Skip to content

Commit

Permalink
docs: apply suggested improvements
Browse files Browse the repository at this point in the history
  • Loading branch information
aneojgurhem committed Oct 11, 2024
1 parent 3234a1c commit 33ea992
Showing 1 changed file with 12 additions and 12 deletions.
24 changes: 12 additions & 12 deletions .docs/content/1.concepts/3.authentication.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,11 +23,11 @@ ArmoniK allows users to impersonate other users by adding an impersonation heade

ArmoniK uses a User-Role-Permission based approach to handle authorization. Each user in the database can have a set of **Roles**. Each role contains a set of **Permissions**. A user cannot receive permissions directly, instead roles containing the permissions have to be created and given to the user. A permission is defined as a string in a specific format.
The current version handles the following types of permissions :
|Format|Example|Parameters|Description|
---|---|---|---|
``General:Impersonate:<Rolename>``|``General:Impersonate:Monitoring``|**Rolename**: Name of a role|Grants the right to impersonate a user with the role named \<Rolename\>. See [Impersonation](#impersonation) for details|
|``<Service>:<Name>``|``Submitter:CreateSession``|**Service**: Name of an ArmoniK web service<br>**Name**: Name of the endpoint|Grants the right to use the endpoint named \<Name\> of the service named \<Service\>|
|``<Service>:<Name>:<Target>``|``Submitter:CancelSession:Self``|**Service**: Name of an ArmoniK web service<br>**Name**: Name of the endpoint<br>**Target**: Target or scope of the permission|Same as ``<Service>:<Name>`` as ``<Target>`` is currently unused|
| Format | Example | Parameters | Description |
|------------------------------------|------------------------------------|--------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------|
| ``General:Impersonate:<Rolename>`` | ``General:Impersonate:Monitoring`` | **Rolename**: Name of a role | Grants the right to impersonate a user with the role named \<Rolename\>. See [Impersonation](#impersonation) for details |
| ``<Service>:<Name>`` | ``Submitter:CreateSession`` | **Service**: Name of an ArmoniK web service<br>**Name**: Name of the endpoint | Grants the right to use the endpoint named \<Name\> of the service named \<Service\> |
| ``<Service>:<Name>:<Target>`` | ``Submitter:CancelSession:Self`` | **Service**: Name of an ArmoniK web service<br>**Name**: Name of the endpoint<br>**Target**: Target or scope of the permission | Same as ``<Service>:<Name>`` as ``<Target>`` is currently unused |

## User authorization

Expand Down Expand Up @@ -60,7 +60,7 @@ flowchart TB

## User administration

Users, roles, permissions and certificates are stored and managed by ArmoniK via environment variables provided to the control plane and compute plane. Administrators in charge of handling user permissions can refer to this section to manage user permissions.
Users, roles, permissions and certificates are stored and managed by ArmoniK via environment variables provided to the control plane and compute plane by the administrator during deployment. Administrators in charge of handling user permissions can refer to this section to manage user permissions.

### Populating the internal MongoDB when deploying ArmoniK

Expand All @@ -83,19 +83,19 @@ In order to function properly, the authentication needs to have the following co
- Handles the association between a user and its roles
- Requires the following fields
- Name : Unique user name
- Roles : list of objectIds, each matching the _id field in RoleData of the roles given to the user
- Roles : list of role names, each matching the Name field of the roles given to the user
- List of [Role](../../../Common/src/Injection/Options/Database/User.cs)
- Handles the association between a role and its permissions
- Requires the following fields
- Name : Unique role name
- Permissions : list of strings corresponding to the permissions of the role

These collections of object needs to be provided as JSON objects as detailled in the following sections.
These collections of object need to be provided as JSON objects as detailled in the following sections.

#### Environment variables base

An InitServices options class was introduced to initialize services.
It contains two classes : Authentication and Partitionning to configure authentications and Partitions respectively.
It contains two classes : Authentication and Partitionning to configure authentication and partitions respectively.
Authentication has several list of strings as fields: UserCertificates, Roles and Users.
Those fields are JSON strings that are deserialized into corresponding objects that will be inserted into the database.

Expand Down Expand Up @@ -125,21 +125,21 @@ InitServices__Authentication__Roles__1='{"Name": "Role2", "Permissions": ["Submi

#### Specify users

To specify a user with the name "User1" with the role "Role1", use the following command :
To specify a user with the name "User1" with the role "Role1", use the following command:

```bash
InitServices__Authentication__Users__0='{"Name": "User1", "Roles": ["Role1"]})'
```

#### Specify certificates

To insert a certificate with Common Name "CN1" and Fingerprint "FP1" associated with the user with the User called "User1", use the following command :
To insert a certificate with Common Name "CN1" and Fingerprint "FP1" associated with the User called "User1", use the following command:

```javascript
InitServices__Authentication__UserCertificates__0='{"User": "User1", "CN": "CN1", "Fingerprint": "FP1"}'
```

To insert an entry matching all certificates with Common Name "CN1" associated with user with UserId "62f4efe6d82645e26e09584f", use the following command :
To insert an entry matching all certificates with Common Name "CN1" associated with the User called "User1", use the following command:

```javascript
InitServices__Authentication__UserCertificates__0='{"User": "User1", "CN": "CN1"}'
Expand Down

0 comments on commit 33ea992

Please sign in to comment.