#5679 [RFE] Provide a graphing tool that can be used to visualise access
Opened by pvoborni. Modified

Provide a graphing tool that can be used to visualize access, similar to the manner in which one can visual puppet module dependencies.

The user would like to have the tool so that they can validate there are no unintended consequences to the change they are making it.

By being able to visualize what would be changed, they can use this to confirm what they are doing is correct

The tool should be able to visualize the access granted to users / groups so that the user can see what the impact of their changes is.

Additional info

  • So, when additional rules are being added to a rule, one could effectively generate a graphviz visualization, of which hosts/users are affected by that modification (due to nested members ship of both user groups and host groups), and ideally showing how it's granted (all of the groups/sub groups that are effected).
  • Or, adding a user to a new group, what hosts, sudo rules, etc would they inherit.
  • If some thing like graphviz was used, then in theory one could have effectively a live map, that one could click around, while it queries the back end and pulls out the linked information (obviously this would incur a load).
  • This could then also be used to assist in working out where would be a better place to apply the permissions, on an existing group, create new group etc.

This is a really cool idea. However before we go there we should at least do the attestation reports. Effectively you want to match things from central service perspective and from a local server perspective.
One should be able to log (remotely) to SSSD (openlmi would have been handy but may be we can do it just as a D-BUS interface from Cockpit or CLI) and run a tool sss_who_can_access_me. Get a report and then compare to what the server thinks. May be we can use OpenSCAP for this. We already have a ticket for the attestation. But this is something we should seriously consider for 1.15 (before building the visual tool, which would be very nice indeed).

Metadata Update from @pvoborni:
- Issue assigned to someone
- Issue set to the milestone: Ticket Backlog

Metadata