-
Notifications
You must be signed in to change notification settings - Fork 108
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #384 from liftbridge-io/v1.7.1
Prepare v1.7.1
- Loading branch information
Showing
10 changed files
with
451 additions
and
17 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| package server | ||
|
|
||
| // Version of the Liftbridge server. | ||
| const Version = "v1.7.0" | ||
| const Version = "v1.7.1" |
59 changes: 59 additions & 0 deletions
59
website/versioned_docs/version-v1.7.1/authentication_authorization.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| --- | ||
| id: version-v1.7.1-authentication-authorization | ||
| title: Authentication and Authorization | ||
| original_id: authentication-authorization | ||
| --- | ||
|
|
||
| Liftbridge currently supports authentication via mutual TLS. This allows both | ||
| the client to authenticate the server and the server to authenticate clients | ||
| using certificates. | ||
|
|
||
| Liftbridge does not currently support authorization, but ACL-based | ||
| authorization is planned for a future release. | ||
|
|
||
| ## Authentication | ||
|
|
||
| Authentication is currently supported using mutual TLS. There are several | ||
| parameters for TLS configuration on the server side. | ||
|
|
||
| ```yaml | ||
| tls: | ||
| key: server-key.pem | ||
| cert: server-cert.pem | ||
| client.auth.enabled: true | ||
| client.auth.ca: ca-cert.pem | ||
| ``` | ||
| `client.auth.enabled` enables client authentication, and `client.auth.ca` | ||
| specifies the path on the server to the client's certificate authority. Refer | ||
| to the `tls` settings in | ||
| [Configuration](./configuration.md#configuration-settings) for more details. | ||
|
|
||
| With these configurations set on the server, only authenticated clients can | ||
| open connections to the server. Using `ca-cert.pem`, `client-key.pem` and | ||
| `client-cert.pem`, the client can safely open a connection to a Liftbridge | ||
| server. Example Go code to connect to a Liftbridge server using TLS is shown | ||
| below: | ||
|
|
||
| ```golang | ||
| certPool := x509.NewCertPool() | ||
| ca, err := ioutil.ReadFile("ca-cert.pem") | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
| certPool.AppendCertsFromPEM(ca) | ||
| certificate, err := tls.LoadX509KeyPair("client-cert.pem", "client-key.pem") | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
| config := &tls.Config{ | ||
| ServerName: "localhost", | ||
| Certificates: []tls.Certificate{certificate}, | ||
| RootCAs: certPool, | ||
| } | ||
| client, err := lift.Connect([]string{"localhost:9292"}, lift.TLSConfig(config)) | ||
| ``` | ||
|
|
||
| ## Authorization | ||
|
|
||
| Support for authorization is not yet provided. It will be implemented in the future. |
Oops, something went wrong.