RBAC HLD #37
RBAC HLD #37
Conversation
It probably shouldn't begin with "Feature Name"...
Fixed some issues with line breaks in the document.
* Tie the token-based auth more closely with password-based auth. * Clearly call out places where we need to finalize on some design decisions (CLI-to-REST auth, JWT)
Update SONiC RBAC HLD.md
- Added 1.1.1.5 certificate-based authentication for REST and gNMI, describing the fact that certs must be managed outside of the NBIs, and certain assumptions made about the certs. - Added a work-item about the REST server -- it currently only allows one form of auth at a time; need to extend it to multiple. - Resolved my question about whether a user will be "dropped into" the KLISH shell, as that is outside of the scope of this doc.
- Added sections about local user management requirements - Made certificate-based client authentication for REST server optional, contingent on CLI authentication needs. - Added a question about User Table
- Finalized approach for 1.1.1.2 CLI Authentication to REST server - Restored requirement for certificate-based authentication for REST server - Answered question about how to register for file system events.
- Updated RBAC document after joint review session between Dell and Broadcom.
- Added details about UserDB sync with Linux users. - Moved the responsibility for UserDB sync out of Translib and into a host service.
- Clarified that remote users will share the same certs and home directory.
ujayakrishnan
requested review from
a-barboza,
anand-kumar-subramanian,
ben-gale,
dutta-partha and
sachinholla
|
what are the privileges for Operator? Can we modify the privileges for Admin and Operator? |
@santoshv522 -- Operator is read-only, whereas Admin is read/write across all attributes. I have added that info to the doc. Initially, the user cannot modify privileges for Admin and Operator. The privileges are enforced by Translib and the initial support for RBAC will be to just hard-code these limitations for these roles. |
Addressed first set of PR comments. * clarified that operators are read-only and admins are read/write * clarified details around CLI authentication and how CLI uses certificates. * clarified details about how certificates are used by REST and gNMI.
For now,what are the rules hard-coded for these roles to validate the functionality for respective users? |
@santoshv522 Sorry, Not sure I understand the first question, beyond what I've already stated. Users with the
To be sure, there are various limitations to this, and we should fix this as part of a future effort. We're not doing any syncing or special mapping of remote users, except to log them into the switch as remote-user or remote-user-su. Max users isn't covered in the scope of this HLD. |
|
Do we have any other document to get the all supported show and CLI commands? if yes,can you please provide the details. |
No description provided.