Hi Sebastien,

 In some cases it may not be possible or viable to create new scope for

each resource id e.g. short lived resources.

Why wouldn't that be possible? What type of short-lived resources did you

have in mind?

For example experimental service version (beta) replaced by release
version, usage of which may be reported and metered but not necessarily
billed.
The scope names may need to follow adopter specific conventions so creating
scope with predefined name 'abacus.usage....' may not fit that scheme.
Abacus should offer ability to adjust the scope names, otherwise submission
may not be possible.

Another reason why I'm not sure about short lived resources, is that

although you may decide to stop offering a type a resource at some point,
once you've metered it, and sent a bill for it >to a customer, I don't
think you can really 'forget' about its existence anymore... So in that
sense I'm not sure how it can be 'short lived'.
The short lived resource is only for submission, once it is not offered,
its specific scope is not needed. Thad does not mean erasing history of
usage.


Piotr






From: Jean-Sebastien Delfino <jsdelfino(a)gmail.com>
To: "Discussions about Cloud Foundry projects and the system
overall." <cf-dev(a)lists.cloudfoundry.org>
Date: 10/08/2015 11:10 AM
Subject: [cf-dev] Re: Re: Re: [abacus] Usage submission authorization



Hi Piotr,

 In some cases it may not be possible or viable to create new scope for

each resource id e.g. short lived resources.

Why wouldn't that be possible? What type of short-lived resources did you
have in mind?

The typical use case I've seen is for a Cloud platform to decide to offer a
new type of database or analytics or messaging service, or a new type of
runtime for example. Before that new resource is offered on the platform,
their resource provider needs to get on board, get a user id, auth
credentials defined in UAA etc... You probably also need to define how
you're going to meter that new resource and the pricing for it.

Couldn't a scope be created in UAA at that time along all these other on
boarding steps?

Another reason why I'm not sure about short lived resources, is that
although you may decide to stop offering a type a resource at some point,
once you've metered it, and sent a bill for it to a customer, I don't think
you can really 'forget' about its existence anymore... So in that sense I'm
not sure how it can be 'short lived'.

Some flexibility would also help to accommodate changes related to

grouping resources by type as discussed in [1].

We discussed two options in [1]:
a) support a resource_type in addition to resource_id for grouping many
resource_ids under a single type
b) a common resource_id for several resources (something like 'node' for
all your versions of Node.js build packs for example)

Since option (a) is not implemented at this point and Issue #38 is actually
assigned to a 'future' milestone, AIUI resource providers need to use
option (b) with a common resource_id for multiple resources. Is creating a
scope for that common id still too much of a burden then?

[1] - https://github.com/cloudfoundry-incubator/cf-abacus/issues/38

Thoughts?

- Jean-Sebastien

On Wed, Oct 7, 2015 at 5:51 PM, Piotr Przybylski <piotrp(a)us.ibm.com> wrote:
Hi Sebastien,

> That OAuth token should include:
> - a user id uniquely identifying that resource provider;
> - an OAuth scope named like abacus.usage.<resource_id>.write

What kind of customization of the above do you plan to expose? In some
cases it may not be possible or viable to create new scope for each
resource id e.g. short lived resources. The ability to either configure
scope to use for validation or provide scope 'mapping' would help to
adapt it to existing deployments. Some flexibility would also help to
accommodate changes related to grouping resources by type as discussed in
[1].

[1] - https://github.com/cloudfoundry-incubator/cf-abacus/issues/38


Piotr



Inactive hide details for Jean-Sebastien Delfino ---10/07/2015 12:30:05
AM---Hi Piotr, > what kind of authorization is requiredJean-Sebastien
Delfino ---10/07/2015 12:30:05 AM---Hi Piotr, > what kind of
authorization is required to submit usage to Abacus ?

From: Jean-Sebastien Delfino <jsdelfino(a)gmail.com>
To: "Discussions about Cloud Foundry projects and the system overall." <
cf-dev(a)lists.cloudfoundry.org>
Date: 10/07/2015 12:30 AM
Subject: [cf-dev] Re: [abacus] Usage submission authorization




Hi Piotr,

> what kind of authorization is required to submit usage to Abacus ?
> Is the oauth token used for submission [1] required to have particular
scope, specific to resource or resource provider ?

A resource provider is expected to present an OAuth token with the usage
it submits for a (service or runtime) resource.

That OAuth token should include:
- a user id uniquely identifying that resource provider;
- an OAuth scope named like abacus.usage.<resource_id>.write.

The precise naming syntax for that scope may still evolve in the next few
days as we progress with the implementation of user story 101703426 [1].

> Is there a different scope required to submit runtimes usage (like cf
bridge) versus other services or its possible to use single scope for all
the submissions

I'd like to handle runtimes and services consistently as they're
basically just different types of resources, i.e. one scope per 'service'
resource, one scope per 'runtime' resource.

We're still working on the detailed design and implementation, but I'm
not sure we'd want to share scopes across (service and runtime) resource
providers as that'd allow a resource provider to submit usage for
resources owned by another...

@assk / @sasrin, anything I missed? Thoughts?

-- Jean-Sebastien


On Tue, Oct 6, 2015 at 6:29 PM, Piotr Przybylski <piotrp(a)us.ibm.com>
wrote:
Hi,
what kind of authorization is required to submit usage to Abacus ?
Is the oauth token used for submission [1] required to have
particular scope, specific to resource or resource provider ? Is
there a different scope required to submit runtimes usage (like cf
bridge) versus other services or its possible to use single scope
for all the submissions ?


[1] - https://www.pivotaltracker.com/story/show/101703426

Piotr