MongoDB user management commands
Spec for enabling various user management commands for MongoDB. user-create, list, and delete, root-enable and show, and user-grant- and revoke-access will be supported. Change-Id: I71f7226cdd07446b2ca19f42f711544e93f288dd Implements: blueprint mongodb-users
This commit is contained in:
Matt Van Dijk
parent
e2c85ecfdb
commit
ce59684356
@ -20,6 +20,14 @@ Kilo approved specs:
|
|||||||
|
|
||||||
specs/kilo/*
|
specs/kilo/*
|
||||||
|
|
||||||
|
Liberty approved specs:
|
||||||
|
|
||||||
|
.. toctree::
|
||||||
|
:glob:
|
||||||
|
:maxdepth: 1
|
||||||
|
|
||||||
|
specs/liberty/*
|
||||||
|
|
||||||
======================
|
======================
|
||||||
Repository Information
|
Repository Information
|
||||||
======================
|
======================
|
||||||
|
|||||||
234
specs/liberty/mongodb-users.rst
Normal file
234
specs/liberty/mongodb-users.rst
Normal file
@ -0,0 +1,234 @@
|
|||||||
|
..
|
||||||
|
This work is licensed under a Creative Commons Attribution 3.0 Unported
|
||||||
|
License.
|
||||||
|
|
||||||
|
http://creativecommons.org/licenses/by/3.0/legalcode
|
||||||
|
|
||||||
|
Sections of this template were taken directly from the Nova spec
|
||||||
|
template at:
|
||||||
|
https://github.com/openstack/nova-specs/blob/master/specs/template.rst
|
||||||
|
|
||||||
|
|
||||||
|
==========================
|
||||||
|
MongoDB users management
|
||||||
|
==========================
|
||||||
|
|
||||||
|
https://blueprints.launchpad.net/trove/+spec/mongodb-users
|
||||||
|
|
||||||
|
Enable MongoDB users management functionality.
|
||||||
|
|
||||||
|
|
||||||
|
Problem description
|
||||||
|
===================
|
||||||
|
|
||||||
|
The MongoDB guest agent does not support users management features. Allowing
|
||||||
|
the user to create, list, and delete users, enable/check root access, and
|
||||||
|
grant/revoke user access through the API is essential.
|
||||||
|
|
||||||
|
MongoDB users are unique to each database. A user is identified by both its name
|
||||||
|
and database. Therefore the Trove actions requiring user names need
|
||||||
|
the value to be in the following string format: "<database>.<username>".
|
||||||
|
MongoDB does not allow the following characters in the database name: /\. "$
|
||||||
|
|
||||||
|
|
||||||
|
Proposed change
|
||||||
|
===============
|
||||||
|
|
||||||
|
Calls to MongoDB will be done in Python via the PyMongo library, which is
|
||||||
|
required to be pre-installed on the guest.
|
||||||
|
|
||||||
|
Features
|
||||||
|
--------
|
||||||
|
|
||||||
|
A number of Trove commands will be enabled for the MongoDB datastore.
|
||||||
|
Also, MongoDB's authentication protocol will be enabled by default, making
|
||||||
|
the database secure.
|
||||||
|
|
||||||
|
Functions
|
||||||
|
~~~~~~~~~
|
||||||
|
|
||||||
|
Several standard Trove commands will be enabled for MongoDB. Below are the
|
||||||
|
corresponding CLI commands with all allowed arguments:
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
user-create <instance> <database>.<name> <password>
|
||||||
|
user-list <instance>
|
||||||
|
user-delete <instance> <database>.<name>
|
||||||
|
user-show <instance> <database>.<name>
|
||||||
|
root-enable <instance>
|
||||||
|
root-show <instance>
|
||||||
|
user-grant-access <instance> <database>.<name> <access_databases>
|
||||||
|
user-revoke-access <instance> <database>.<name> <access_database>
|
||||||
|
user-show-access <instance> <database>.<name>
|
||||||
|
|
||||||
|
The code changes will be to implement a new class service.MongoAdmin and the
|
||||||
|
corresponding methods as members of the class. The methods of manager.Manager
|
||||||
|
will be updated to call the admin functions.
|
||||||
|
|
||||||
|
|
||||||
|
Security
|
||||||
|
~~~~~~~~
|
||||||
|
|
||||||
|
Currently the MongoDB datastore creates an insecure database. To make the
|
||||||
|
above functionality useful the guest agent's MongoDB server will be made
|
||||||
|
secure. This will be done by enabling authentication and creating a Trove
|
||||||
|
user 'os_admin' on the server by default. The Trove user will have user and
|
||||||
|
database administrator privileges, but not read/write. When the guest is first
|
||||||
|
started the guest agent will generate a password and
|
||||||
|
connect (because of the localhost exception) to the server. It will then run
|
||||||
|
the following (below is Mongo shell code, but it will be implemented using
|
||||||
|
PyMongo):
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
use admin
|
||||||
|
db.createUser(
|
||||||
|
{
|
||||||
|
user: "os_admin",
|
||||||
|
pwd: "<generated_password>",
|
||||||
|
roles: [
|
||||||
|
{ role: "userAdminAnyDatabase", db: "admin" },
|
||||||
|
{ role: "dbAdminAnyDatabase", db: "admin" },
|
||||||
|
{ role: "cluserAdmin", db: "admin" }
|
||||||
|
]
|
||||||
|
}
|
||||||
|
)
|
||||||
|
|
||||||
|
Authentication will be enabled by default. To disable it a configuration group
|
||||||
|
can be used with the option {'auth': 'false'}.
|
||||||
|
|
||||||
|
Note: enabling authentication on MongoDB effects clustering as shards are
|
||||||
|
required to use a shared key file to connect to each other. Therefore a new
|
||||||
|
cryptographically secure key will be generated during cluster-create to be used
|
||||||
|
by the shards. This key value will be pushed to each shard, where it will be
|
||||||
|
stored for connection use. The key will not be stored on the controller. The
|
||||||
|
controller will ask an existing cluster guest for the key when adding new
|
||||||
|
shards.
|
||||||
|
|
||||||
|
|
||||||
|
Configuration
|
||||||
|
-------------
|
||||||
|
|
||||||
|
The mongodb configuration file will have 'auth' set to 'on' to enable
|
||||||
|
authentication on the server.
|
||||||
|
|
||||||
|
A new MongoDB RC script will be created at ~/.mongorc.js. This file will store
|
||||||
|
the username and generated password, allowing the local MongoDB client to
|
||||||
|
automatically connect using those credentials.
|
||||||
|
|
||||||
|
|
||||||
|
Database
|
||||||
|
--------
|
||||||
|
|
||||||
|
No new items will be added here.
|
||||||
|
|
||||||
|
|
||||||
|
Public API
|
||||||
|
----------
|
||||||
|
|
||||||
|
No API changes.
|
||||||
|
|
||||||
|
|
||||||
|
Public API Security
|
||||||
|
-------------------
|
||||||
|
|
||||||
|
No API Security changes.
|
||||||
|
|
||||||
|
|
||||||
|
Internal API
|
||||||
|
------------
|
||||||
|
|
||||||
|
No Internal API changes.
|
||||||
|
|
||||||
|
|
||||||
|
Guest Agent
|
||||||
|
-----------
|
||||||
|
|
||||||
|
Modified files:
|
||||||
|
|
||||||
|
::
|
||||||
|
|
||||||
|
trove/guestagent/db/models.py - add a MongoDBUser class.
|
||||||
|
trove/guestagent/datastore/experimental/mongodb/manager.py - enable functions.
|
||||||
|
trove/guestagent/datastore/experimental/mongodb/service.py - add functions.
|
||||||
|
trove/guestagent/datastore/experimental/mongodb/system.py - store system constants.
|
||||||
|
|
||||||
|
The Guest Agent will be changed to support the following manager functions:
|
||||||
|
|
||||||
|
- create user - using 'createUser()'
|
||||||
|
- list users - query the admin database's system.users collection
|
||||||
|
- delete user - using 'dropUser()'
|
||||||
|
- show user - using 'getUser()'
|
||||||
|
- enable root - create user "root" and grant the role "root"
|
||||||
|
- check if root is enabled - check if user "root" exists
|
||||||
|
- grant user access to a database - using 'updateUser()'
|
||||||
|
- revoke user access to a database - using 'updateUser()'
|
||||||
|
- show user access to a database - using 'getUser()'
|
||||||
|
|
||||||
|
|
||||||
|
Alternatives
|
||||||
|
------------
|
||||||
|
|
||||||
|
Grant os_admin “root” role for full access.
|
||||||
|
|
||||||
|
|
||||||
|
Implementation
|
||||||
|
==============
|
||||||
|
|
||||||
|
Assignee(s)
|
||||||
|
-----------
|
||||||
|
|
||||||
|
Matthew Van Dijk
|
||||||
|
|
||||||
|
|
||||||
|
Milestones
|
||||||
|
----------
|
||||||
|
|
||||||
|
liberty-1
|
||||||
|
|
||||||
|
|
||||||
|
Work Items
|
||||||
|
----------
|
||||||
|
|
||||||
|
The work will be split into four deliverables:
|
||||||
|
|
||||||
|
1) Enable authentication on server
|
||||||
|
2) create/list/show/delete users
|
||||||
|
3) enable/check root
|
||||||
|
4) grant/show/revoke access
|
||||||
|
|
||||||
|
|
||||||
|
Upgrade Implications
|
||||||
|
====================
|
||||||
|
|
||||||
|
There will be no upgrade implications.
|
||||||
|
|
||||||
|
|
||||||
|
Dependencies
|
||||||
|
============
|
||||||
|
|
||||||
|
There are no dependencies on other work in progress.
|
||||||
|
|
||||||
|
|
||||||
|
Testing
|
||||||
|
=======
|
||||||
|
|
||||||
|
Unit tests will be added to validate non-trivial codepaths.
|
||||||
|
Integration tests may be added if necessary.
|
||||||
|
|
||||||
|
|
||||||
|
Documentation Impact
|
||||||
|
====================
|
||||||
|
|
||||||
|
Documentation will be required to explain that authentication is enabled on
|
||||||
|
MongoDB guests. The MongoDB datastore documentation can be updated to reflect
|
||||||
|
the enabled features.
|
||||||
|
|
||||||
|
|
||||||
|
References
|
||||||
|
==========
|
||||||
|
|
||||||
|
`MongoDB manual
|
||||||
|
<http://docs.mongodb.org/manual/>`_
|
||||||
|
|
||||||
Loading…
Reference in New Issue
Block a user