Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Platform] Implement RBAC #2793

Closed
ramkumarvs opened this issue Oct 30, 2019 · 0 comments
Closed

[Platform] Implement RBAC #2793

ramkumarvs opened this issue Oct 30, 2019 · 0 comments
Assignees
@Arnav15
Labels
area/platform Yugabyte Platform area/ui All issues relating to UI/UX

Comments

@ramkumarvs
Copy link
Contributor

Implement RBAC in platform side, with atleast two roles (admin and read-only).
@ramkumarvs ramkumarvs added area/ui All issues relating to UI/UX area/platform Yugabyte Platform labels Oct 30, 2019
Arnav15 added a commit that referenced this issue Dec 20, 2019
@Arnav15
#2793: Implement RBAC in Yugaware
a5f687a 
Summary:
This diff introduces the following things:
1) Additional check when running APIs against universes to verify they belong to the customer.
2) A User table to support multiple users for a customer. The users also have an associated role for RBAC. The registration now creates a customer and an admin user.
3) Migrate existing YWs to move customer level info to the Users table.
4) The session controller now uses the AuthToken/ApiToken at the user level rather than the customer.
5) Added RBAC so that read only users cannot access POST/PUT requests (other than for metrics)
6) New APIs to work with the Users (Create, Get, Delete and Change Role).
7) Updated insecure login to only allow read-only access and for insecure-logins to only work in single-tenant YWs.
8) Made corresponding changes to yugabyted to work correctly with the new insecure login.

Test Plan: Created a multi-tenant YW with version 2.0.6. Created two customers. Then upgraded the YW to the latest version and verified through the postgres table that the Users table got populated. Verified that YW worked as expected. Created two read only users and verified that it did not support POST/PUT requests.  Created a universe and verified that the read only user for the same customer could see the metrics as well as the universe information and that the other customer's users could not see the universe as well as access the universe even with the universe UUID in the URL.

Reviewers: sanketh, andrew, vit.pankin, ram, wesley

Reviewed By: ram, wesley

Subscribers: daniel, wesley, jenkins-bot, yugaware

Differential Revision: https://phabricator.dev.yugabyte.com/D7694
@Arnav15 Arnav15 closed this as completed Feb 18, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@Arnav15 Arnav15

Labels
area/platform Yugabyte Platform area/ui All issues relating to UI/UX
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@ramkumarvs @Arnav15