Rebrand auth-{basic,bearer,machine,service}

This commit is contained in:
André Duffeck
2025-01-16 13:56:16 +01:00
parent 31965a8f9d
commit c982a81135
14 changed files with 27 additions and 27 deletions

View File

@@ -1,14 +1,14 @@
# Auth-Basic # Auth-Basic
The oCIS Auth Basic service provides basic authentication for those clients who cannot handle OpenID Connect. This should only be enabled for tests and development. The OpenCloud Auth Basic service provides basic authentication for those clients who cannot handle OpenID Connect. This should only be enabled for tests and development.
The `auth-basic` service is responsible for validating authentication of incoming requests. To do so, it will use the configured `auth manager`, see the `Auth Managers` section. Only HTTP basic auth requests to ocis will involve the `auth-basic` service. The `auth-basic` service is responsible for validating authentication of incoming requests. To do so, it will use the configured `auth manager`, see the `Auth Managers` section. Only HTTP basic auth requests to OpenCloud will involve the `auth-basic` service.
To enable `auth-basic`, you first must set `PROXY_ENABLE_BASIC_AUTH` to `true`. To enable `auth-basic`, you first must set `PROXY_ENABLE_BASIC_AUTH` to `true`.
## The `auth` Service Family ## The `auth` Service Family
ocis uses serveral authentication services for different use cases. All services that start with `auth-` are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist: OpenCloud uses serveral authentication services for different use cases. All services that start with `auth-` are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist:
- `auth-app` handles authentication of external 3rd party apps - `auth-app` handles authentication of external 3rd party apps
- `auth-basic` handles basic authentication - `auth-basic` handles basic authentication
- `auth-bearer` handles oidc authentication - `auth-bearer` handles oidc authentication
@@ -21,11 +21,11 @@ Since the `auth-basic` service does not do any validation itself, it needs to be
### LDAP Auth Manager ### LDAP Auth Manager
Setting `AUTH_BASIC_AUTH_MANAGER` to `"ldap"` will configure the `auth-basic` service to use LDAP as auth manager. This is the recommended option for running in a production and testing environment. More details on how to configure LDAP with ocis can be found in the admin docs. Setting `AUTH_BASIC_AUTH_MANAGER` to `"ldap"` will configure the `auth-basic` service to use LDAP as auth manager. This is the recommended option for running in a production and testing environment. More details on how to configure LDAP with OpenCloud can be found in the admin docs.
### Other Auth Managers ### Other Auth Managers
oCIS currently supports no other auth manager OpenCloud currently supports no other auth manager
## Scalability ## Scalability

View File

@@ -22,11 +22,11 @@ func GetCommands(cfg *config.Config) cli.Commands {
} }
} }
// Execute is the entry point for the ocis-auth-basic command. // Execute is the entry point for the opencloud auth-basic command.
func Execute(cfg *config.Config) error { func Execute(cfg *config.Config) error {
app := clihelper.DefaultApp(&cli.App{ app := clihelper.DefaultApp(&cli.App{
Name: "auth-basic", Name: "auth-basic",
Usage: "Provide basic authentication for oCIS", Usage: "Provide basic authentication for OpenCloud",
Commands: GetCommands(cfg), Commands: GetCommands(cfg),
}) })

View File

@@ -42,7 +42,7 @@ func Server(cfg *config.Config) *cli.Command {
defer cancel() defer cancel()
// the reva runtime calls `os.Exit` in the case of a failure and there is no way for the oCIS // the reva runtime calls `os.Exit` in the case of a failure and there is no way for the OpenCloud
// runtime to catch it and restart a reva service. Therefore, we need to ensure the service has // runtime to catch it and restart a reva service. Therefore, we need to ensure the service has
// everything it needs, before starting the service. // everything it needs, before starting the service.
// In this case: CA certificates // In this case: CA certificates

View File

@@ -53,7 +53,7 @@ type GRPCConfig struct {
type AuthProviders struct { type AuthProviders struct {
LDAP LDAPProvider `yaml:"ldap"` LDAP LDAPProvider `yaml:"ldap"`
OwnCloudSQL OwnCloudSQLProvider `yaml:"owncloudsql"` OwnCloudSQL OwnCloudSQLProvider `yaml:"owncloudsql"`
JSON JSONProvider `yaml:"json,omitempty"` // not supported by the oCIS product, therefore not part of docs JSON JSONProvider `yaml:"json,omitempty"` // not supported by the OpenCloud product, therefore not part of docs
} }
type JSONProvider struct { type JSONProvider struct {

View File

@@ -4,7 +4,7 @@ import (
"github.com/opencloud-eu/opencloud/services/auth-basic/pkg/config" "github.com/opencloud-eu/opencloud/services/auth-basic/pkg/config"
) )
// AuthBasicConfigFromStruct will adapt an oCIS config struct into a reva mapstructure to start a reva service. // AuthBasicConfigFromStruct will adapt an OpenCloud config struct into a reva mapstructure to start a reva service.
func AuthBasicConfigFromStruct(cfg *config.Config) map[string]interface{} { func AuthBasicConfigFromStruct(cfg *config.Config) map[string]interface{} {
rcfg := map[string]interface{}{ rcfg := map[string]interface{}{
"shared": map[string]interface{}{ "shared": map[string]interface{}{

View File

@@ -1,10 +1,10 @@
# Auth-Bearer # Auth-Bearer
The oCIS Auth Bearer service communicates with the configured OpenID Connect identity provider to authenticate requests. OpenID Connect is the default authentication mechanism for all clients: web, desktop and mobile. Basic auth is only used for testing and has to be explicity enabled. The OpenCloud Auth Bearer service communicates with the configured OpenID Connect identity provider to authenticate requests. OpenID Connect is the default authentication mechanism for all clients: web, desktop and mobile. Basic auth is only used for testing and has to be explicity enabled.
## The `auth` Service Family ## The `auth` Service Family
ocis uses serveral authentication services for different use cases. All services that start with `auth-` are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist: OpenCloud uses serveral authentication services for different use cases. All services that start with `auth-` are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist:
- `auth-app` handles authentication of external 3rd party apps - `auth-app` handles authentication of external 3rd party apps
- `auth-basic` handles basic authentication - `auth-basic` handles basic authentication
- `auth-bearer` handles oidc authentication - `auth-bearer` handles oidc authentication
@@ -13,7 +13,7 @@ ocis uses serveral authentication services for different use cases. All services
## Built in OpenID Connect Identity Provider ## Built in OpenID Connect Identity Provider
A default oCIS deployment will start a [built in OpenID Connect identity provider](https://github.com/owncloud/ocis/tree/master/services/idp) but can be configured to use an external one as well. A default OpenCloud deployment will start a [built in OpenID Connect identity provider](https://github.com/opencloud-eu/opencloud/tree/master/services/idp) but can be configured to use an external one as well.
## Scalability ## Scalability

View File

@@ -25,11 +25,11 @@ func GetCommands(cfg *config.Config) cli.Commands {
} }
} }
// Execute is the entry point for the ocis-auth-bearer command. // Execute is the entry point for the opencloud auth-bearer command.
func Execute(cfg *config.Config) error { func Execute(cfg *config.Config) error {
app := clihelper.DefaultApp(&cli.App{ app := clihelper.DefaultApp(&cli.App{
Name: "auth-bearer", Name: "auth-bearer",
Usage: "Provide bearer authentication for oCIS", Usage: "Provide bearer authentication for OpenCloud",
Commands: GetCommands(cfg), Commands: GetCommands(cfg),
}) })

View File

@@ -5,7 +5,7 @@ import (
"github.com/opencloud-eu/opencloud/services/auth-bearer/pkg/config" "github.com/opencloud-eu/opencloud/services/auth-bearer/pkg/config"
) )
// AuthBearerConfigFromStruct will adapt an oCIS config struct into a reva mapstructure to start a reva service. // AuthBearerConfigFromStruct will adapt an OpenCloud config struct into a reva mapstructure to start a reva service.
func AuthBearerConfigFromStruct(cfg *config.Config) map[string]interface{} { func AuthBearerConfigFromStruct(cfg *config.Config) map[string]interface{} {
return map[string]interface{}{ return map[string]interface{}{
"shared": map[string]interface{}{ "shared": map[string]interface{}{

View File

@@ -1,8 +1,8 @@
# Auth-Machine # Auth-Machine
The oCIS Auth Machine is used for interservice communication when using user impersonation. The OpenCloud Auth Machine is used for interservice communication when using user impersonation.
ocis uses serveral authentication services for different use cases. All services that start with `auth-` are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist: OpenCloud uses serveral authentication services for different use cases. All services that start with `auth-` are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist:
- `auth-app` handles authentication of external 3rd party apps - `auth-app` handles authentication of external 3rd party apps
- `auth-basic` handles basic authentication - `auth-basic` handles basic authentication
- `auth-bearer` handles oidc authentication - `auth-bearer` handles oidc authentication
@@ -11,7 +11,7 @@ ocis uses serveral authentication services for different use cases. All services
## User Impersonation ## User Impersonation
When one ocis service is trying to talk to other ocis services, it needs to authenticate itself. To do so, it will impersonate a user using the `auth-machine` service. It will then act on behalf of this user. Any action will show up as action of this specific user, which gets visible when e.g. logged in the audit log. When one OpenCloud service is trying to talk to other OpenCloud services, it needs to authenticate itself. To do so, it will impersonate a user using the `auth-machine` service. It will then act on behalf of this user. Any action will show up as action of this specific user, which gets visible when e.g. logged in the audit log.
## Deprecation ## Deprecation

View File

@@ -22,11 +22,11 @@ func GetCommands(cfg *config.Config) cli.Commands {
} }
} }
// Execute is the entry point for the ocis-auth-machine command. // Execute is the entry point for the opencloud auth-machine command.
func Execute(cfg *config.Config) error { func Execute(cfg *config.Config) error {
app := clihelper.DefaultApp(&cli.App{ app := clihelper.DefaultApp(&cli.App{
Name: "auth-machine", Name: "auth-machine",
Usage: "Provide machine authentication for oCIS", Usage: "Provide machine authentication for OpenCloud",
Commands: GetCommands(cfg), Commands: GetCommands(cfg),
}) })

View File

@@ -4,7 +4,7 @@ import (
"github.com/opencloud-eu/opencloud/services/auth-machine/pkg/config" "github.com/opencloud-eu/opencloud/services/auth-machine/pkg/config"
) )
// AuthMachineConfigFromStruct will adapt an oCIS config struct into a reva mapstructure to start a reva service. // AuthMachineConfigFromStruct will adapt an OpenCloud config struct into a reva mapstructure to start a reva service.
func AuthMachineConfigFromStruct(cfg *config.Config) map[string]interface{} { func AuthMachineConfigFromStruct(cfg *config.Config) map[string]interface{} {
return map[string]interface{}{ return map[string]interface{}{
"shared": map[string]interface{}{ "shared": map[string]interface{}{

View File

@@ -1,10 +1,10 @@
# Auth-Service # Auth-Service
The ocis Auth Service is used to authenticate service accounts. Compared to normal accounts, service accounts are ocis internal only and not available as ordinary users like via LDAP. The OpenCloud Auth Service is used to authenticate service accounts. Compared to normal accounts, service accounts are OpenCloud internal only and not available as ordinary users like via LDAP.
## The `auth` Service Family ## The `auth` Service Family
ocis uses serveral authentication services for different use cases. All services that start with `auth-` are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist: OpenCloud uses serveral authentication services for different use cases. All services that start with `auth-` are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist:
- `auth-app` handles authentication of external 3rd party apps - `auth-app` handles authentication of external 3rd party apps
- `auth-basic` handles basic authentication - `auth-basic` handles basic authentication
- `auth-bearer` handles oidc authentication - `auth-bearer` handles oidc authentication

View File

@@ -22,11 +22,11 @@ func GetCommands(cfg *config.Config) cli.Commands {
} }
} }
// Execute is the entry point for the ocis-auth-service command. // Execute is the entry point for the opencloud auth-service command.
func Execute(cfg *config.Config) error { func Execute(cfg *config.Config) error {
app := clihelper.DefaultApp(&cli.App{ app := clihelper.DefaultApp(&cli.App{
Name: "auth-service", Name: "auth-service",
Usage: "Provide service authentication for oCIS", Usage: "Provide service authentication for OpenCloud",
Commands: GetCommands(cfg), Commands: GetCommands(cfg),
}) })

View File

@@ -4,7 +4,7 @@ import (
"github.com/opencloud-eu/opencloud/services/auth-service/pkg/config" "github.com/opencloud-eu/opencloud/services/auth-service/pkg/config"
) )
// AuthMachineConfigFromStruct will adapt an oCIS config struct into a reva mapstructure to start a reva service. // AuthMachineConfigFromStruct will adapt an OpenCloud config struct into a reva mapstructure to start a reva service.
func AuthMachineConfigFromStruct(cfg *config.Config) map[string]interface{} { func AuthMachineConfigFromStruct(cfg *config.Config) map[string]interface{} {
return map[string]interface{}{ return map[string]interface{}{
"core": map[string]interface{}{ "core": map[string]interface{}{