mirror of
https://github.com/NLnetLabs/krill.git
synced 2026-08-30 11:49:41 +02:00
Martin HoffmannandGitHub
fc104247ae
This PR restructures how authentication policies are used in Krill. It removes the use of Oso and its policy definition language and instead switches to simple, straightforward mappings between permissions, roles, and users. The existing concept of roles is augmented to serve as the central configuration option for limiting a user’s access to certain action and resources. Roles are now user configurable via the new auth_roles configuration directive. For each role, a set of permissions has to be provided. Optionally, a list of resource handles (vulgo: CAs) can be given in which case access is limited to these resources. The authentication providers now assign one of these roles to each logged in user. The OpenID Connect provider now only determines claims for “id,” i.e., the user name, and the “role.” Since we replaced the previous use of JMES paths with custom functions with a more stringent model of matching and substitution, the configuration had to change in a non-compatible way, anyway, so we cleaned it up a bit and switched from a map to an array for the claims. For the config file provider, this was already possible by adding a “role” attribute. This has now been changed into a “role” field of the user details. In order to make upgrading seamless, the “role” attribute is still accepted but a deprecation warning is logged. Since the auth_users configuration is not used for the OpenID Connect provider any more, the password_hash and salt fields of the user details are now mandatory. Custom policies have been removed. This is a breaking change.
47 lines
1.4 KiB
ReStructuredText
47 lines
1.4 KiB
ReStructuredText
.. _doc_krill_multi_user:
|
|
|
|
Login with Named Users
|
|
======================
|
|
|
|
.. versionadded:: v0.9.0
|
|
|
|
.. figure:: img/multi-user-banner.png
|
|
:align: center
|
|
:width: 100%
|
|
:alt: Multi-user user identity head & shoulders popup
|
|
|
|
Checking the currently logged in user and user attributes
|
|
|
|
By default Krill requires users to authenticate using the configured secret
|
|
token, and actions in the event history are attributed to a client using the
|
|
secret token or to Krill itself.
|
|
|
|
Krill also supports authenticating users **of the web user interface** with
|
|
their own username and credentials. Actions taken by such logged in users are
|
|
attributed in the event history to their username.
|
|
|
|
To login users by username Krill must first be configured either with locally
|
|
defined user details and credentials, or with the details necessary to
|
|
interact with a separate `OpenID Connect <https://openid.net/connect/>`_
|
|
compliant identity provider system.
|
|
|
|
Further reading:
|
|
|
|
.. toctree::
|
|
:maxdepth: 1
|
|
:name: toc-multi-user
|
|
|
|
multi-user/roles
|
|
multi-user/config-file-provider
|
|
multi-user/openid-connect-provider
|
|
|
|
.. history
|
|
.. authors
|
|
.. license
|
|
|
|
.. note:: Clients using the Krill REST API directly or via ``krillc`` cannot
|
|
authenticate using named users, they can only authenticate using the
|
|
secret token. If you need this capability `please let us know
|
|
<https://github.com/NLnetLabs/krill/issues/new/choose>`_.
|
|
|