Enabling Authentication for Milvus

[Pranav-NG]

I have my Milvus Standalone Running in server.(By docker-compose)
The issue I have is my application is able to connect without having to enter the username and password by default.
This seems to be risky in having my documentation and collections in the server.
However , I have created multiple users and changed password for root user.

How to enable authentication in the server so that username and password is made mandatory

[yhmo]

To enable user authentication, you need to set common.security.authorizationEnabled as true in milvus.yaml.
Please read this doc: https://milvus.io/docs/authenticate.md

[Pranav-NG]

Thanks you for the reply and reference !
I understand that a change needs to be made in the config file (milvus.yaml).

However , few questions on setting up the config file -
For the setup I just used docker-compose file. What should I do to setup the config file. ?

The steps explained in this link (https://milvus.io/docs/configure-docker.md) is sort of confusing .

How to use milvus.yaml and docker-compose.yaml together.

[yhmo]

Steps:

1. create a directory named "test", cmd line cd to the this directory
2. download a milvus.yaml file into "test": wget https://raw.githubusercontent.com/milvus-io/milvus/v2.2.9/configs/milvus.yaml
3. download the docker-compose.yml into "test": wget https://github.com/milvus-io/milvus/releases/download/v2.2.9/milvus-standalone-docker-compose.yml -O docker-compose.yml
4. use text edit tool to edit the docker-compose.yml, add a line to the standalone section:

standalone:
   container_name: milvus-standalone
   image: milvusdb/milvus:v2.2.8
   command: ["milvus", "run", "standalone"]
   environment:
     ETCD_ENDPOINTS: etcd:2379
     MINIO_ADDRESS: minio:9000
   volumes:
     - ${DOCKER_VOLUME_DIRECTORY:-.}/volumes/milvus:/var/lib/milvus
     - ./milvus.yaml:/milvus/configs/milvus.yaml   # Add this line to map the milvus.yaml from inside container to outside
   ports:
     - "19530:19530"
     - "9091:9091"
   depends_on:
     - "etcd"
     - "minio"

5. use text edit tool to edit the test/milvus.yaml

common:
  security:
    authorizationEnabled: true

6. under the "test" directory, start the service by command docker-compose up -d

[scordl327]

Thanks

[TaoWolf]

However, if I set it up this way, I am unable to log in using any username and password. What should I do?

[TaoWolf]

Error: 14 UNAVAILABLE: No connection established

[TaoWolf]

[xiaofan-luan]

and this is highly recommended

[scordl327]

1.You neet download this file : wget https://raw.githubusercontent.com/milvus-io/milvus/v2.2.9/configs/milvus.yaml , copy to your docker place.
2.now edit find the authorizationEnabled: true , so you useing milvus API connect Milvus with an existing user. python sdk like this
from pymilvus import connections
connections.connect(
alias='default',
host='localhost',
port='19530',
user='root',
password='Milvus',
)
you need see this website :https://milvus.io/docs/authenticate.md#docker

[ndtreviv]

Is there a way to update the root password using the Java SDK?

[xiaofan-luan]

It will be supported in the next release.
Before that use python sdk might be an alternative

[ndtreviv]

Actually, I figured it out:

    private boolean changeRootUserPassword(String password) {
        R<RpcStatus> result = client.updateCredential(UpdateCredentialParam.newBuilder()
                        .withUsername("root")
                        .withOldPassword("Milvus")
                        .withNewPassword(password)
                .build());

        if (result.getStatus() == 0) {
            LOGGER.info("Successfully changed root password");
            return true;
        } else {
            LOGGER.error("Failed to change root password: {}:{}", result.getStatus(), getMessageSafe(result));
            return false;
        }
    }

[TaoWolf]

Thanks，OK！

[teetering]

After following the instructions in this thread and bringing back up the docker-compose container, I'm still able to connect to milvus without a username password. Any ideas on how to debug this? I don't see anything in the milvus log about auth, and the milvus.yaml appears to be mapped correctly as per above...

Thank you!

[yhmo]

Use "docker exec -it [standalone_container_id] bash" to enter the container.

Find the milvus.yaml in this path:
cd /milvus/configs

Check the authorizationEnabled value:
cat ./milvus.yaml | grep 'authorizationEnabled'

If the value is true, the client connect milvus without a username/password, you will get error "grpc RpcError: [__internal_register], <_InactiveRpcError: StatusCode.UNAUTHENTICATED, missing authorization in header>"

[miguelwon]

What about webui? I just did as explained in the documentation and I now need authentication to make a simple connection. However, webui is completely open. How do put it behind and authentication system?

[yhmo]

At present, the webui is not authorizable. Let me talk with the team.