You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
RS: Fixed outdated password rotation and authorize user docs (#1564)
* DOC-5248 RS: Fixed outdated password rotation docs
* Added breaking changes for /users/password and /users/authorize APIs to 7.8 release notes
* DOC-5248 Feedback update to add 401 status codes back to API reference
* Updated 401 status code links
* Fixed /users/authorize breaking change description
* Removed redundant wording
* Fixed /users/authorize breaking change description on 7.8 release notes index
* Updated outdated /users/authorize REST API reference
* Added ttl default, min, and max values to /users/authorize API reference
* Fixed another error in /users/authorize breaking changes description
Copy file name to clipboardExpand all lines: content/operate/rs/references/rest-api/requests/users/authorize.md
+18-17Lines changed: 18 additions & 17 deletions
Original file line number
Diff line number
Diff line change
@@ -13,13 +13,13 @@ weight: $weight
13
13
14
14
| Method | Path | Description |
15
15
|--------|------|-------------|
16
-
|[POST](#post-authorize)|`/v1/users/authorize`|Authorize a user |
16
+
|[POST](#post-authorize)|`/v1/users/authorize`|Generate a token to authorize an authenticated user |
17
17
18
18
## Authorize user {#post-authorize}
19
19
20
20
POST /v1/users/authorize
21
21
22
-
Generate a JSON Web Token (JWT) for a user to use as authorization to access the REST API.
22
+
Generates a JSON Web Token (JWT) for a user to use as authorization to access the REST API. The request authentication header must include the relevant username and password.
23
23
24
24
### Request {#post-request}
25
25
@@ -29,12 +29,13 @@ Generate a JSON Web Token (JWT) for a user to use as authorization to access the
The request body is optional unless you want to specify the token's time to live:
33
+
34
+
```json
35
+
{
36
+
"ttl": <time_in_seconds>
37
+
}
38
+
```
38
39
39
40
#### Request headers
40
41
| Key | Value | Description |
@@ -44,19 +45,19 @@ Generate a JSON Web Token (JWT) for a user to use as authorization to access the
44
45
45
46
#### Request body
46
47
47
-
Include a [JWT authorize object]({{< relref "/operate/rs/references/rest-api/objects/jwt_authorize" >}}) with a valid username and password in the request body.
48
+
Optionally include a JSON object in the request body to specify the time to live (`ttl`), which determines the amount of time in seconds the token will be valid. The default `ttl` is `300` seconds. The minimum `ttl` is `1` second and the maximum `ttl` is `86400` seconds.
48
49
49
50
### Response {#post-response}
50
51
51
52
Returns a JSON object that contains the generated access token.
@@ -72,6 +73,6 @@ The following are possible `error_code` values:
72
73
73
74
| Code | Description |
74
75
|------|-------------|
75
-
|[200 OK](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.2.1)| The user is authorized. |
76
-
|[400 Bad Request](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.1)| The request could not be understood by the server due to malformed syntax. |
77
-
|[401 Unauthorized](http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.2)| The user is unauthorized. |
76
+
|[200 OK](https://www.rfc-editor.org/rfc/rfc9110.html#name-200-ok)| The user is authorized. |
77
+
|[400 Bad Request](https://www.rfc-editor.org/rfc/rfc9110.html#name-400-bad-request)| The request could not be understood by the server due to malformed syntax. |
78
+
|[401 Unauthorized](https://www.rfc-editor.org/rfc/rfc9110.html#name-401-unauthorized)| The user is unauthorized. |
Copy file name to clipboardExpand all lines: content/operate/rs/release-notes/rs-7-8-releases/_index.md
+18Lines changed: 18 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -65,6 +65,24 @@ Redis Software version 7.8.2 introduces the following breaking changes:
65
65
66
66
- When you [upgrade a database]({{<relref "/operate/rs/references/rest-api/requests/bdbs/upgrade#post-bdbs-upgrade">}}) using the REST API, you can set `"latest_with_modules": false` in the request body to prevent module upgrades.
67
67
68
+
- Authentication method changes for [`/v1/users/password`]({{<relref "/operate/rs/references/rest-api/requests/users/password">}}) REST API requests.
69
+
70
+
-`PUT`, `POST`, and `DELETE` methods require users to include their usernames and a current password in the authentication header to change their password lists. If the authentication header is not provided, the response status will be `401 Unauthorized`.
71
+
72
+
-`/v1/users/password` requests change the password list of the user who provides their credentials in the authorization header when sending the requests.
73
+
74
+
-`PUT` and `POST` requests will ignore `username` and `old_password` parameters provided in the request body.
75
+
76
+
-`DELETE` requests will ignore the `username` parameter provided in the request body.
77
+
78
+
- Authentication method changes for [`POST /v1/users/authorize`]({{<relref "/operate/rs/references/rest-api/requests/users/authorize">}}) REST API requests.
79
+
80
+
- The `POST` method requires users to include their usernames and a current password in the authentication header to generate a JSON Web Token.
81
+
82
+
-`POST /v1/users/authorize` generates a token for the user who provides their credentials in the authorization header when sending the requests.
83
+
84
+
-`POST` requests will ignore `username` and `password` parameters provided in the request body.
85
+
68
86
#### Redis database version 7.4 breaking changes {#redis-74-breaking-changes}
69
87
70
88
When new major versions of Redis Community Edition change existing commands, upgrading your database to a new version can potentially break some functionality. Before you upgrade, read the provided list of breaking changes that affect Redis Software and update any applications that connect to your database to handle these changes.
Copy file name to clipboardExpand all lines: content/operate/rs/release-notes/rs-7-8-releases/rs-7-8-2-34.md
+18Lines changed: 18 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -246,6 +246,24 @@ Redis Software version 7.8.2 introduces the following breaking changes:
246
246
247
247
- When you [upgrade a database]({{<relref "/operate/rs/references/rest-api/requests/bdbs/upgrade#post-bdbs-upgrade">}}) using the REST API, you can set `"latest_with_modules": false` in the request body to prevent module upgrades.
248
248
249
+
- Authentication method changes for [`/v1/users/password`]({{<relref "/operate/rs/references/rest-api/requests/users/password">}}) REST API requests.
250
+
251
+
-`PUT`, `POST`, and `DELETE` methods require users to include their usernames and a current password in the authentication header to change their password lists. If the authentication header is not provided, the response status will be `401 Unauthorized`.
252
+
253
+
-`/v1/users/password` requests change the password list of the user who provides their credentials in the authorization header when sending the requests.
254
+
255
+
-`PUT` and `POST` requests will ignore `username` and `old_password` parameters provided in the request body.
256
+
257
+
-`DELETE` requests will ignore the `username` parameter provided in the request body.
258
+
259
+
- Authentication method changes for [`POST /v1/users/authorize`]({{<relref "/operate/rs/references/rest-api/requests/users/authorize">}}) REST API requests.
260
+
261
+
- The `POST` method requires users to include their usernames and a current password in the authentication header to generate a JSON Web Token.
262
+
263
+
-`POST /v1/users/authorize` generates a token for the user who provides their credentials in the authorization header when sending the requests.
264
+
265
+
-`POST` requests will ignore `username` and `password` parameters provided in the request body.
266
+
249
267
### Redis database version 7.4 breaking changes {#redis-74-breaking-changes}
250
268
251
269
When new major versions of Redis Community Edition change existing commands, upgrading your database to a new version can potentially break some functionality. Before you upgrade, read the provided list of breaking changes that affect Redis Software and update any applications that connect to your database to handle these changes.
Copy file name to clipboardExpand all lines: content/operate/rs/security/access-control/manage-passwords/rotate-passwords.md
+13-17Lines changed: 13 additions & 17 deletions
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ weight: 70
13
13
14
14
Redis Enterprise Software lets you implement password rotation policies using the [REST API]({{< relref "/operate/rs/references/rest-api" >}}).
15
15
16
-
You can add a new password for a database user without immediately invalidating the old one (which might cause authentication errors in production).
16
+
You can add a new password for a database user without immediately invalidating the old one to prevent possible authentication errors in production.
17
17
18
18
{{< note >}}
19
19
Password rotation does not work for the default user. [Add additional users]({{< relref "/operate/rs/security/access-control/create-users" >}}) to enable password rotation.
@@ -27,7 +27,7 @@ you can set a [password expiration policy]({{< relref "/operate/rs/security/acce
27
27
However, for database connections that rely on password authentication,
28
28
you need to allow for authentication with the existing password while you roll out the new password to your systems.
29
29
30
-
With the Redis Enterprise Software REST API, you can add additional passwords to a user account for authentication to the database or the Cluster Manager UI and API.
30
+
With the Redis Enterprise Software REST API, you can add additional passwords to your user account for authentication to the database or the Cluster Manager UI and API.
31
31
32
32
After the old password is replaced in the database connections, you can delete the old password to finish the password rotation process.
33
33
@@ -41,13 +41,13 @@ The new password cannot already exist as a password for the user and must meet t
41
41
42
42
## Rotate password
43
43
44
-
To rotate the password of a user account:
44
+
To rotate your password:
45
45
46
-
1. Add an additional password to a user account with [`POST /v1/users/password`]({{< relref "/operate/rs/references/rest-api/requests/users/password#add-password" >}}):
46
+
1. Add an additional password to your password list with [`POST /v1/users/password`]({{< relref "/operate/rs/references/rest-api/requests/users/password#add-password" >}}). You must provide the relevant username and current password for [basic authentication]({{<relref "/operate/rs/references/rest-api#authentication">}}) credentials when you send the request.
After you send this request, you can authenticate with both the old and the new password.
@@ -56,26 +56,22 @@ To rotate the password of a user account:
56
56
1. Delete the original password with [`DELETE /v1/users/password`]({{< relref "/operate/rs/references/rest-api/requests/users/password#update-password">}}):
If there is only one valid password for a user account, you cannot delete that password.
64
64
65
65
## Replace all passwords
66
66
67
-
You can also replace all existing passwords fora user account with a single password that does not match any existing passwords.
67
+
You can also replace all existing passwords foryour user account with a single password that does not match any existing passwords.
68
68
This can be helpful if you suspect that your passwords are compromised and you want to quickly resecure the account.
69
69
70
-
To replace all existing passwordsfor a user account with a single new password, use [`PUT /v1/users/password`]({{< relref "/operate/rs/references/rest-api/requests/users/password#delete-password">}}):
70
+
To replace your passwords, use [`PUT /v1/users/password`]({{< relref "/operate/rs/references/rest-api/requests/users/password#delete-password">}}). You must provide the relevant username and current password for [basic authentication]({{<relref "/operate/rs/references/rest-api#authentication">}}) credentials when you send the request.
0 commit comments