Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Namespaces and users in backup and metrics role #9

Open
dvzrv opened this issue Aug 26, 2024 · 0 comments
Open

Namespaces and users in backup and metrics role #9

dvzrv opened this issue Aug 26, 2024 · 0 comments

Comments

@dvzrv
Copy link

dvzrv commented Aug 26, 2024

Hi! 👋

When implementing namespaces support for the nethsm library I ran across a few inconsistencies, that I would like to document here.

Users for a namespaces and the namespace itself is created using a system-wide user in the administrator role (R-Administrator):

  • one or more users in the administrator role are created with a namespace prefix (e.g. namespace1~admin1)
    • optionally, further users (also in other roles) for that namespace are created
  • the namespace (e.g. namespace1) is created

Afterwards only the namespace administrator (N-Administrator) is able to create further users and keys.
Users in the metrics and backup role can also be created for a namespace (either up front by the R-Administrator or after namespace creation by the N-Administrator).

After private discussion with @ansiwen it appears as if functionality accessible to users in the backup and metrics role is not meant to be available in namespaces though.

When testing I noticed, that the namespace users in the backup role can indeed not be used to retrieve backups.
However, namespace users in the metrics role can be used to retrieve metrics.

For documentation (and implementation) purposes it would be great to figure out whether namespace users in the metrics role should be able to retrieve metrics.

In general I wonder whether it wouldn't be best to guard against the creation of users in the metrics and backup role in/ for namespaces altogether.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant