Root user cannot rotate passwords

[martelli]

Is your feature request related to a problem? Please describe.

As documented in the tests, the principals rotate-credentials command is "self" privilege.

But the cli documentation shows an explicit principal is required, inducing one to think that the root user should be able to request a credential rotation for other users.

Any particular reason for not allowing the root user to perform credential rotation for other users?

Describe the solution you'd like

The root principal should be allowed to rotate credentials of other principals.

This would make it simpler in the case a regular principal needs new credentials after losing the original ones, as we wouldn't need to generate the ids and secrets ourselves.

Describe alternatives you've considered

We could always use the principals reset, but this requires knwowing the id and secret patterns in order to generate valid values.

Additional context

No response

[MonkeyCanCode]

Hi @martelli,

Based on what I recalled, the root can indeed reset credential (both id and secret) for other principals:

polaris principals reset some_user

Thanks,
Yong Zheng

[dimas-b]

@martelli : as @MonkeyCanCode noted, this may be just a naming confusion. In Polaris "rotate" means a user's own request to make new credentials based on the user's old (valid) password. Root users can "reset" any user's credentials authenticating with the root password even if the user's credentials have expired.

[dimas-b]

We could always use the principals reset, but this requires knwowing the id and secret patterns in order to generate valid values.

The client (user) ID does have to be known.

However, the new secret value is optional in reset requests. If not provided, the server will general a random secret automatically.

[dimas-b]

Correction: Only the principal name is required for reset. If Client ID is not provided, the current one will be reused.

[MonkeyCanCode]

@martelli does above answered your questions? If not other issues, should we close this issue?