Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add credentialz endpoints to manage system role accounts. #207

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add credentialz endpoints to manage system role accounts. #207

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions credentialz/credentialz.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,6 +224,16 @@ service Credentialz {
// Get the current public keys from the host. Each configured key will be
// returned in the provided list.
rpc GetPublicKeys(GetPublicKeysRequest) returns (GetPublicKeysResponse);

// Add a system role account.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would be good to add a strict definition what a "system role account" is.

OpenConfig has SYSTEM_ROLE_ADMIN https://github.com/openconfig/public/blob/db78d44e93a97cef4db27f82bba3fba454e907a5/release/models/system/openconfig-aaa-types.yang#L77-L84, but I have a feeling that you mean something else in this context.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it the case, avanpo, that you mean here:
"Add an account to the NOS, but not to the underlying unix system."

This maybe an operator account:

operator - robot/user responsible for interface up/down/troubleshooting

or an administrative account:

god - the user with all power/privilege on the device

// Note that an attempt to add a system role account that already exists will
// be rejected with an error.
rpc AddAccount(AddAccountRequest) returns (AddAccountResponse);

// Delete a system role account.
// Note that an attempt to delete a system role account that doesn't exist
// will be rejected with an error.
rpc DeleteAccount(DeleteAccountRequest) returns (DeleteAccountResponse);
}

//
Expand Down Expand Up @@ -787,3 +797,17 @@ message GetPublicKeysResponse {
// Return all currently configured keys on host.
repeated PublicKey public_keys = 1;
}

message AddAccountRequest {
// The system role account name. This account must not already exist.
string account = 1;
}

message AddAccountResponse {}

message DeleteAccountRequest {
// The system role account name. This account must exist.
string account = 1;
}

message DeleteAccountResponse {}