acl.py:62: trusted_identities = [
as I said in another CL, I don't like implicitly binding service ID to service
account email. Is it hard to put it into a config?

[nodir, 2015-07-08 16:33:37]

Patchset #3 (id:80001) has been deleted

[nodir, 2015-07-08 16:35:58]

Rebased on top of https://codereview.chromium.org/1221643020/ to have
services.cfg

https://codereview.chromium.org/1224913002/diff/60001/appengine/config_servic...
File appengine/config_service/acl.py (left):

https://codereview.chromium.org/1224913002/diff/60001/appengine/config_servic...
appengine/config_service/acl.py:65: (headers or
{}).get('X-Appengine-Inbound-Appid') == service_id
On 2015/07/08 14:20:34, Vadim Sh. wrote:
> it should have worked
> 
> does caller use follow_redirects=False? GAE adds X-Appengine-Inbound-Appid
only
> when follow_redirects=False.

yes, the caller is chrome-infra-auth-dev.appspot.com through
components.config.remote through components.net which uses
follow_redirects=False by default

https://codereview.chromium.org/1224913002/diff/60001/appengine/config_servic...
File appengine/config_service/acl.py (right):

https://codereview.chromium.org/1224913002/diff/60001/appengine/config_servic...
appengine/config_service/acl.py:62: trusted_identities = [
On 2015/07/08 14:20:34, Vadim Sh. wrote:
> as I said in another CL, I don't like implicitly binding service ID to service
> account email. Is it hard to put it into a config?

Implemented fine-grained acls for service configs and removed
service_access_group from acl.cfg

[nodir, 2015-07-08 17:17:16]

Updated acl.cfg https://chromereviews.googleplex.com/220517013/

[Vadim Sh., 2015-07-08 17:52:39]

I'm confused by this change after rebase.. where's the new code, where's
committed code..

[nodir, 2015-07-08 17:53:26]

On 2015/07/08 17:52:39, Vadim Sh. wrote:
> I'm confused by this change after rebase.. where's the new code, where's
> committed code..

For exactly this reason I've uploaded patchset 3. Compare PS4 to PS3

[Vadim Sh., 2015-07-08 19:57:56]

https://codereview.chromium.org/1224913002/diff/120001/appengine/config_servi...
File appengine/config_service/acl.py (right):

https://codereview.chromium.org/1224913002/diff/120001/appengine/config_servi...
appengine/config_service/acl.py:67: if auth.is_group_member(service_cfg.access):
Why not support both groups and individual accounts? :( I'd like to avoid
creating single member groups.

[nodir, 2015-07-08 20:51:20]

Patchset #5 (id:140001) has been deleted

[nodir, 2015-07-08 20:52:45]

Patchset #5 (id:160001) has been deleted

[nodir, 2015-07-08 21:07:58]

Patchset #5 (id:180001) has been deleted

[nodir, 2015-07-08 21:08:49]

https://codereview.chromium.org/1224913002/diff/120001/appengine/config_servi...
File appengine/config_service/acl.py (right):

https://codereview.chromium.org/1224913002/diff/120001/appengine/config_servi...
appengine/config_service/acl.py:67: if auth.is_group_member(service_cfg.access):
On 2015/07/08 19:57:56, Vadim Sh. wrote:
> Why not support both groups and individual accounts? :( I'd like to avoid
> creating single member groups.

Done.

[Vadim Sh., 2015-07-08 21:34:07]

lgtm

[nodir, 2015-07-08 21:42:02]

Committed patchset #5 (id:190001) manually as
28b2abd1e68e72f5ec4d1c6815263daa0aa57790 (presubmit successful).