Vhost based administration rights

[hairyhum]

Related to rabbitmq/rabbitmq-management#153
There should be some way to define admin rights for specific vhost.

[michaelklishin]

I suggest that we put this off until we begin working on topic-based authorisation. While this is not directly related, such things need to be designed as a group.

[megwill4268]

Hi @michaelklishin , excited to have the topic-based authorizations implemented. This feature would be extraordinarily useful to my organization (and personally I could stop maintaining an application to hack around this) is this still in sight to implement?

[lukebakken]

@megwill4268 RabbitMQ implements topic authorization as of 3.7.0. Read about it here.

[megwill4268]

@michaelklishin yes, I was thanking you for the topic authorization feature. I was asking if you were still looking at implementing vhost level administration of users and permissions. rabbitmq/rabbitmq-management#153

[michaelklishin]

User permissions are per-vhost and have always been. The issue description is very vague but I suspect that it's a about having a "vhost-specific administrator" since currently administrators can manage everything across all vhosts. This is not on the roadmap for the next release.

[Skeen]

What's the status of this?

[michaelklishin]

Nothing has changed: administrator privileges are expressed via a tag, which is global. Virtual host permissions are, well, virtual host-based.

No one has explained what the solution would look like here and what the migration path would be. I'm inclined to close this as we only use issues for specific, actionable items where it is clear enough for our contributors what should be done and why.

[Skeen]

While I cannot give a suggestion for what a solution would look like, I can suggest how I would like the behavior to be.

I would like to have an instance admin, which creates namespaces (read vhosts) and create a namespace admin (vhost admin).
Namespace admin should be able to control all resources within their own namespace, but no resources outside of it.
The namespace admin should be able to create namespaced users, namespaces exchanged, queues, etc.

I believe this proper namespace isolation is necessary to support multi-tenancy in RabbitMQ, as currently the RBAC is not strong enough to provide proper separation of tenants.