[v1.30] Dynamic user management docs #3092
Conversation
![orca-security-eu[bot]](https://avatars.githubusercontent.com/in/276244?s=60&v=4){kind=small}
There was a problem hiding this comment.
Orca Security Scan Summary
| Status | Check | Issues by priority | |
|---|---|---|---|
 Passed |
Infrastructure as Code |  0  0  0  0 |
View in Orca |
| Passed |
SAST | 0 0 0 0 |
View in Orca |
| Passed |
Secrets | 0 0 0 0 |
View in Orca |
| Passed |
Vulnerabilities | 0 0 0 0 |
View in Orca |
There was a problem hiding this comment.
Orca Security Scan Summary
| Status | Check | Issues by priority | |
|---|---|---|---|
| Passed |
Secrets | 0 0 0 0 |
View in Orca |
|
Great to see you again! Thanks for the contribution. |
|
|
||
| In Weaviate, Role-based access control (RBAC) allows you to define roles and assign permissions to those roles. Users can then be assigned to roles and inherit the permissions associated with those roles. | ||
|
|
||
| On this page, you will find examples of how to programmatically **manage users** and their associated roles with Weaviate client libraries. |
There was a problem hiding this comment.
Hey @g-despot I think this was ported over from an earlier version, but maybe it could be reviewed once again.
Reading this page, I wonder if "User" here could be clarified to use the term "Database user" where applicable as Sebastian mentioned in our discussion, to contrast against "OIDC user".
Then, user could mean: Union[Database user, OIDC user]. Wdyt?
There was a problem hiding this comment.
I agree, this could be a good place to introduce the different user types. I will also try to follow this naming convention where it makes sense Union[Database user, OIDC user]
| <!-- NOTE: left out AUTHORIZATION_ADMINLIST_USERS to dissuade usage --> | ||
| <!-- TODO[g-despot]: Check if DB_DYNAMIC is renamed --> | ||
| Under the hood, Weaviate differentiates three types of users: | ||
| - `DB_DYNAMIC`: Database users that can be fully managed through the API. |
There was a problem hiding this comment.
You have a todo here, but just another reminder re: naming ;)
|
|
||
| <ConfigureRbac /> | ||
|
|
||
| ## User management <i class="fas fa-user-edit"></i> {#user-management} |
There was a problem hiding this comment.
This is about the DB users, right?
Wdyt about a section like "Database user operations"? Reason being that 'manage' in "Manage users" of the page also seems to include updating user permissions
There was a problem hiding this comment.
As the list_all command also concerns OIDC users I wouldn't necessarily name the whole section "database users". Maybe this could work:
- User management
- List all users
- Create a database user
- Delete a database user
- Rotate database user API key
|
|
||
| On this page, you will find examples of how to programmatically **manage users** and their associated roles with Weaviate client libraries. | ||
|
|
||
| import ConfigureRbac from '/_includes/configuration/configure-rbac.mdx'; |
There was a problem hiding this comment.
I'm a little unsure about this section. It feels like an incomplete set of steps for configuring RBAC.
There was a problem hiding this comment.
Maybe it's not even needed on this page, will remove, but I would like to keep it on the "Manage roles" page as it's important to make the user aware of the user API being needed to assign roles to users.
| In Weaviate, Role-based access control (RBAC) allows you to define roles and assign permissions to those roles. Users can then be assigned to roles and inherit the permissions associated with those roles. | ||
|
|
||
| On this page, you will find examples of how to programmatically **manage users** and their associated roles with Weaviate client libraries. | ||
|
|
There was a problem hiding this comment.
Wdyt about introducing the three user tiers up here for clarity? That sets up the rest of the sections.
- DB_USER
- DB_ENV_USER
- OIDC
|
|
||
| ### List all users | ||
|
|
||
| This example shows how to get a list of all the users in Weaviate. |
There was a problem hiding this comment.
e.g. here, we would want to be clear what we mean by user. Whether these are just DB users, DB + DB_ENV users, or DB, DB_ENV and OIDC users with roles.
|
|
||
| </details> | ||
|
|
||
| ## User permissions management <i class="fas fa-user-lock"></i> {#user-permissions-management} |
There was a problem hiding this comment.
I think I might want to know what subset of users this applies to (e.g. DB + DB_ENV users)
There was a problem hiding this comment.
Orca Security Scan Summary
| Status | Check | Issues by priority | |
|---|---|---|---|
 Passed |
Secrets | 0 0 0 0 |
View in Orca |
What's being changed:
New documentation for managing users and API keys in Weaviate.
Type of change:
How Has This Been Tested?
yarn start