Add credentialz endpoints to manage system role accounts. #207
Conversation
|
|
||
| message AddAccountRequest { | ||
| // The system role account name. This account must not already exist. | ||
| string account = 1; |
There was a problem hiding this comment.
Some implementations need a password to create an account, would suggest add Password which can be optional.
We might also want to clarify if Password is not specified we want to create an account with,
- Disabled password (prevent authentication via password) OR
- No password (password not required for authentication)
There was a problem hiding this comment.
(picking long past old PR)
Either specifying in the proto/docs:
"If a passwd is required, but not provided, an error is returned"
or:
"where a password is required and not provided the device will provide an unusable password"
(like username:*:userid:groupid:comment:shell on standard unix-like platforms)
seems ok.
| // returned in the provided list. | ||
| rpc GetPublicKeys(GetPublicKeysRequest) returns (GetPublicKeysResponse); | ||
|
|
||
| // Add a system role account. |
There was a problem hiding this comment.
I'm not sure why my previous comment was marked as resolved, but I still would like to get an answer to that question.
Would be good to add a strict definition what a "system role account" is.
OpenConfig has SYSTEM_ROLE_ADMIN https://github.com/openconfig/public/blob/db78d44e93a97cef4db27f82bba3fba454e907a5/release/models/system/openconfig-aaa-types.yang#L77-L84, but I have a feeling that you mean something else in this context.
There was a problem hiding this comment.
I think 'system role admin' is like 'admin group' or 'root access for user in this group', right?
I think the intent of this is to provide a way to set a passwd/ssh-key/etc for:
linuxadmin
root
admin
event-manager-user
etc.. accounts which the vendor provides on the device outside of any requirement of the operator of that device.
There was a problem hiding this comment.
I think the intent of this is to provide a way to set a passwd/ssh-key/etc for:
is it? the proto change says it can only add or delete account. for credentials management we have existing credz service RPCs..
morrowc
left a comment
morrowc
left a comment
There was a problem hiding this comment.
Left 2 clarifying answers/pointers to the existing conversations.
4 participants
It seems there is no way to manage system role accounts via openconfig today, meaning it's necessary to know about the NOS or underlying OS in order to get that done.