This repository was archived by the owner on Aug 28, 2019. It is now read-only.
File tree Expand file tree Collapse file tree 2 files changed +0
-20
lines changed
src/main/java/org/mozilla/taskcluster/client/auth Expand file tree Collapse file tree 2 files changed +0
-20
lines changed Original file line number Diff line number Diff line change @@ -20,9 +20,6 @@ calling TaskCluster APIs.
20
20
21
21
The client's scopes control the client's access to TaskCluster resources.
22
22
The scopes are *expanded* by substituting roles, as defined below.
23
- Every client has an implicit scope named `assume:client-id:<clientId>`,
24
- allowing additional access to be granted to the client without directly
25
- editing the client's scopes.
26
23
27
24
### Roles
28
25
A _role_ consists of a `roleId`, a set of scopes and a description.
@@ -36,13 +33,6 @@ located at the end of a `roleId`. If you have a role with the following
36
33
`roleId`: `my-prefix*`, then any client which has a scope staring with
37
34
`assume:my-prefix` will be allowed to assume the role.
38
35
39
- As previously mentioned each client gets the scope:
40
- `assume:client-id:<clientId>`, it trivially follows that you can create a
41
- role with the `roleId`: `client-id:<clientId>` to assign additional
42
- scopes to a client. You can also create a role `client-id:user-*`
43
- if you wish to assign a set of scopes to all clients whose `clientId`
44
- starts with `user-`.
45
-
46
36
### Guarded Services
47
37
The authentication service also has API end-points for delegating access
48
38
to some guarded service such as AWS S3, or Azure Table Storage.
Original file line number Diff line number Diff line change 26
26
*
27
27
* The client's scopes control the client's access to TaskCluster resources.
28
28
* The scopes are *expanded* by substituting roles, as defined below.
29
- * Every client has an implicit scope named `assume:client-id:<clientId>`,
30
- * allowing additional access to be granted to the client without directly
31
- * editing the client's scopes.
32
29
*
33
30
* ### Roles
34
31
* A _role_ consists of a `roleId`, a set of scopes and a description.
42
39
* `roleId`: `my-prefix*`, then any client which has a scope staring with
43
40
* `assume:my-prefix` will be allowed to assume the role.
44
41
*
45
- * As previously mentioned each client gets the scope:
46
- * `assume:client-id:<clientId>`, it trivially follows that you can create a
47
- * role with the `roleId`: `client-id:<clientId>` to assign additional
48
- * scopes to a client. You can also create a role `client-id:user-*`
49
- * if you wish to assign a set of scopes to all clients whose `clientId`
50
- * starts with `user-`.
51
- *
52
42
* ### Guarded Services
53
43
* The authentication service also has API end-points for delegating access
54
44
* to some guarded service such as AWS S3, or Azure Table Storage.
You can’t perform that action at this time.
0 commit comments