luxolus
/
open-consul
2
0
Fork 0
Code Issues 1 Pull Requests Packages Releases Wiki Activity

Backport of docs: Add complete auth method payloads into release/1.16.x (#18912) 

backport of commit 30b6777cb3f04589a7bdd0f6089be2d623454ed2

Co-authored-by: Blake Covarrubias <blake@covarrubi.as>
This commit is contained in:
hc-github-team-consul-core 2023-09-20 20:22:36 -04:00 committed by GitHub
parent 5e96c31c79
commit c7f6602f1f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 105 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
website/content/api-docs/acl/binding-rules.mdx
View File

@ -62,38 +62,63 @@ The corresponding CLI command is [`consul acl binding-rule create`](/consul/comm
- `BindType=service` - The computed bind name value is used as an - `BindType=service` - The computed bind name value is used as an
`ACLServiceIdentity.ServiceName` field in the token that is created. `ACLServiceIdentity.ServiceName` field in the token that is created.
<CodeBlockConfig heading="Equivalent payload for Consul token API endpoint">
```json ```json
{ ...other fields... {
"AccessorID": "<token accessor ID>",
"SecretID": "<token secret ID>",
"ServiceIdentities": [ "ServiceIdentities": [
{ "ServiceName": "<computed BindName>" } {
"ServiceName": "<computed BindName>"
}
] ]
} }
``` ```
</CodeBlockConfig>
- `BindType=node` - The computed bind name value is used as an - `BindType=node` - The computed bind name value is used as an
`ACLNodeIdentity.NodeName` field in the token that is created. `ACLNodeIdentity.NodeName` field in the token that is created.
<CodeBlockConfig heading="Equivalent payload for Consul token API endpoint">
```json ```json
{ ...other fields... {
"AccessorID": "<token accessor ID>",
"SecretID": "<token secret ID>",
"NodeIdentities": [ "NodeIdentities": [
{ "NodeName": "<computed BindName>", "Datacenter": "<local datacenter>" } {
"NodeName": "<computed BindName>",
"Datacenter": "<local datacenter>"
}
] ]
} }
``` ```
</CodeBlockConfig>
- `BindType=role` - The computed bind name value is used as a `RoleLink.Name` - `BindType=role` - The computed bind name value is used as a `RoleLink.Name`
field in the token that is created. This binding rule will only apply if a field in the token that is created. This binding rule will only apply if a
role with the given name exists at login-time. If it does not then this role with the given name exists at login-time. If it does not then this
rule is ignored. rule is ignored.
<CodeBlockConfig heading="Equivalent payload for Consul token API endpoint">
```json ```json
{ ...other fields... {
"AccessorID": "<token accessor ID>",
"SecretID": "<token secret ID>",
"Roles": [ "Roles": [
{ "Name": "<computed BindName>" } {
"Name": "<computed BindName>"
}
] ]
} }
``` ```
</CodeBlockConfig>
- `BindName` `(string: <required>)` - The name to bind to a token at - `BindName` `(string: <required>)` - The name to bind to a token at
login-time. What it binds to can be adjusted with different values of the login-time. What it binds to can be adjusted with different values of the
`BindType` field. This can either be a plain string or lightly templated `BindType` field. This can either be a plain string or lightly templated
@ -250,38 +275,63 @@ The corresponding CLI command is [`consul acl binding-rule update`](/consul/comm
- `BindType=service` - The computed bind name value is used as an - `BindType=service` - The computed bind name value is used as an
`ACLServiceIdentity.ServiceName` field in the token that is created. `ACLServiceIdentity.ServiceName` field in the token that is created.
<CodeBlockConfig heading="Equivalent payload for Consul token API endpoint">
```json ```json
{ ...other fields... {
"AccessorID": "<token accessor ID>",
"SecretID": "<token secret ID>",
"ServiceIdentities": [ "ServiceIdentities": [
{ "ServiceName": "<computed BindName>" } {
"ServiceName": "<computed BindName>"
}
] ]
} }
``` ```
</CodeBlockConfig>
- `BindType=node` - The computed bind name value is used as an - `BindType=node` - The computed bind name value is used as an
`ACLNodeIdentity.NodeName` field in the token that is created. `ACLNodeIdentity.NodeName` field in the token that is created.
<CodeBlockConfig heading="Equivalent payload for Consul token API endpoint">
```json ```json
{ ...other fields... {
"AccessorID": "<token accessor ID>",
"SecretID": "<token secret ID>",
"NodeIdentities": [ "NodeIdentities": [
{ "NodeName": "<computed BindName>", "Datacenter": "<local datacenter>" } {
"NodeName": "<computed BindName>",
"Datacenter": "<local datacenter>"
}
] ]
} }
``` ```
</CodeBlockConfig>
- `BindType=role` - The computed bind name value is used as a `RoleLink.Name` - `BindType=role` - The computed bind name value is used as a `RoleLink.Name`
field in the token that is created. This binding rule will only apply if a field in the token that is created. This binding rule will only apply if a
role with the given name exists at login-time. If it does not then this role with the given name exists at login-time. If it does not then this
rule is ignored. rule is ignored.
<CodeBlockConfig heading="Equivalent payload for Consul token API endpoint">
```json ```json
{ ...other fields... {
"AccessorID": "<token accessor ID>",
"SecretID": "<token secret ID>",
"Roles": [ "Roles": [
{ "Name": "<computed BindName>" } {
"Name": "<computed BindName>"
}
] ]
} }
``` ```
</CodeBlockConfig>
- `BindName` `(string: <required>)` - The name to bind to a token at - `BindName` `(string: <required>)` - The name to bind to a token at
login-time. What it binds to can be adjusted with different values of the login-time. What it binds to can be adjusted with different values of the
`BindType` field. This can either be a plain string or lightly templated `BindType` field. This can either be a plain string or lightly templated

4
website/content/docs/security/acl/auth-methods/aws-iam.mdx
View File

@ -86,7 +86,9 @@ parameters for an auth method of type `aws-iam`:
```json ```json
{ {
...other fields... "Name": "example-iam-auth",
"Type": "aws-iam",
"Description": "Example AWS IAM auth method",
"Config": { "Config": {
"BoundIAMPrincipalARNs": ["arn:aws:iam::123456789012:role/MyRoleName"], "BoundIAMPrincipalARNs": ["arn:aws:iam::123456789012:role/MyRoleName"],
"EnableIAMEntityDetails": true, "EnableIAMEntityDetails": true,

12
website/content/docs/security/acl/auth-methods/jwt.mdx
View File

@ -92,7 +92,9 @@ parameters are required to properly configure an auth method of type
```json ```json
{ {
...other fields... "Name": "example-jwt-auth-static-keys",
"Type": "jwt",
"Description": "Example JWT auth method with static keys",
"Config": { "Config": {
"BoundIssuer": "corp-issuer", "BoundIssuer": "corp-issuer",
"JWTValidationPubKeys": [ "JWTValidationPubKeys": [
@ -113,7 +115,9 @@ parameters are required to properly configure an auth method of type
```json ```json
{ {
...other fields... "Name": "example-jwt-auth-jwks",
"Type": "jwt",
"Description": "Example JWT auth method with JWKS",
"Config": { "Config": {
"JWKSURL": "https://my-corp-jwks-url.example.com/", "JWKSURL": "https://my-corp-jwks-url.example.com/",
"ClaimMappings": { "ClaimMappings": {
@ -131,7 +135,9 @@ parameters are required to properly configure an auth method of type
```json ```json
{ {
...other fields... "Name": "example-oidc-auth",
"Type": "oidc",
"Description": "Example OIDC auth method",
"Config": { "Config": {
"BoundAudiences": [ "BoundAudiences": [
"V1RPi2MYptMV1RPi2MYptMV1RPi2MYpt" "V1RPi2MYptMV1RPi2MYptMV1RPi2MYpt"

4
website/content/docs/security/acl/auth-methods/kubernetes.mdx
View File

@ -61,7 +61,9 @@ parameters are required to properly configure an auth method of type
```json ```json
{ {
...other fields... "Name": "example-k8s-auth",
"Type": "kubernetes",
"Description": "Example JWT auth method",
"Config": { "Config": {
"Host": "https://192.0.2.42:8443", "Host": "https://192.0.2.42:8443",
"CACert": "-----BEGIN CERTIFICATE-----\n...-----END CERTIFICATE-----\n", "CACert": "-----BEGIN CERTIFICATE-----\n...-----END CERTIFICATE-----\n",

4
website/content/docs/security/acl/auth-methods/oidc.mdx
View File

@ -86,7 +86,9 @@ parameters are required to properly configure an auth method of type
```json ```json
{ {
...other fields... "Name": "example-oidc-auth",
"Type": "oidc",
"Description": "Example OIDC auth method",
"Config": { "Config": {
"AllowedRedirectURIs": [ "AllowedRedirectURIs": [
"http://localhost:8550/oidc/callback", "http://localhost:8550/oidc/callback",

7
website/content/partials/jwt_claim_mapping_details.mdx
View File

@ -19,7 +19,11 @@ rule, and the lists of values mapped by `ListClaimMappings` cannot.
Assume this is your config snippet: Assume this is your config snippet:
```json ```json
{ ...other fields... {
"Name": "example-auth-method",
"Type": "<jwt|oidc>",
"Description": "Example auth method",
"Config": {
"ClaimMappings": { "ClaimMappings": {
"givenName": "first_name", "givenName": "first_name",
"surname": "last_name" "surname": "last_name"
@ -27,6 +31,7 @@ Assume this is your config snippet:
"ListClaimMappings": { "ListClaimMappings": {
"groups": "groups" "groups": "groups"
} }
}
} }
``` ```