[MXS-1662] Allow all users in a specific group to use MaxAdmin Created: 2018-02-09 Updated: 2020-08-25 Resolved: 2019-04-30 |
|
| Status: | Closed |
| Project: | MariaDB MaxScale |
| Component/s: | maxadmin |
| Affects Version/s: | 2.1.13 |
| Fix Version/s: | 2.4.0 |
| Type: | New Feature | Priority: | Major |
| Reporter: | Geoff Montee (Inactive) | Assignee: | Esa Korhonen |
| Resolution: | Fixed | Votes: | 1 |
| Labels: | maxadmin | ||
| Sprint: | MXS-SPRINT-78, MXS-SPRINT-79, MXS-SPRINT-80, MXS-SPRINT-81 |
| Description |
|
In MaxScale 2.1, Linux user accounts can be given access to maxadmin: Some users would like this to be expanded, so that all Linux users within a specific Linux group could be given access to maxadmin. e.g. executing something like this would allow any user in the "dba" group to use MaxAdmin:
It would be preferable if this would also work for non-local groups pulled in from certain PAM plugins, such as those from Active Directory or LDAP. |
| Comments |
| Comment by Johan Wikman [ 2018-02-13 ] |
|
In the case of maxadmin this would be straightforward, but not so in the case of maxctrl (the REST-API based replacement for maxadmin). |
| Comment by Johan Wikman [ 2018-03-05 ] |
|
dshjoshi, could you have a look at this. Giving access to maxadmin for specific Linux group access would be doable. However, as maxadmin is being phased out that does not seem like time well spent. However, making it possible to configure the REST-API of MaxScale to use Active Directory or LDAP for the authentication seems quite sensible and is something that probably would fit in the 2.3 timeframe. |
| Comment by Dipti Joshi (Inactive) [ 2018-03-05 ] |
|
Agree with you johan.wikman, we should support LDAP and AD for REST-API - Let us add it as an 2.3 item. |
| Comment by Dipti Joshi (Inactive) [ 2018-05-25 ] |
|
johan.wikmanLet us get estimate for this |
| Comment by Manjot Singh (Inactive) [ 2018-08-02 ] |
|
@Dipti Do you have an update on this? |
| Comment by Johan Wikman [ 2018-09-04 ] |
|
LDAP support for REST-API authorization is not entirelly trivial. I think the basic use-case is that you, using maxctrl or the REST-API directly using curl, should be able to get your authorization provided from LDAP (or AD). The problem is that any back and forth communication between MaxScale and the client is not really possible since the protocol is HTTP. What could be done is that MaxScale would simply take the provided username and password and use them for logging into an LDAP server to find out the rights of the user. The problem with that approach is that MaxScale would have access to the cleartext password of the user, which from a security perspective is not good. However, I suppose a security conscious organization could setup a dedicated LDAP server just for MaxScale, in which case the situation is security wise basically the same as it currently is. The estimate is based upon this approach. |
| Comment by Johan Wikman [ 2018-09-11 ] |
|
Seems like this is not that complex after all, so cut down on the estimate. |
| Comment by markus makela [ 2018-12-27 ] |
|
Some prototype code for this exists on the |