Skip to content

Commit 693828c

Browse files
andreyaksenovandreyaksenov
authored
Document config credentials (#4024)
1 parent c9e9c81 commit 693828c

File tree

17 files changed

+1340
-479
lines changed

17 files changed

+1340
-479
lines changed

‎doc/book/admin/access_control.rst

Lines changed: 994 additions & 299 deletions
Large diffs are not rendered by default.

‎doc/code_snippets/test/access_control/grant_roles_test.lua

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
local fio = require('fio')
2+
local server = require('luatest.server')
3+
local t = require('luatest')
4+
local g = t.group()
5+
g.before_all(function(cg)
6+
cg.server = server:new {
7+
box_cfg = {},
8+
workdir = fio.cwd() .. '/tmp'
9+
}
10+
cg.server:start()
11+
cg.server:exec(function()
12+
box.schema.space.create('writers')
13+
box.space.writers:format({
14+
{ name = 'id', type = 'unsigned' },
15+
{ name = 'name', type = 'string' }
16+
})
17+
box.space.writers:create_index('primary', { parts = { 'id' } })
18+
19+
box.schema.space.create('books')
20+
box.space.books:format({
21+
{ name = 'id', type = 'unsigned' },
22+
{ name = 'title', type = 'string' },
23+
{ name = 'author_id', foreign_key = { space = 'writers', field = 'id' } },
24+
})
25+
box.space.books:create_index('primary', { parts = { 'id' } })
26+
27+
box.space.writers:insert { 1, 'Leo Tolstoy' }
28+
box.space.writers:insert { 2, 'Fyodor Dostoevsky' }
29+
box.space.writers:insert { 3, 'Alexander Pushkin' }
30+
31+
box.space.books:insert { 1, 'War and Peace', 1 }
32+
box.space.books:insert { 2, 'Anna Karenina', 1 }
33+
box.space.books:insert { 3, 'Resurrection', 1 }
34+
box.space.books:insert { 4, 'Crime and Punishment', 2 }
35+
box.space.books:insert { 5, 'The Idiot', 2 }
36+
box.space.books:insert { 6, 'The Brothers Karamazov', 2 }
37+
box.space.books:insert { 7, 'Eugene Onegin', 3 }
38+
box.space.books:insert { 8, 'The Captain\'s Daughter', 3 }
39+
box.space.books:insert { 9, 'Boris Godunov', 3 }
40+
box.space.books:insert { 10, 'Ruslan and Ludmila', 3 }
41+
end)
42+
end)
43+
44+
g.after_all(function(cg)
45+
cg.server:drop()
46+
fio.rmtree(cg.server.workdir)
47+
end)
48+
49+
g.test_role_granted_revoked = function(cg)
50+
cg.server:exec(function()
51+
box.schema.user.create('testuser', { password = 'foobar' })
52+
53+
-- Create roles --
54+
box.schema.role.create('books_space_manager')
55+
box.schema.role.create('writers_space_reader')
56+
-- End: Create roles --
57+
58+
-- Grant read/write privileges to a role --
59+
box.schema.role.grant('books_space_manager', 'read,write', 'space', 'books')
60+
-- Grant write privileges to a role --
61+
box.schema.role.grant('writers_space_reader', 'read', 'space', 'writers')
62+
-- End: Grant privileges to roles --
63+
64+
-- Grant a role to a role --
65+
box.schema.role.create('all_spaces_manager')
66+
box.schema.role.grant('all_spaces_manager', 'books_space_manager')
67+
box.schema.role.grant('all_spaces_manager', 'writers_space_reader')
68+
-- End: Grant a role to a role --
69+
70+
-- Grant a role to a user --
71+
box.schema.user.grant('testuser', 'books_space_manager')
72+
box.schema.user.grant('testuser', 'writers_space_reader')
73+
-- End: Grant a role to a user --
74+
75+
-- Test removing a tuple from 'writers' --
76+
box.session.su('testuser')
77+
local _, delete_writer_error = pcall(function()
78+
box.space.writers:delete(3)
79+
end)
80+
t.assert_equals(delete_writer_error:unpack().message, "Write access to space 'writers' is denied for user 'testuser'")
81+
box.session.su('admin')
82+
83+
-- Revoking a role from a user --
84+
box.schema.user.revoke('testuser', 'execute', 'role', 'writers_space_reader')
85+
-- End: Revoking a role from a user --
86+
87+
-- Test selecting data from 'writers' --
88+
box.session.su('testuser')
89+
local _, select_writer_error = pcall(function()
90+
box.space.writers:select(3)
91+
end)
92+
t.assert_equals(select_writer_error:unpack().message, "Read access to space 'writers' is denied for user 'testuser'")
93+
box.session.su('admin')
94+
95+
-- Dropping a role --
96+
box.schema.role.drop('writers_space_reader')
97+
-- End: Dropping a role --
98+
99+
-- Test roles exist --
100+
t.assert_equals(box.schema.role.exists('books_space_manager'), true)
101+
t.assert_equals(box.schema.role.exists('all_spaces_manager'), true)
102+
t.assert_equals(box.schema.role.exists('writers_space_reader'), false)
103+
end)
104+
end

‎doc/code_snippets/test/access_control/grant_user_privileges_test.lua

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
local fio = require('fio')
2+
local server = require('luatest.server')
3+
local t = require('luatest')
4+
local g = t.group()
5+
g.before_all(function(cg)
6+
cg.server = server:new {
7+
box_cfg = {},
8+
workdir = fio.cwd() .. '/tmp'
9+
}
10+
cg.server:start()
11+
cg.server:exec(function()
12+
box.schema.space.create('writers')
13+
box.space.writers:format({
14+
{ name = 'id', type = 'unsigned' },
15+
{ name = 'name', type = 'string' }
16+
})
17+
box.space.writers:create_index('primary', { parts = { 'id' } })
18+
19+
box.schema.space.create('books')
20+
box.space.books:format({
21+
{ name = 'id', type = 'unsigned' },
22+
{ name = 'title', type = 'string' },
23+
{ name = 'author_id', foreign_key = { space = 'writers', field = 'id' } },
24+
})
25+
box.space.books:create_index('primary', { parts = { 'id' } })
26+
27+
box.space.writers:insert { 1, 'Leo Tolstoy' }
28+
box.space.writers:insert { 2, 'Fyodor Dostoevsky' }
29+
box.space.writers:insert { 3, 'Alexander Pushkin' }
30+
31+
box.space.books:insert { 1, 'War and Peace', 1 }
32+
box.space.books:insert { 2, 'Anna Karenina', 1 }
33+
box.space.books:insert { 3, 'Resurrection', 1 }
34+
box.space.books:insert { 4, 'Crime and Punishment', 2 }
35+
box.space.books:insert { 5, 'The Idiot', 2 }
36+
box.space.books:insert { 6, 'The Brothers Karamazov', 2 }
37+
box.space.books:insert { 7, 'Eugene Onegin', 3 }
38+
box.space.books:insert { 8, 'The Captain\'s Daughter', 3 }
39+
box.space.books:insert { 9, 'Boris Godunov', 3 }
40+
box.space.books:insert { 10, 'Ruslan and Ludmila', 3 }
41+
end)
42+
end)
43+
44+
g.after_each(function(cg)
45+
cg.server:exec(function()
46+
if box.schema.user.exists('testuser') then
47+
box.schema.user.drop('testuser')
48+
end
49+
end)
50+
end)
51+
52+
g.after_all(function(cg)
53+
cg.server:drop()
54+
fio.rmtree(cg.server.workdir)
55+
end)
56+
57+
g.test_user_without_password_created = function(cg)
58+
cg.server:exec(function()
59+
-- Create a user without a password --
60+
box.schema.user.create('testuser')
61+
-- End: Create a user without a password --
62+
t.assert_equals(box.space._user.index.name:select { 'testuser' }[1][5]['chap-sha1'], nil)
63+
end)
64+
end
65+
66+
g.test_user_with_password_created = function(cg)
67+
cg.server:exec(function()
68+
-- Create a user with a password --
69+
box.schema.user.create('testuser', { password = 'foobar' })
70+
-- End: Create a user with a password --
71+
t.assert_equals(box.space._user.index.name:select { 'testuser' }[1][5]['chap-sha1'], 'm1ADQ7xS4pERcutSrlz0hHYExuU=')
72+
end)
73+
end
74+
75+
g.test_current_user_password_set = function(cg)
76+
cg.server:exec(function()
77+
box.session.su('admin')
78+
-- Set a password for the current user --
79+
box.schema.user.passwd('foobar')
80+
-- End: Set a password for the current user --
81+
t.assert_equals(box.space._user.index.name:select { 'admin' }[1][5]['chap-sha1'], 'm1ADQ7xS4pERcutSrlz0hHYExuU=')
82+
end)
83+
end
84+
85+
g.test_specified_user_password_set = function(cg)
86+
cg.server:exec(function()
87+
box.schema.user.create('testuser')
88+
-- Set a password for the specified user --
89+
box.schema.user.passwd('testuser', 'foobar')
90+
-- End: Set a password for the specified user --
91+
t.assert_equals(box.space._user.index.name:select { 'testuser' }[1][5]['chap-sha1'], 'm1ADQ7xS4pERcutSrlz0hHYExuU=')
92+
end)
93+
end
94+
95+
g.test_grant_revoke_privileges_user = function(cg)
96+
cg.server:exec(function()
97+
box.schema.user.create('testuser', { password = 'foobar' })
98+
box.schema.user.grant('testuser', 'execute', 'universe')
99+
-- Grant privileges to the specified user --
100+
box.schema.user.grant('testuser', 'read', 'space', 'writers')
101+
box.schema.user.grant('testuser', 'read,write', 'space', 'books')
102+
-- End: Grant privileges to the specified user --
103+
box.session.su('testuser')
104+
local _, delete_writer_error = pcall(function()
105+
box.space.writers:delete(3)
106+
end)
107+
t.assert_equals(delete_writer_error:unpack().message, "Write access to space 'writers' is denied for user 'testuser'")
108+
109+
box.session.su('admin')
110+
-- Revoke space reading --
111+
box.schema.user.revoke('testuser', 'write', 'space', 'books')
112+
-- End: Revoke space reading --
113+
box.session.su('testuser')
114+
local _, delete_book_error = pcall(function()
115+
box.space.books:delete(10)
116+
end)
117+
t.assert_equals(delete_book_error:unpack().message, "Write access to space 'books' is denied for user 'testuser'")
118+
119+
box.session.su('admin')
120+
-- Revoke session --
121+
box.schema.user.revoke('testuser', 'session', 'universe')
122+
-- End: Revoke session --
123+
local _, change_user_error = pcall(function()
124+
box.session.su('testuser')
125+
end)
126+
t.assert_equals(change_user_error:unpack().message, "Session access to universe '' is denied for user 'testuser'")
127+
end)
128+
end
129+
130+
g.test_user_dropped = function(cg)
131+
cg.server:exec(function()
132+
box.schema.user.create('testuser')
133+
-- Drop a user --
134+
box.schema.user.drop('testuser')
135+
-- End: Drop a user --
136+
t.assert_equals(box.schema.user.exists('testuser'), false)
137+
end)
138+
end

‎doc/reference/reference_lua/box_schema/role_create.rst

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,10 @@ box.schema.role.create()
2222

2323
**Example:**
2424

25-
.. code-block:: lua
25+
.. literalinclude:: /code_snippets/test/access_control/grant_roles_test.lua
26+
:language: lua
27+
:start-after: Create roles
28+
:end-before: End: Create roles
29+
:dedent:
2630

27-
box.schema.role.create('Accountant')
28-
box.schema.role.create('Accountant', {if_not_exists = false})
31+
See also: :ref:`access_control_roles`.

‎doc/reference/reference_lua/box_schema/role_drop.rst

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,10 @@ box.schema.role.drop()
1818

1919
**Example:**
2020

21-
.. code-block:: lua
21+
.. literalinclude:: /code_snippets/test/access_control/grant_roles_test.lua
22+
:language: lua
23+
:start-after: Dropping a role
24+
:end-before: End: Dropping a role
25+
:dedent:
2226

23-
box.schema.role.drop('Accountant')
27+
See also: :ref:`access_control_roles`.

‎doc/reference/reference_lua/box_schema/role_exists.rst

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,4 @@ box.schema.role.exists()
1313
:param string role-name: the name of the role
1414
:rtype: bool
1515

16-
**Example:**
17-
18-
.. code-block:: lua
19-
20-
box.schema.role.exists('Accountant')
16+
See also: :ref:`access_control_roles_info`.

‎doc/reference/reference_lua/box_schema/role_grant.rst

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -12,29 +12,28 @@ box.schema.role.grant()
1212

1313
Grant :ref:`privileges <authentication-owners_privileges>` to a role.
1414

15-
:param string role-name: the name of the role.
16-
:param string privilege: 'read' or 'write' or 'execute' or 'create' or
17-
'alter' or 'drop' or a combination.
18-
:param string object-type: 'space' or 'function' or 'sequence' or 'role'.
19-
:param string object-name: the name of a function or space or sequence or role.
15+
:param string role-name: the name of the role
16+
:param string privilege: one or more :ref:`privileges <access_control_list_privileges>` to grant to the role (for example, ``read`` or ``read,write``)
17+
:param string object-type: a database :ref:`object type <access_control_list_objects>` to grant privileges to (for example, ``space``, ``role``, or ``function``)
18+
:param string object-name: the name of a function or space or sequence or role
2019
:param table option: ``if_not_exists`` = ``true|false`` (default = ``false``) - boolean;
2120
``true`` means there should be no error if the role already
22-
has the privilege.
21+
has the privilege
2322

2423
The role must exist, and the object must exist.
2524

26-
**Variation:** instead of ``object-type, object-name`` say 'universe'
25+
**Variation:** instead of ``object-type, object-name`` say ``universe``
2726
which means 'all object-types and all objects'. In this case, object name is omitted.
2827

2928
**Variation:** instead of ``privilege, object-type, object-name`` say
3029
``role-name`` -- to grant a role to a role.
3130

3231
**Example:**
3332

34-
.. code-block:: lua
33+
.. literalinclude:: /code_snippets/test/access_control/grant_roles_test.lua
34+
:language: lua
35+
:start-after: Grant read/write privileges to a role
36+
:end-before: Grant write privileges to a role
37+
:dedent:
3538

36-
box.schema.role.grant('Accountant', 'read', 'space', 'tester')
37-
box.schema.role.grant('Accountant', 'execute', 'function', 'f')
38-
box.schema.role.grant('Accountant', 'read,write', 'universe')
39-
box.schema.role.grant('public', 'Accountant')
40-
box.schema.role.grant('role1', 'role2', nil, nil, {if_not_exists=false})
39+
See also: :ref:`access_control_roles`.

‎doc/reference/reference_lua/box_schema/role_info.rst

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,4 @@ box.schema.role.info()
1212

1313
:param string role-name: the name of the role.
1414

15-
**Example:**
16-
17-
.. code-block:: lua
18-
19-
box.schema.role.info('Accountant')
15+
See also: :ref:`access_control_roles_info`.

‎doc/reference/reference_lua/box_schema/role_revoke.rst

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -10,26 +10,18 @@ box.schema.role.revoke()
1010

1111
Revoke :ref:`privileges <authentication-owners_privileges>` from a role.
1212

13-
:param string role-name: the name of the role.
14-
:param string privilege: 'read' or 'write' or 'execute' or 'create' or
15-
'alter' or 'drop' or a combination.
16-
:param string object-type: 'space' or 'function' or 'sequence' or 'role'.
17-
:param string object-name: the name of a function or space or sequence or role.
13+
:param string role-name: the name of the role
14+
:param string privilege: one or more :ref:`privileges <access_control_list_privileges>` to revoke from the role (for example, ``read`` or ``read,write``)
15+
:param string object-type: a database :ref:`object type <access_control_list_objects>` to revoke privileges from (for example, ``space``, ``role``, or ``function``)
16+
:param string object-name: the name of a database object to revoke privileges from
1817

1918
The role must exist, and the object must exist,
2019
but it is not an error if the role does not have the privilege.
2120

22-
**Variation:** instead of ``object-type, object-name`` say 'universe'
21+
**Variation:** instead of ``object-type, object-name`` say ``universe``
2322
which means 'all object-types and all objects'.
2423

2524
**Variation:** instead of ``privilege, object-type, object-name`` say
2625
``role-name``.
2726

28-
**Example:**
29-
30-
.. code-block:: lua
31-
32-
box.schema.role.revoke('Accountant', 'read', 'space', 'tester')
33-
box.schema.role.revoke('Accountant', 'execute', 'function', 'f')
34-
box.schema.role.revoke('Accountant', 'read,write', 'universe')
35-
box.schema.role.revoke('public', 'Accountant')
27+
See also: :ref:`access_control_roles`.

‎doc/reference/reference_lua/box_schema/user_create.rst

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ box.schema.user.create()
2121
* ``password`` (default = '') - string; the ``password`` = *password*
2222
specification is good because in a :ref:`URI <index-uri>`
2323
(Uniform Resource Identifier) it is usually illegal to include a
24-
user-name without a password.
24+
username without a password.
2525

2626
.. NOTE::
2727

@@ -34,8 +34,10 @@ box.schema.user.create()
3434

3535
**Examples:**
3636

37-
.. code-block:: lua
37+
.. literalinclude:: /code_snippets/test/access_control/grant_user_privileges_test.lua
38+
:language: lua
39+
:start-after: Create a user with a password
40+
:end-before: End: Create a user with a password
41+
:dedent:
3842

39-
box.schema.user.create('testuser')
40-
box.schema.user.create('testuser', {password = 'foobar'})
41-
box.schema.user.create('testuser', {if_not_exists = false})
43+
See also: :ref:`access_control_users`.

0 commit comments

Comments
 (0)