mirror of
https://github.com/opencloud-eu/opencloud.git
synced 2025-12-21 12:09:40 -06:00
Rebrand auth-{basic,bearer,machine,service}
This commit is contained in:
@@ -1,14 +1,14 @@
|
|||||||
# Auth-Basic
|
# Auth-Basic
|
||||||
|
|
||||||
The oCIS Auth Basic service provides basic authentication for those clients who cannot handle OpenID Connect. This should only be enabled for tests and development.
|
The OpenCloud Auth Basic service provides basic authentication for those clients who cannot handle OpenID Connect. This should only be enabled for tests and development.
|
||||||
|
|
||||||
The `auth-basic` service is responsible for validating authentication of incoming requests. To do so, it will use the configured `auth manager`, see the `Auth Managers` section. Only HTTP basic auth requests to ocis will involve the `auth-basic` service.
|
The `auth-basic` service is responsible for validating authentication of incoming requests. To do so, it will use the configured `auth manager`, see the `Auth Managers` section. Only HTTP basic auth requests to OpenCloud will involve the `auth-basic` service.
|
||||||
|
|
||||||
To enable `auth-basic`, you first must set `PROXY_ENABLE_BASIC_AUTH` to `true`.
|
To enable `auth-basic`, you first must set `PROXY_ENABLE_BASIC_AUTH` to `true`.
|
||||||
|
|
||||||
## The `auth` Service Family
|
## The `auth` Service Family
|
||||||
|
|
||||||
ocis uses serveral authentication services for different use cases. All services that start with `auth-` are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist:
|
OpenCloud uses serveral authentication services for different use cases. All services that start with `auth-` are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist:
|
||||||
- `auth-app` handles authentication of external 3rd party apps
|
- `auth-app` handles authentication of external 3rd party apps
|
||||||
- `auth-basic` handles basic authentication
|
- `auth-basic` handles basic authentication
|
||||||
- `auth-bearer` handles oidc authentication
|
- `auth-bearer` handles oidc authentication
|
||||||
@@ -21,11 +21,11 @@ Since the `auth-basic` service does not do any validation itself, it needs to be
|
|||||||
|
|
||||||
### LDAP Auth Manager
|
### LDAP Auth Manager
|
||||||
|
|
||||||
Setting `AUTH_BASIC_AUTH_MANAGER` to `"ldap"` will configure the `auth-basic` service to use LDAP as auth manager. This is the recommended option for running in a production and testing environment. More details on how to configure LDAP with ocis can be found in the admin docs.
|
Setting `AUTH_BASIC_AUTH_MANAGER` to `"ldap"` will configure the `auth-basic` service to use LDAP as auth manager. This is the recommended option for running in a production and testing environment. More details on how to configure LDAP with OpenCloud can be found in the admin docs.
|
||||||
|
|
||||||
### Other Auth Managers
|
### Other Auth Managers
|
||||||
|
|
||||||
oCIS currently supports no other auth manager
|
OpenCloud currently supports no other auth manager
|
||||||
|
|
||||||
## Scalability
|
## Scalability
|
||||||
|
|
||||||
|
|||||||
@@ -22,11 +22,11 @@ func GetCommands(cfg *config.Config) cli.Commands {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Execute is the entry point for the ocis-auth-basic command.
|
// Execute is the entry point for the opencloud auth-basic command.
|
||||||
func Execute(cfg *config.Config) error {
|
func Execute(cfg *config.Config) error {
|
||||||
app := clihelper.DefaultApp(&cli.App{
|
app := clihelper.DefaultApp(&cli.App{
|
||||||
Name: "auth-basic",
|
Name: "auth-basic",
|
||||||
Usage: "Provide basic authentication for oCIS",
|
Usage: "Provide basic authentication for OpenCloud",
|
||||||
Commands: GetCommands(cfg),
|
Commands: GetCommands(cfg),
|
||||||
})
|
})
|
||||||
|
|
||||||
|
|||||||
@@ -42,7 +42,7 @@ func Server(cfg *config.Config) *cli.Command {
|
|||||||
|
|
||||||
defer cancel()
|
defer cancel()
|
||||||
|
|
||||||
// the reva runtime calls `os.Exit` in the case of a failure and there is no way for the oCIS
|
// the reva runtime calls `os.Exit` in the case of a failure and there is no way for the OpenCloud
|
||||||
// runtime to catch it and restart a reva service. Therefore, we need to ensure the service has
|
// runtime to catch it and restart a reva service. Therefore, we need to ensure the service has
|
||||||
// everything it needs, before starting the service.
|
// everything it needs, before starting the service.
|
||||||
// In this case: CA certificates
|
// In this case: CA certificates
|
||||||
|
|||||||
@@ -53,7 +53,7 @@ type GRPCConfig struct {
|
|||||||
type AuthProviders struct {
|
type AuthProviders struct {
|
||||||
LDAP LDAPProvider `yaml:"ldap"`
|
LDAP LDAPProvider `yaml:"ldap"`
|
||||||
OwnCloudSQL OwnCloudSQLProvider `yaml:"owncloudsql"`
|
OwnCloudSQL OwnCloudSQLProvider `yaml:"owncloudsql"`
|
||||||
JSON JSONProvider `yaml:"json,omitempty"` // not supported by the oCIS product, therefore not part of docs
|
JSON JSONProvider `yaml:"json,omitempty"` // not supported by the OpenCloud product, therefore not part of docs
|
||||||
}
|
}
|
||||||
|
|
||||||
type JSONProvider struct {
|
type JSONProvider struct {
|
||||||
|
|||||||
@@ -4,7 +4,7 @@ import (
|
|||||||
"github.com/opencloud-eu/opencloud/services/auth-basic/pkg/config"
|
"github.com/opencloud-eu/opencloud/services/auth-basic/pkg/config"
|
||||||
)
|
)
|
||||||
|
|
||||||
// AuthBasicConfigFromStruct will adapt an oCIS config struct into a reva mapstructure to start a reva service.
|
// AuthBasicConfigFromStruct will adapt an OpenCloud config struct into a reva mapstructure to start a reva service.
|
||||||
func AuthBasicConfigFromStruct(cfg *config.Config) map[string]interface{} {
|
func AuthBasicConfigFromStruct(cfg *config.Config) map[string]interface{} {
|
||||||
rcfg := map[string]interface{}{
|
rcfg := map[string]interface{}{
|
||||||
"shared": map[string]interface{}{
|
"shared": map[string]interface{}{
|
||||||
|
|||||||
@@ -1,10 +1,10 @@
|
|||||||
# Auth-Bearer
|
# Auth-Bearer
|
||||||
|
|
||||||
The oCIS Auth Bearer service communicates with the configured OpenID Connect identity provider to authenticate requests. OpenID Connect is the default authentication mechanism for all clients: web, desktop and mobile. Basic auth is only used for testing and has to be explicity enabled.
|
The OpenCloud Auth Bearer service communicates with the configured OpenID Connect identity provider to authenticate requests. OpenID Connect is the default authentication mechanism for all clients: web, desktop and mobile. Basic auth is only used for testing and has to be explicity enabled.
|
||||||
|
|
||||||
## The `auth` Service Family
|
## The `auth` Service Family
|
||||||
|
|
||||||
ocis uses serveral authentication services for different use cases. All services that start with `auth-` are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist:
|
OpenCloud uses serveral authentication services for different use cases. All services that start with `auth-` are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist:
|
||||||
- `auth-app` handles authentication of external 3rd party apps
|
- `auth-app` handles authentication of external 3rd party apps
|
||||||
- `auth-basic` handles basic authentication
|
- `auth-basic` handles basic authentication
|
||||||
- `auth-bearer` handles oidc authentication
|
- `auth-bearer` handles oidc authentication
|
||||||
@@ -13,7 +13,7 @@ ocis uses serveral authentication services for different use cases. All services
|
|||||||
|
|
||||||
## Built in OpenID Connect Identity Provider
|
## Built in OpenID Connect Identity Provider
|
||||||
|
|
||||||
A default oCIS deployment will start a [built in OpenID Connect identity provider](https://github.com/owncloud/ocis/tree/master/services/idp) but can be configured to use an external one as well.
|
A default OpenCloud deployment will start a [built in OpenID Connect identity provider](https://github.com/opencloud-eu/opencloud/tree/master/services/idp) but can be configured to use an external one as well.
|
||||||
|
|
||||||
## Scalability
|
## Scalability
|
||||||
|
|
||||||
|
|||||||
@@ -25,11 +25,11 @@ func GetCommands(cfg *config.Config) cli.Commands {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Execute is the entry point for the ocis-auth-bearer command.
|
// Execute is the entry point for the opencloud auth-bearer command.
|
||||||
func Execute(cfg *config.Config) error {
|
func Execute(cfg *config.Config) error {
|
||||||
app := clihelper.DefaultApp(&cli.App{
|
app := clihelper.DefaultApp(&cli.App{
|
||||||
Name: "auth-bearer",
|
Name: "auth-bearer",
|
||||||
Usage: "Provide bearer authentication for oCIS",
|
Usage: "Provide bearer authentication for OpenCloud",
|
||||||
Commands: GetCommands(cfg),
|
Commands: GetCommands(cfg),
|
||||||
})
|
})
|
||||||
|
|
||||||
|
|||||||
@@ -5,7 +5,7 @@ import (
|
|||||||
"github.com/opencloud-eu/opencloud/services/auth-bearer/pkg/config"
|
"github.com/opencloud-eu/opencloud/services/auth-bearer/pkg/config"
|
||||||
)
|
)
|
||||||
|
|
||||||
// AuthBearerConfigFromStruct will adapt an oCIS config struct into a reva mapstructure to start a reva service.
|
// AuthBearerConfigFromStruct will adapt an OpenCloud config struct into a reva mapstructure to start a reva service.
|
||||||
func AuthBearerConfigFromStruct(cfg *config.Config) map[string]interface{} {
|
func AuthBearerConfigFromStruct(cfg *config.Config) map[string]interface{} {
|
||||||
return map[string]interface{}{
|
return map[string]interface{}{
|
||||||
"shared": map[string]interface{}{
|
"shared": map[string]interface{}{
|
||||||
|
|||||||
@@ -1,8 +1,8 @@
|
|||||||
# Auth-Machine
|
# Auth-Machine
|
||||||
|
|
||||||
The oCIS Auth Machine is used for interservice communication when using user impersonation.
|
The OpenCloud Auth Machine is used for interservice communication when using user impersonation.
|
||||||
|
|
||||||
ocis uses serveral authentication services for different use cases. All services that start with `auth-` are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist:
|
OpenCloud uses serveral authentication services for different use cases. All services that start with `auth-` are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist:
|
||||||
- `auth-app` handles authentication of external 3rd party apps
|
- `auth-app` handles authentication of external 3rd party apps
|
||||||
- `auth-basic` handles basic authentication
|
- `auth-basic` handles basic authentication
|
||||||
- `auth-bearer` handles oidc authentication
|
- `auth-bearer` handles oidc authentication
|
||||||
@@ -11,7 +11,7 @@ ocis uses serveral authentication services for different use cases. All services
|
|||||||
|
|
||||||
## User Impersonation
|
## User Impersonation
|
||||||
|
|
||||||
When one ocis service is trying to talk to other ocis services, it needs to authenticate itself. To do so, it will impersonate a user using the `auth-machine` service. It will then act on behalf of this user. Any action will show up as action of this specific user, which gets visible when e.g. logged in the audit log.
|
When one OpenCloud service is trying to talk to other OpenCloud services, it needs to authenticate itself. To do so, it will impersonate a user using the `auth-machine` service. It will then act on behalf of this user. Any action will show up as action of this specific user, which gets visible when e.g. logged in the audit log.
|
||||||
|
|
||||||
## Deprecation
|
## Deprecation
|
||||||
|
|
||||||
|
|||||||
@@ -22,11 +22,11 @@ func GetCommands(cfg *config.Config) cli.Commands {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Execute is the entry point for the ocis-auth-machine command.
|
// Execute is the entry point for the opencloud auth-machine command.
|
||||||
func Execute(cfg *config.Config) error {
|
func Execute(cfg *config.Config) error {
|
||||||
app := clihelper.DefaultApp(&cli.App{
|
app := clihelper.DefaultApp(&cli.App{
|
||||||
Name: "auth-machine",
|
Name: "auth-machine",
|
||||||
Usage: "Provide machine authentication for oCIS",
|
Usage: "Provide machine authentication for OpenCloud",
|
||||||
Commands: GetCommands(cfg),
|
Commands: GetCommands(cfg),
|
||||||
})
|
})
|
||||||
|
|
||||||
|
|||||||
@@ -4,7 +4,7 @@ import (
|
|||||||
"github.com/opencloud-eu/opencloud/services/auth-machine/pkg/config"
|
"github.com/opencloud-eu/opencloud/services/auth-machine/pkg/config"
|
||||||
)
|
)
|
||||||
|
|
||||||
// AuthMachineConfigFromStruct will adapt an oCIS config struct into a reva mapstructure to start a reva service.
|
// AuthMachineConfigFromStruct will adapt an OpenCloud config struct into a reva mapstructure to start a reva service.
|
||||||
func AuthMachineConfigFromStruct(cfg *config.Config) map[string]interface{} {
|
func AuthMachineConfigFromStruct(cfg *config.Config) map[string]interface{} {
|
||||||
return map[string]interface{}{
|
return map[string]interface{}{
|
||||||
"shared": map[string]interface{}{
|
"shared": map[string]interface{}{
|
||||||
|
|||||||
@@ -1,10 +1,10 @@
|
|||||||
# Auth-Service
|
# Auth-Service
|
||||||
|
|
||||||
The ocis Auth Service is used to authenticate service accounts. Compared to normal accounts, service accounts are ocis internal only and not available as ordinary users like via LDAP.
|
The OpenCloud Auth Service is used to authenticate service accounts. Compared to normal accounts, service accounts are OpenCloud internal only and not available as ordinary users like via LDAP.
|
||||||
|
|
||||||
## The `auth` Service Family
|
## The `auth` Service Family
|
||||||
|
|
||||||
ocis uses serveral authentication services for different use cases. All services that start with `auth-` are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist:
|
OpenCloud uses serveral authentication services for different use cases. All services that start with `auth-` are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist:
|
||||||
- `auth-app` handles authentication of external 3rd party apps
|
- `auth-app` handles authentication of external 3rd party apps
|
||||||
- `auth-basic` handles basic authentication
|
- `auth-basic` handles basic authentication
|
||||||
- `auth-bearer` handles oidc authentication
|
- `auth-bearer` handles oidc authentication
|
||||||
|
|||||||
@@ -22,11 +22,11 @@ func GetCommands(cfg *config.Config) cli.Commands {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Execute is the entry point for the ocis-auth-service command.
|
// Execute is the entry point for the opencloud auth-service command.
|
||||||
func Execute(cfg *config.Config) error {
|
func Execute(cfg *config.Config) error {
|
||||||
app := clihelper.DefaultApp(&cli.App{
|
app := clihelper.DefaultApp(&cli.App{
|
||||||
Name: "auth-service",
|
Name: "auth-service",
|
||||||
Usage: "Provide service authentication for oCIS",
|
Usage: "Provide service authentication for OpenCloud",
|
||||||
Commands: GetCommands(cfg),
|
Commands: GetCommands(cfg),
|
||||||
})
|
})
|
||||||
|
|
||||||
|
|||||||
@@ -4,7 +4,7 @@ import (
|
|||||||
"github.com/opencloud-eu/opencloud/services/auth-service/pkg/config"
|
"github.com/opencloud-eu/opencloud/services/auth-service/pkg/config"
|
||||||
)
|
)
|
||||||
|
|
||||||
// AuthMachineConfigFromStruct will adapt an oCIS config struct into a reva mapstructure to start a reva service.
|
// AuthMachineConfigFromStruct will adapt an OpenCloud config struct into a reva mapstructure to start a reva service.
|
||||||
func AuthMachineConfigFromStruct(cfg *config.Config) map[string]interface{} {
|
func AuthMachineConfigFromStruct(cfg *config.Config) map[string]interface{} {
|
||||||
return map[string]interface{}{
|
return map[string]interface{}{
|
||||||
"core": map[string]interface{}{
|
"core": map[string]interface{}{
|
||||||
|
|||||||
Reference in New Issue
Block a user