saltstack/salt
1
0
Fork 0
mirror of https://github.com/saltstack/salt.git synced 2025-04-16 09:40:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Port #49617 to master

Browse source
This commit is contained in:
MKelley80 2020-05-07 17:44:07 +03:00 • committed by Daniel Wozniak
parent 86e061f91e
commit a6b63cb81d
3 changed files with 47 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
doc/ref/publisheracl.rst
View file

@ -7,6 +7,25 @@ Publisher ACL system
The salt publisher ACL system is a means to allow system users other than root
to have access to execute select salt commands on minions from the master.
.. note::
``publisher_acl`` is useful for allowing local system users to run Salt
commands without giving them root access. If you can log into the Salt
master directly, then ``publisher_acl`` allows you to use Salt without
root privileges. If the local system is configured to authenticate against
a remote system, like LDAP or Active Directory, then ``publisher_acl`` will
interact with the remote system transparently.
``external_auth`` is useful for ``salt-api`` or for making your own scripts
that use Salt's Python API. It can be used at the CLI (with the ``-a``
flag) but it is more cumbersome as there are more steps involved. The only
time it is useful at the CLI is when the local system is *not* configured
to authenticate against an external service *but* you still want Salt to
authenticate against an external service.
For more information and examples, see :ref:`this Access Control System
<acl_types>` section.
The publisher ACL system is configured in the master configuration file via the
``publisher_acl`` configuration option. Under the ``publisher_acl``
configuration option the users open to send commands are specified and then a

7
doc/topics/eauth/access_control.rst
View file

@ -28,6 +28,13 @@ case of the peer system.
index
../../ref/peer
.. The two paragraphs below (in the "When to use each authentication system"
heading) are copied in the doc/ref/publisheracl.rst and doc/topics/eauth/index.rst
topics as a note, at the top of the document. If you update the below
content, update it in the other two files as well.
.. _acl_types:
When to Use Each Authentication System
======================================
``publisher_acl`` is useful for allowing local system users to run Salt

23
doc/topics/eauth/index.rst
View file

@ -12,6 +12,25 @@ command authorization to any external authentication system, such as PAM or LDAP
eAuth using the PAM external auth system requires salt-master to be run as
root as this system needs root access to check authentication.
.. note::
``publisher_acl`` is useful for allowing local system users to run Salt
commands without giving them root access. If you can log into the Salt
master directly, then ``publisher_acl`` allows you to use Salt without
root privileges. If the local system is configured to authenticate against
a remote system, like LDAP or Active Directory, then ``publisher_acl`` will
interact with the remote system transparently.
``external_auth`` is useful for ``salt-api`` or for making your own scripts
that use Salt's Python API. It can be used at the CLI (with the ``-a``
flag) but it is more cumbersome as there are more steps involved. The only
time it is useful at the CLI is when the local system is *not* configured
to authenticate against an external service *but* you still want Salt to
authenticate against an external service.
For more information and examples, see :ref:`this Access Control System
<acl_types>` section.
External Authentication System Configuration
============================================
The external authentication system allows for specific users to be granted
@ -275,7 +294,7 @@ Server configuration values and their defaults:
auth.ldap.persontype: 'person'
auth.ldap.minion_stripdomains: []
# Redhat Identity Policy Audit
auth.ldap.freeipa: False
@ -344,7 +363,7 @@ from LDAP or Active Directory have fully-qualified domain names attached, while
instead are simple hostnames. The parameter below allows the administrator to strip
off a certain set of domain names so the hostnames looked up in the directory service
can match the minion IDs.
.. code-block:: yaml
auth.ldap.minion_stripdomains: ['.external.bigcorp.com', '.internal.bigcorp.com']