...
- ory/hydra
- github https://github.com/ory/hydra
- as docker https://hub.docker.com/r/oryd/hydra/
- ory/kratos
- github https://github.com/ory/kratos
- as docker https://hub.docker.com/r/oryd/kratos
- Quickstart: https://www.youtube.com/watch?v=5t1Zr_zJc7E
User setting
- server can store a provide a user specific data record
- username is key for the record
- Should be JSON
- data-provider has get and set method
- Specified via yang
- User groups
Features to be managed
- Applications (use, read)
- all
- Configurations
- mountpoint
- config app
- maintenance
...
AAA configuration
The term AAA configuration groups the configuration of
- user domains
- user roles
- user policies
- users
- and the associations for users to domains, roles and policies
At startup time of the system domains, roles and policies are configured and the fix during the runtime of the system. Users and there associations to domains, roles and policies can be configured during runtime.
For a better understanding of such configuration ONAP SDN-R should provide the following default configuration:
SDN-R default configuration for "Domains"
| Domain ID | Description |
|---|---|
| sdn | Default OpenDaylight SDN domain |
Please note that this configuration is set during start-up time of the system e.g. by K8s.
SDN-R default configuration for "Roles"
| Role ID | Description | Domain |
|---|---|---|
| admin | A role with full read and write access. | sdn |
| provision | A role for those who are provisioning the network. This allows read-write access to everything, accept security settings. Open: each user should be able to configure his own password. | sdn |
| supervision | A role read-only access. Open: each user should be able to configure his own password. | sdn |
Please note that this configuration is set during start-up time of the system e.g. by K8s.
SDN-R default configuration for "Policies"
| REST pattern (Policy ID) | ROLE | HTTP-GET | HTTP-PUT | HTTP-PATCH | HTTP-DELETE | HTTP-POST |
|---|---|---|---|---|---|---|
| /restconf/** | admin | true | true | true | true | true |
| /rests/data/network-topology:network-topology/topology=topology-netconf/** | admin | true | true | true | true | true |
| /rests/data/network-topology:network-topology/topology=topology-netconf/** | provision | true | true | true | true | true |
| /rests/data/network-topology:network-topology/topology=topology-netconf/** | supervision | true | false | false | false | false |
Please note that this configuration is set during start-up time of the system e.g. by K8s.
Open: How to allow EACH user to update its own user password?
SDN-R default configuration for "Users"
| NAME (User ID) | DESCRIPTION | PASSWORD | DOMAIN | |
|---|---|---|---|---|
leia.organa | The first administrator of ONAP SDN-R. | leia.organa@sdnr.onap.org | Default4SDN! | sdn |
| r2.d2 | The automation administrator for ONAP SDN-R. | r2.d2@sdnr.onap.org | Default4SDN! | sdn |
| luke.skywalker | The son of Anakin Skywalker and Padmé Amidala, Luke Skywalker was born mere days after the formation of the Galactic Empire. | luke.skywalker@sdnr.onap.org | Default4SDN! | sdn |
| jargo.fett | Just read - don't write. | jargo.fett@sdnr.onap.org | Default4SDN! | sdn |
Please note that this configuration can be set set during start-up time and during run time.
SDN-R default configuration for "Grants"
| NAME | DOMAIN | ROLE |
|---|---|---|
| leia.organa | sdn | admin |
| r2.d2 | sdn | admin |
| luke.skywalker | sdn | provision |
| jargo.fett | sdn | supervision |
| Drawio | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
...