Configuration: document the 'credentials' option #4035

andreyaksenov · 2024-02-08T08:03:40Z

New/updated topics

Created a new Credentials topic in the Configuration section. Note that main concepts of access control system is described in the reworked Access control topic (PR: Rework the Access control topic #4024).
Added a link to a new topic in the main Configuration topic.

New reference sections

Changes not directly related to this PR

Given that a privilege is a container for a permission and a corresponding object, it is necessary to clarify terminology in the existing Access control topic and related admin functions. So, privilege is changed to permission where applicable:

Topic:

https://docs.d.tarantool.io/en/doc/access-control-configuration/book/admin/access_control/

Reference - Updated signatures and descriptions:

Lord-KA

Thanks for the patchset! See my 6 comments on the privileges/permissions patch below.

doc/book/admin/access_control.rst

Lord-KA

Credentials part of the patchset looks good, LGTM. See my only proposal below.

Lord-KA · 2024-02-14T11:03:29Z

doc/reference/configuration/configuration_reference.rst

+credentials.roles.*
+~~~~~~~~~~~~~~~~~~~


Personally, I would prefer to have user section before role, because it has the primary meaning.

p7nov

Nice, just some minor comments from my side.

p7nov · 2024-02-15T04:44:25Z

doc/concepts/configuration.rst

@@ -395,18 +395,15 @@ Access control
 ~~~~~~~~~~~~~~

 The ``credentials`` section allows you to create users and grant them the specified privileges.
-In the example below, there are two users:
+In the example below, a password for the built-in 'admin' user is set:


Suggested change

In the example below, a password for the built-in 'admin' user is set:

In the example below, a password for the built-in ``admin`` user is set:

Omg, here is a new dbadmin user is created, fixed:

p7nov · 2024-02-15T04:49:47Z

doc/concepts/configuration/configuration_credentials.rst

+You can read more about the main concepts of Tarantool access control system in the :ref:`authentication` section.
+
+This topic describes how to create users and grant them the specified privileges in the :ref:`credentials <configuration_reference_credentials>` section of a YAML configuration.
+This might be used to create specific users used in communications between Tarantool instances.


Used to create users used - needs rephrasing.
Also, specific and specified seem redundant in sentences of this paragraphs. It's better to keep short.

If I get it right, these replication and sharding users are necessary in case of a sharded cluster (which is the main use case of Tarantool 3.0). If it's true, I'd expect a stronger wording expressing this, not just might be used.

Al right, the last comment on this paragraph =)
The only example made me think that this section is only for such technical users, while regular users are created from the Lua console. Maybe a bit more explicit explanation?

Decided to remove the second sentence at all:

This topic describes how to create users and grant them the specified privileges in the :ref:`credentials <configuration_reference_credentials>` section of a YAML configuration. For example, you can define users with the ``replication`` and ``sharding`` roles to maintain :ref:`replication <replication-master_replica_configuring_credentials>` and sharding in a Tarantool cluster.

p7nov · 2024-02-15T05:02:44Z

doc/concepts/configuration/configuration_credentials.rst

+    :end-at: [ writers_space_reader ]
+    :dedent:
+
+Apart from assigning a role to a user, you can grant specific privileges directly using :ref:`credentials.users.\<username\>.privileges <configuration_reference_credentials_users_name_privileges>`.


Nit: intro part Apart from assigning a role to a user doesn't seem to add meaning, so I'd drop it to keep short. Up to you.

Idea: maybe make separate headings Granting roles and Granting privileges to make the right ToC more explicit?

p7nov · 2024-02-15T05:10:58Z

doc/reference/configuration/configuration_reference.rst


 .. confval:: <user_or_role_name>.privileges.permissions

+    Permissions assigned to this user or a user with this role.


Possible values?

Thanks, added a link https://www.tarantool.io/en/doc/latest/book/admin/access_control/#access-control-list-privileges.

andreyaksenov linked an issue Feb 8, 2024 that may be closed by this pull request

[Config] Document the 'credentials' option #3666

Closed

andreyaksenov force-pushed the access-control-configuration branch 3 times, most recently from ea999ec to 9138851 Compare February 8, 2024 09:49

andreyaksenov linked an issue Feb 8, 2024 that may be closed by this pull request

config.context: define cluster config parts in env/file #3954

Closed

andreyaksenov force-pushed the access-control-configuration branch 10 times, most recently from 949cf7d to 1750c3d Compare February 9, 2024 07:56

andreyaksenov changed the title ~~Config credentials: sample~~ Configuration: Create the Credentials topic Feb 9, 2024

andreyaksenov changed the title ~~Configuration: Create the Credentials topic~~ Configuration: document the 'credentials' option Feb 9, 2024

andreyaksenov force-pushed the access-control-configuration branch 13 times, most recently from 707582d to 232d204 Compare February 12, 2024 14:21

andreyaksenov force-pushed the access-control-configuration branch 16 times, most recently from 328befc to cc629f0 Compare February 13, 2024 09:05

andreyaksenov added 3 commits February 13, 2024 12:17

Config credentials

ebed02a

Config credentials: reference

8ce794e

Config credentials: privilege -> permission

377fe57

andreyaksenov force-pushed the access-control-configuration branch from cc629f0 to 377fe57 Compare February 13, 2024 09:17

Lord-KA reviewed Feb 13, 2024

View reviewed changes

Totktonada removed their request for review February 13, 2024 11:38

Config credentials: privilege -> permission - update per review

e4a1892

Lord-KA approved these changes Feb 14, 2024

View reviewed changes

andreyaksenov requested review from p7nov and removed request for ImeevMA February 14, 2024 14:09

p7nov approved these changes Feb 15, 2024

View reviewed changes

Config credentials: privilege -> permission - update per TW review

5c9c83f

andreyaksenov merged commit 1f7a33a into latest Feb 15, 2024
1 check passed

andreyaksenov deleted the access-control-configuration branch February 15, 2024 08:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Configuration: document the 'credentials' option #4035

Configuration: document the 'credentials' option #4035

andreyaksenov commented Feb 8, 2024 •

edited

Loading

Lord-KA left a comment

Lord-KA left a comment

Lord-KA Feb 14, 2024

p7nov left a comment

p7nov Feb 15, 2024

andreyaksenov Feb 15, 2024

p7nov Feb 15, 2024

p7nov Feb 15, 2024

p7nov Feb 15, 2024

andreyaksenov Feb 15, 2024

p7nov Feb 15, 2024

p7nov Feb 15, 2024

p7nov Feb 15, 2024

andreyaksenov Feb 15, 2024

	In the example below, a password for the built-in 'admin' user is set:
	In the example below, a password for the built-in ``admin`` user is set:


		.. confval:: <user_or_role_name>.privileges.permissions

		Permissions assigned to this user or a user with this role.

		credentials.roles.*
		~~~~~~~~~~~~~~~~~~~

Configuration: document the 'credentials' option #4035

Configuration: document the 'credentials' option #4035

Conversation

andreyaksenov commented Feb 8, 2024 • edited Loading

New/updated topics

New reference sections

Changes not directly related to this PR

Lord-KA left a comment

Choose a reason for hiding this comment

Lord-KA left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

p7nov left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

andreyaksenov commented Feb 8, 2024 •

edited

Loading