Shared deployments

[EGI-ILM]

The current implementation of IM requires the share of access tokens between users in order to share the administration of some deployments in the Dashboard.

Whereas this could be a good solution, it implies a trust that it is not always shared between users. Since the access token has a wider scope, a user can use the access token shared by the other user in order to perform (malicious) actions in the EGI ecosystem, in the name of this other user. Even though access tokens have a limited lifetime, this is long enough to perform actions and even establish new mechanisms to maintain future access to unauthorised resources.

I think a better solution can be either:

• To share a one-time use, internal token for the IM dashboard OR
• To set up some functionality to explicitly share a deployment or group of deployments with another user, based on e.g. their Check-in ePUB IDs (which is an information that does not compromise the security of the referenced user). The referenced user could get a notification to accept or reject this sharing.

Additionally, if this is not currently implemented, it could be good for the Dashboard to be able to display which users have access to which deployment (meaning a user can see what other users share his/her deployments).