8000 Feature/roles (#3364) · MohammedDeveloper/arangodb@f240b8b · GitHub
[go: up one dir, main page]
Skip to content

Commit f240b8b

Browse files
fcellerfceller
authored
Feature/roles (arangodb#3364)
1 parent af3f977 commit f240b8b

File tree

8 files changed

+247
-44
lines changed

8 files changed

+247
-44
lines changed

‎CHANGELOG

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ devel
77
--ldap.roles-transformation
88
--ldap.roles-search
99
--ldap.superuser-role
10+
--ldap.roles-include
11+
--ldap.roles-exclude
1012

1113
* performance improvements for full collection scans and a few other operations
1214
in MMFiles engine

‎Documentation/Books/Manual/Administration/Configuration/Ldap.md

Lines changed: 152 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -3,30 +3,124 @@ LDAP
33

44
__This feature is available in the Enterprise Edition.__
55

6-
The basic options are `--ldap.enabled`, `--ldap.tls`, `--ldap.port`, `--ldap.server` and `--ldap.permissions-attribute-name`.
6+
Basics Concepts
7+
---------------
78

8-
`--ldap.server` and `--ldap.port` can be replace by `--ldap.url`.
9+
There are two modes of operation: *simple auth* and *bind+search*.
910

10-
The default for `--ldap.port` is *389*.
11+
The basic options for specifying how to access the LDAP server are
12+
`--ldap.enabled`, `--ldap.tls`, `--ldap.port`,
13+
`--ldap.server`. `--ldap.server` and `--ldap.port` can be replace by
14+
`--ldap.url`. The default for `--ldap.port` is *389*.
1115

12-
`--ldap.permissions-attribute-name` has the format *databse-name=(*|rw|none)[,database-name=(*|rw|none)]*.
16+
### Simple auth
1317

14-
There are two modes of operation: *simple auth* and *bind+search*.
18+
ArangoDB connects to the ldap server and authenticates with the
19+
username and password provided by the api authentication request. If
20+
ldap server verifies the the password then the user is authenticated.
21+
22+
If `--ldap.prefix` and/or `--ldap.suffix` is provided then the simple
23+
mode is selected.
24+
25+
In order to authorize the user for one or more databases there are two
26+
modes of operation: *database attribute* or *roles*.
27+
28+
#### Database attribute
1529

16-
### simple auth
30+
In this mode, an ldap sttribute of the user is used to specify the
31+
access levels within ldap. The database/collection access levels in
32+
ArangoDB are not used.
1733

18-
ArangoDB connects to the ldap server and authenticates with the username and password provided by the
19-
api authentication request and searches for the database permissions using the attribute name
20-
provided by `--ldap.permissions-attribute-name`.
34+
`--ldap.permissions-attribute-name` has the format
35+
*databse-name=(*|rw|none)[,database-name=(*|rw|none)]*.
2136

2237
Example:
2338

2439
--ldap.enabled true --ldap.server ldap.company.com \
2540
--ldap.permissions-attribute-name arangodbPermissions \
26-
--ldap.prefix uid= --ldap.suffix ,dc=company,dc=com
41+
--ldap.prefix uid= \
42+
--ldap.suffix ,dc=company,dc=com
43+
44+
`--ldap.prefix` and `--ldap.suffix` build the distinguished name
45+
(DN). ArangoDB trys to authenticate with *prefix* + *ArangoDB
46+
username* + *suffix* against the ldap server and searches for the
47+
database permissions.
48+
49+
dn: uid=fermi,dc=example,dc=com
50+
arangodbPermissions: foo=none,bar=rw
51+
52+
This will give *Administrate* access to *bar* and *No Acess* to *foo*.
53+
Note that this methods only allows to specify database access levels,
54+
not collection access levels.
55+
56+
#### Roles
57+
58+
In this mode, an ldap sttribute of the user is used to specify one or
59+
more roles for that users. The database/collection access levels for
60+
these roles defined in ArangoDB are then used.
61+
62+
Example:
63+
64+
--ldap.enabled true --ldap.server ldap.company.com \
65+
--ldap.roles-attribute-name groupMembership \
66+
--ldap.prefix uid= \
67+
--ldap.suffix ,dc=company,dc=com
68+
69+
`--ldap.prefix` and `--ldap.suffix` build the distinguished name
70+
(DN). ArangoDB trys to authenticate with *prefix* + *ArangoDB
71+
username* + *suffix* against the ldap server and searches for the
72+
roles in the attribute `groupMembership`.
73+
74+
dn: uid=fermi,dc=example,dc=com
75+
groupMembership: project-a
76+
groupMembership: project-b
77+
78+
This will give the combined permissions of the roles `project-a` and
79+
`project-b` to the user.
80+
81+
#### Roles transformations and filters
82+
83+
`--ldap.roles-include` can be used to specify a regular expression
84+
that is used to filter roles. Only roles that match the regular
85+
expression are used.
86+
87+
`--ldap.roles-exclude` can be used to specify a regular expression
88+
that is used to filter roles. Only roles that do not match the regular
89+
expression are used.
2790

28-
`--ldap.prefix` and `--ldap.suffix` build the distinguished name (DN). ArangoDB trys to authenticate
29-
with *prefix* + *ArangoDB username* + *suffix* against the ldap server and searches for the database permissions.
91+
`--ldap.roles-transformation` can be used to sepcify a regular
92+
expression and replacement text as `/re/text/`. This regular
93+
expression is apply to the role name found.
94+
95+
`--ldap.superuser-role` can be used to specify the role associated
96+
with the superuser. Any user belonging to this role gains superuser
97+
status. This role is checked before applying any regular expression.
98+
99+
Example:
100+
101+
--ldap.enabled true --ldap.server ldap.company.com \
102+
--ldap.roles-attribute-name groupMembership \
103+
--ldap.prefix uid= \
104+
--ldap.suffix ,dc=company,dc=com
105+
--ldap.roles-include "^arangodb"
106+
107+
will only consider roles that start with `arangodb`.
108+
109+
--ldap.enabled true --ldap.server ldap.company.com \
110+
--ldap.roles-attribute-name groupMembership \
111+
--ldap.prefix uid= \
112+
--ldap.suffix ,dc=company,dc=com
113+
--ldap.roles-exclude "disabled"
114+
115+
will only consider roles that do contain the word `disabled`.
116+
117+
--ldap.enabled true --ldap.server ldap.company.com \
118+
--ldap.roles-attribute-name groupMembership \
119+
--ldap.prefix uid= \
120+
--ldap.suffix ,dc=company,dc=com
121+
--ldap.superuser-role "arangodb-admin"
122+
123+
anyone belonging to the group "arangodb-admin" will become a superuser.
30124

31125
### bind+search
32126

@@ -36,43 +130,70 @@ Example with anonymous auth:
36130
--ldap.basedn dc=company,dc=com \
37131
--ldap.permissions-attribute-name arangodbPermissions
38132

39-
With this configuration ArangoDB binds anonymously to the ldap server and searches for the user.
40-
If the user is found a authentication is done with the users DN and password and then database permissions are fetched.
133+
With this configuration ArangoDB binds anonymously to the ldap server
134+
and searches for the user. If the user is found a authentication is
135+
done with the users DN and password and then database permissions are
136+
fetched.
41137

42138
Example with DN and password:
43139

44140
--ldap.enabled true --ldap.server ldap.company.com \
45141
--ldap.basedn dc=company,dc=com \
142+
--ldap.binddn cn=admin,dc=company,dc=com \
143+
--ldap.bindpasswd admin \
46144
--ldap.permissions-attribute-name arangodbPermissions
47-
--ldap.binddn cn=admin,dc=company,dc=com --ldap.bindpasswd admin
48145

49-
With this configuration ArangoDB binds with `--ldap.bindn` and `--ldap.bindpasswd` to the ldap server and searches for the user.
50-
If the user is found a authentication is done with the users DN and password and then database permissions are fetched.
146+
With this configuration ArangoDB binds with `--ldap.bindn` and
147+
`--ldap.bindpasswd` to the ldap server and searches for the user. If
148+
the user is found a authentication is done with the users DN and
149+
password and then database permissions are fetched.
150+
151+
#### Roles search
152+
153+
--ldap.roles-search search-expression
154+
155+
Instead of specifying a roles attribute it is possible to use a search
156+
when using *bind+search*. In this case the *search-expression* must be
157+
an ldap search string. Any `{USER}` is replaced by the `dn` of the
158+
user.
51159

52-
#### additional options
160+
Example:
161+
162+
--ldap.enabled true --ldap.server ldap.company.com \
163+
--ldap.basedn dc=company,dc=com \
164+
--ldap.binddn cn=admin,dc=company,dc=com \
165+
--ldap.bindpasswd admin \
166+
--ldap.roles-search '(&(objectClass=groupOfUniqueNames)(uniqueMember={USER}))'
53167

168+
### Additional options
54169

55170
--ldap.search-filter "objectClass=*"
56171

57-
Restrict the search to specific object classes. The default is `objectClass=*`.
172+
Restrict the search to specific object classes. The default is
173+
`objectClass=*`.
58174

59175
--ldap.search-attribute "uid"
60176

61-
`--ldap.search-attribute` specifies which attribute to compare with the *username*. The default is `uid`.
177+
`--ldap.search-attribute` specifies which attribute to compare with
178+
the *username*. The default is `uid`.
62179

63180
--ldap.search-scope sub
64181

65-
`--ldap.search-scope specifies in which scope to search for a user. Valid are one of *base*, *one* or *sub*. The default is *sub*.
182+
`--ldap.search-scope specifies in which scope to search for a
183+
user. Valid are one of *base*, *one* or *sub*. The default is *sub*.
66184

67-
### ldap url
185+
#### ldap url
68186

69187
--ldap.url ldap://ldap.server.com:1234/dc=example,dc=com?uid?sub
70188

71-
The ldap url consists of the ldap *server* and *port*, a *basedn*, a *search attribute* and a *scope* which can be one of *base*, *one* or *sub*.
189+
The ldap url consists of the ldap *server* and *port*, a *basedn*, a
190+
*search attribute* and a *scope* which can be one of *base*, *one* or
191+
*sub*.
72192

73193
### TLS options
74194

75-
A encrypted connection can be established with `--ldap.tls true` under UNIX and GNU/Linux platforms.
195+
A encrypted connection can be established with `--ldap.tls true` under
196+
UNIX and GNU/Linux platforms.
76197

77198
All following options are not available under Windows.
78199

@@ -86,16 +207,18 @@ The default is `1.2`. Available versions are `1.0`, `1.1` and `1.2`.
86207

87208
--ldap.tls-cert-check-strategy
88209

89-
The default is `hard`. Available strategies are `never`, `hard`, `demand`, `allow` and `try`.
210+
The default is `hard`. Available strategies are `never`, `hard`,
211+
`demand`, `allow` and `try`.
90212

91213
--ldap.tls-cacert-file
92214

93-
A file path to one or more (concatenated) certificate authority certificates in pem format.
94-
As default no file path is configured.
215+
A file path to one or more (concatenated) certificate authority
216+
certificates in pem format. As default no file path is configured.
95217

96218
Following option has no effect / does not work under macOS.
97219

98220
--ldap.tls-cacert-dir
99221

100-
A directory path to certificate authority certificates in [c_rehash](https://www.openssl.org/docs/man1.0.2/apps/c_rehash.html) format.
101-
As default no directory path is configured.
222+
A directory path to certificate authority certificates in
223+
[c_rehash](https://www.openssl.org/docs/man1.0.2/apps/c_rehash.html)
224+
format. As default no directory path is configured.

‎arangod/Utils/Authentication.h

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ class AuthenticationResult : public arangodb::Result {
4545
: Result(errorNumber), _authSource(source) {}
4646

4747
AuthenticationResult(
48-
std::unordered_map<std::string, std::string> const& permissions,
48+
std::unordered_map<std::string, AuthLevel> const& permissions,
4949
std::unordered_set<std::string> roles, AuthSource const& source)
5050
: Result(0),
5151
_authSource(source),
@@ -55,15 +55,15 @@ class AuthenticationResult : public arangodb::Result {
5555
public:
5656
AuthSource source() const { return _authSource; }
5757

58-
std::unordered_map<std::string, std::string> permissions() const {
58+
std::unordered_map<std::string, AuthLevel> permissions() const {
5959
return _permissions;
6060
}
6161

6262
std::unordered_set<std::string> roles() const { return _roles; }
6363

6464
protected:
6565
AuthSource _authSource;
66-
std::unordered_map<std::string, std::string> _permissions;
66+
std::unordered_map<std::string, AuthLevel> _permissions;
6767
std::unordered_set<std::string> _roles;
6868
};
6969

0 commit comments

Comments
 (0)
0