Skip to content

Commit cc253e3

Browse files
liranmaudaliranmauda
authored
Merge pull request #9004 from shirady/nc-iam-add-doc-demo
NC | NSFS | IAM | Doc | Add Demo Case
2 parents 6787090 + c06a9c3 commit cc253e3

File tree

1 file changed

+143
-30
lines changed

1 file changed

+143
-30
lines changed

‎docs/dev_guide/nc_nsfs_iam_developer_doc.md

Lines changed: 143 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,63 +1,176 @@
11
# Non Containerized NSFS IAM (Developers Documentation)
22

33
## Related files:
4-
1. [NC NSFS](../non_containerized_NSFS.md)
5-
2. [NC NSFS Design Documentation](../design/NonContainerizedNooBaaDesign.md)
4+
1. [NooBaa Non Containerized README](../NooBaaNonContainerized/README.md)
65
2. [IAM Design Documentation](../design/iam.md)
76

87
## Get Started
9-
Currently, we do not validate the input, so the test should use only valid input.
10-
11-
1. Create the `FS_ROOT` and a directory for a bucket: `mkdir -p /tmp/nsfs_root1/my-bucket` and give permissions `chmod 777 /tmp/nsfs_root1/` `chmod 777 /tmp/nsfs_root1/my-bucket`.
12-
This will be the argument for:
13-
- `new_buckets_path` flag `/tmp/nsfs_root1` (that we will use in the account commands)
14-
- `path` in the buckets commands `/tmp/nsfs_root1/my-bucket` (that we will use in bucket commands).
15-
2. Create the root user account with the CLI:
16-
`sudo node src/cmd/manage_nsfs account add --name <name> --new_buckets_path /tmp/nsfs_root1 --access_key <access-key> --secret_key <secret-key> --uid <uid> --gid <gid>`.
17-
3. Start the NSFS server (using debug mode and the port for IAM): `sudo node src/cmd/nsfs --debug 5 --https_port_iam 7005`
18-
Note: before starting the server please add this line: `process.env.NOOBAA_LOG_LEVEL = 'nsfs';` in the endpoint.js (before the condition `if (process.env.NOOBAA_LOG_LEVEL) {`)
19-
4. Create the alias for IAM service:
20-
`alias nc-user-1-iam='AWS_ACCESS_KEY_ID=<access-key> AWS_SECRET_ACCESS_KEY=<secret-key> aws --no-verify-ssl --endpoint-url https://localhost:7005'`.
21-
5. Use AWS CLI to send requests to the IAM service, for example:
22-
`nc-user-1-iam iam create-user --user-name Bob --path /division_abc/subdivision_xyz/`
23-
`nc-user-1-iam iam get-user --user-name Bob`
24-
`nc-user-1-iam iam update-user --user-name Bob --new-path /division_abc/subdivision_abc/`
25-
`nc-user-1-iam iam delete-user --user-name Bob`
26-
`nc-user-1-iam iam list-users`
27-
28-
`nc-user-1-iam iam create-access-key --user-name Bob`
29-
`nc-user-1-iam iam update-access-key --access-key-id <access-key> --user-name Bob --status Inactive`
30-
`nc-user-1-iam iam delete-access-key --access-key-id <access-key> --user-name Bob`
8+
9+
### Basic Steps (Create an Account, a Bucket, and Check Connection to Endpoint)
10+
1. Create an account with noobaa CLI:
11+
`sudo node src/cmd/manage_nsfs account add --name <account-name> --new_buckets_path /Users/buckets/ --access_key <access-key> --secret_key <secret-key> --uid <uid> --gid <gid>`
12+
Note: before creating the account need to give permission to the `new_buckets_path`: `chmod 777 /Users/buckets/`
13+
2. Start the NSFS server (using debug mode and the port for IAM):
14+
`sudo node src/cmd/nsfs --debug 5 --https_port_iam 7005`
15+
3. Create the alias for S3 service:
16+
`alias nc-user-1-s3=‘AWS_ACCESS_KEY_ID=<access-key> AWS_SECRET_ACCESS_KEY=<secret-key> aws --no-verify-ssl --endpoint-url https://localhost:6443’`
17+
4. Check the connection to the endpoint and try to list the buckets (should be empty):
18+
`nc-user-1-s3 s3 ls; echo $?`
19+
5. Add bucket to the account using AWS CLI:
20+
`nc-user-1-s3 s3 mb s3://bucket-01`
21+
(`bucket-01` is the bucket name in this example)
22+
or noobaa CLI:
23+
`sudo node src/cmd/manage_nsfs bucket add --name bucket-01 --path /Users/buckets/bucket-01 --owner <account-name>`
24+
6. Create the alias for IAM service:
25+
`alias nc-user-1-iam='AWS_ACCESS_KEY_ID=<access-key> AWS_SECRET_ACCESS_KEY=<secret-key> aws --no-verify-ssl --endpoint-url https://localhost:7005'`
26+
7. Check the connection to the endpoint and try to list the users (should be empty):
27+
`nc-user-1-iam iam list-user`
28+
29+
### Call The IAM Actions
30+
Use AWS CLI to send requests to the IAM service, for example:
31+
#### IAM Users API
32+
`nc-user-1-iam iam create-user --user-name Bob --path /division_abc/subdivision_xyz/`
33+
34+
`nc-user-1-iam iam get-user --user-name Bob`
35+
36+
`nc-user-1-iam iam update-user --user-name Bob --new-path /division_abc/subdivision_abc/`
37+
38+
`nc-user-1-iam iam delete-user --user-name Bob`
39+
40+
`nc-user-1-iam iam list-users`
41+
42+
#### IAM Access Keys API
43+
`nc-user-1-iam iam create-access-key --user-name Bob`
44+
45+
`nc-user-1-iam iam update-access-key --access-key-id <access-key> --user-name Bob --status Inactive`
46+
47+
`nc-user-1-iam iam delete-access-key --access-key-id <access-key> --user-name Bob`
48+
3149
`nc-user-1-iam iam list-access-keys --user-name Bob`
3250

33-
Create the alias for IAM service for the user that was created (with its access keys):
34-
`alias nc-user-1-iam-regular='AWS_ACCESS_KEY_ID=<access-key> AWS_SECRET_ACCESS_KEY=<secret-key> aws --no-verify-ssl --endpoint-url https://localhost:7005'`.
51+
Create the alias for IAM service for the user that was created (with its access keys):
52+
`alias nc-user-1-iam-regular='AWS_ACCESS_KEY_ID=<access-key> AWS_SECRET_ACCESS_KEY=<secret-key> aws --no-verify-ssl --endpoint-url https://localhost:7005'`
53+
3554
`nc-user-1-iam-regular iam get-access-key-last-used --access-key-id <access-key>`
3655

3756
### Demo Examples:
3857
#### Deactivate Access Key:
39-
`alias nc-user-1-iam-regular='AWS_ACCESS_KEY_ID=<access-key> AWS_SECRET_ACCESS_KEY=<secret-key> aws --no-verify-ssl --endpoint-url https://localhost:6443'` (port for s3)
58+
We will start with the steps in the part [Basic Steps](#get-started).
59+
4060
1. Use the root account credentials to create a user: `nc-user-1-iam iam create-user --user-name <username>`
4161
2. Use the root account credentials to create access keys for the user: `nc-user-1-iam iam create-access-key --user-name <username>`
4262
3. The alias for s3 service: `alias nc-user-1-s3-regular='AWS_ACCESS_KEY_ID=<access-key> AWS_SECRET_ACCESS_KEY=<secret-key> aws --no-verify-ssl --endpoint-url https://localhost:6443'`
4363
2. Create a bucket (so we can list it) `nc-user-1-s3-regular s3 mb s3://<bucket-name`
4464
3. List bucket (use s3 service)`nc-user-1-s3-regular s3 ls`
4565
4. List access keys (use IAM service) `nc-user-1-iam-regular iam list-access-keys`
4666
5. Deactivate access keys: `nc-user-1-iam iam update-access-key --access-key-id <access-key> --user-name <username> --status Inactive`
47-
6. It should throw an error for both s3 service (`nc-user-1-s3-regular s3 ls`) and iam service (`nc-user-1-iam-regular iam list-access-keys`) that uses the deactivated access key.
48-
Note: Currently we clean the cache after update, but it happens for the specific endpoint, if there are more endpoints (using forks) developers can change the expiry cache in the line `expiry_ms: 1` inside `account_cache` (currently inside object_sdk).
67+
6. It should throw an error for both S3 service (`nc-user-1-s3-regular s3 ls`) and IAM service (`nc-user-1-iam-regular iam list-access-keys`) that uses the deactivated access key.
4968

5069
#### Rename Username:
70+
We will start with the steps in the part [Basic Steps](#get-started).
71+
5172
1. Use the root account credentials to create a user: `nc-user-1-iam iam create-user --user-name <username>` (You should see the config file in under the accounts directory).
5273
2. Use the root account credentials to create access keys for the user:(first time): `nc-user-1-iam iam create-access-key --user-name <username>` (You should see the first symbolic link in under the access_keys directory).
5374
3. Use the root account credentials to create access keys for the user (second time): `nc-user-1-iam iam create-access-key --user-name <username>` (You should see the second symbolic link in under the access_keys directory).
5475
4. Update the username: `nc-user-1-iam iam update-user --user-name <username> --new-user-name <new-username>` (You should see the following changes: config file name updated, symlinks updated according to the current config).
5576

56-
#### Create root account using the IAM API (requesting account is root accounts manager):
77+
#### Create Root Account Using the IAM API (Requesting Account is Root Accounts Manager):
5778
1. Create the root accounts manager with the CLI:
5879
`sudo node src/cmd/manage_nsfs account add --name <name> --new_buckets_path /tmp/nsfs_root1 --access_key <access-key> --secret_key <secret-key> --uid <uid> --gid <gid> --iam_operate_on_root_account`.
5980
2. Use the root accounts manager details in the alias:
6081
`alias nc-user-manager-iam='AWS_ACCESS_KEY_ID=<access-key> AWS_SECRET_ACCESS_KEY=<secret-key> aws --no-verify-ssl --endpoint-url https://localhost:7005'`.
6182
3. Use the root accounts manager account credentials to create a root account:
6283
`nc-user-manager-iam create-user --user-name <username>`
6384
4. Use the root account credentials to create access keys for the root account: `nc-user-manager-iam iam create-access-key --user-name <username>`
85+
86+
#### One Account With 2 Users With Bucket Policy
87+
Note: Currently, we have implementation of the Principal field as name or ID in NC ([S3 Ops, Bucket Policy - Principal Field](../NooBaaNonContainerized//S3Ops.md#principal-field)) - not with ARN at this point, so we will use what we have at this example (we can support it in the future).
88+
We will start with the steps in the part [Basic Steps](#get-started).
89+
90+
##### IAM Steps (Create 3 Users With Access Keys)
91+
We will create 3 users:
92+
(1) user for read-write permission user-rw
93+
(2) user for read permission user-ro
94+
(3) user without any permission user-no
95+
96+
We will give example of user-rw, but it is the same for the rest
97+
1. Create user: `nc-user-1-iam iam create-user --user-name user-rw`
98+
2. Create access key for user user-rw: `nc-user-1-iam iam create-access-key --user-name user-rw`
99+
3. Create alias for S3 service:`alias nc-user-rw-s3=‘AWS_ACCESS_KEY_ID=<access-key> AWS_SECRET_ACCESS_KEY=<secret-key> aws --no-verify-ssl --endpoint-url https://localhost:6443’`.
100+
4. Check the connection to the endpoint and try to list the buckets (should be one): `nc-user-rw-s3 s3 ls; echo $?`
101+
102+
we will have 3 alias: `nc-user-rw-s3`, `nc-user-ro-s3`, `nc-user-no-s3`
103+
104+
##### S3 Steps (Bucket Policy and S3 Operations)
105+
5. Root account will put the bucket policy - `nc-user-1-s3 s3api put-bucket-policy --bucket bucket-01 --policy file://policy.json`
106+
107+
policy with IDs (can be done in master branch)
108+
109+
```json
110+
{
111+
"Version": "2012-10-17",
112+
"Statement": [
113+
{
114+
"Sid": "AllowUserRW",
115+
"Effect": "Allow",
116+
"Principal": { "AWS": [ "<id of user-rw>" ] },
117+
"Action": [ "s3:PutObject", "s3:GetObject", "s3:ListBucket" ],
118+
"Resource": [ "arn:aws:s3:::bucket-01/*", "arn:aws:s3:::bucket-01" ]
119+
},
120+
{
121+
"Sid": "AllowUserRO",
122+
"Effect": "Allow",
123+
"Principal": { "AWS": [ "id of user-ro" ] },
124+
"Action": [ "s3:GetObject", "s3:ListBucket"],
125+
"Resource": [ "arn:aws:s3:::bucket-01/*", "arn:aws:s3:::bucket-01" ]
126+
}
127+
]
128+
}
129+
```
130+
131+
policy with names (can be done in version 5.17)
132+
133+
```
134+
{
135+
"Version": "2012-10-17",
136+
"Statement": [
137+
{
138+
"Sid": "AllowUserRW",
139+
"Effect": "Allow",
140+
"Principal": { "AWS": [ "user-rw" ] },
141+
"Action": [ "s3:PutObject", "s3:GetObject", "s3:ListBucket" ],
142+
"Resource": [ "arn:aws:s3:::bucket-01/*", "arn:aws:s3:::bucket-01" ]
143+
},
144+
{
145+
"Sid": "AllowUserRO",
146+
"Effect": "Allow",
147+
"Principal": { "AWS": [ "user-ro" ] },
148+
"Action": [ "s3:GetObject", "s3:ListBucket"],
149+
"Resource": [ "arn:aws:s3:::bucket-01/*", "arn:aws:s3:::bucket-01" ]
150+
}
151+
]
152+
}
153+
```
154+
155+
user user-rw:
156+
6. user-rw can put object: `echo 'hello_world1' | nc-user-rw-s3 s3 cp - s3://bucket-01/hello_world1.txt #valid`
157+
7. user-rw can get object: `nc-user-rw-s3 s3api get-object --bucket bucket-01 --key hello_world1.txt /dev/stdout`
158+
8. user-rw can list the objects in the bucket: `nc-user-rw-s3 s3api list-objects-v2 --bucket bucket-01` (expected to see `hello_world1.txt`)
159+
160+
user user-ro:
161+
9. user-ro cannot put object: `echo 'hello_world2' | nc-user-ro-s3 s3 cp - s3://bucket-01/hello_world2.txt #invalid` (`AccessDenied` error)
162+
10. user-ro can get object: `nc-user-ro-s3 s3api get-object --bucket bucket-01 --key hello_world1.txt /dev/stdout`
163+
11. user-ro can list the objects in the bucket: `nc-user-ro-s3 s3api list-objects-v2 --bucket bucket-01` (expected to see `hello_world1.txt`)
164+
165+
user user-no: (all should fail with `AccessDenied` error)
166+
12. user-no cannot put object: `echo 'hello_world3' | nc-user-no-s3 s3 cp - s3://bucket-01/hello_world3.txt #invalid` (`AccessDenied` error)
167+
13. user-no cannot get object: `nc-user-no-s3 s3api get-object --bucket bucket-01 --key hello_world1.txt /dev/stdout` (`AccessDenied` error)
168+
14. user-no cannot list the objects in the bucket: `nc-user-no-s3 s3api list-objects-v2 --bucket bucket-01` (`AccessDenied` error)
169+
170+
##### Expand The Example (Additional Account and a User Inside It)
171+
15. Add another account with noobaa CLI - see step 1 and in [Basic Steps](#get-started) and create alias `nc-user-2-iam`
172+
16. Add user `acc2-user` with access key and create alias `nc-user-acc2-user-s3` - see steps 1-3
173+
17. Run the operations with user acc2-user: (all should fail with `AccessDenied` error)
174+
18. user-no cannot put object: `echo 'hello_world4' | nc-user-acc2-user-s3 s3 cp - s3://bucket-01/hello_world4.txt #invalid` (`AccessDenied` error)
175+
19. user-no cannot get object: `nc-user-acc2-user-s3 s3api get-object --bucket bucket-01 --key hello_world1.txt /dev/stdout` (`AccessDenied` error)
176+
20. user-no cannot list the objects in the bucket: `nc-user-acc2-user-s3 s3api list-objects-v2 --bucket bucket-01` (`AccessDenied` error)

0 commit comments

Comments
 (0)