From 5266eb32696ee5e56eb64857690370b2e9ba2ebc Mon Sep 17 00:00:00 2001 From: Jeff Mitchell Date: Wed, 10 Feb 2021 15:59:31 -0500 Subject: [PATCH] Don't error worker filters if a key isn't found, treat it as a non-match (#900) --- CHANGELOG.md | 13 +- go.mod | 1 + .../handlers/targets/target_service.go | 3 +- internal/tests/cluster/worker_tagging_test.go | 6 + .../docs/concepts/filtering/worker-tags.mdx | 10 +- .../docs/concepts/security/permissions.mdx | 1156 ++++++++++------- 6 files changed, 701 insertions(+), 488 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a5107b818..4f419fb6c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,11 @@ Canonical reference for changes, improvements, and bugfixes for Boundary. ### Changes/Deprecations +* authentication: The `auth-methods/:authenticate` action is deprecated and + will be removed in a few releases. Instead, each auth method will define its + own action or actions that are valid. This is necessary to support multi-step + authentication schemes in upcoming releases. For the `password` auth method, + the new action is `auth-methods/:authenticate:login`. * permissions: Update some errors to make them more descriptive, and disallow permissions in some forms where they will never take effect, preventing possible confusion (existing grants already saved to the database will not be @@ -16,11 +21,6 @@ Canonical reference for changes, improvements, and bugfixes for Boundary. * `type=;actions=` where one of the actions is _not_ `create` or `list`. This format operates only on collections so assigning more actions this way will never work -* authentication: The `auth-methods/:authenticate` action is deprecated and - will be removed in a few releases. Instead, each auth method will define its - own action or actions that are valid. This is necessary to support multi-step - authentication schemes in upcoming releases. For the `password` auth method, - the new action is `auth-methods/:authenticate:login`. ### New and Improved @@ -38,6 +38,9 @@ Canonical reference for changes, improvements, and bugfixes for Boundary. * server: When shutting down a controller release the shared advisory lock with a non cancelled context. ([Issue](https://github.com/hashicorp/boundary/pull/909), [PR](https://github.com/hashicorp/boundary/pull/918)) +* targets: If a worker filter references a key that doesn't exist, treat it as a + non-match rather than an error + ([PR](https://github.com/hashicorp/boundary/pull/900)) ## 0.1.5 (2021/01/29) diff --git a/go.mod b/go.mod index 24b6f2b8e..856695d82 100644 --- a/go.mod +++ b/go.mod @@ -45,6 +45,7 @@ require ( github.com/mitchellh/go-wordwrap v1.0.1 github.com/mitchellh/gox v1.0.1 github.com/mitchellh/mapstructure v1.4.1 + github.com/mitchellh/pointerstructure v1.1.1 github.com/mr-tron/base58 v1.2.0 github.com/oligot/go-mod-upgrade v0.3.0 github.com/ory/dockertest/v3 v3.6.0 diff --git a/internal/servers/controller/handlers/targets/target_service.go b/internal/servers/controller/handlers/targets/target_service.go index 070722182..97fa2bb18 100644 --- a/internal/servers/controller/handlers/targets/target_service.go +++ b/internal/servers/controller/handlers/targets/target_service.go @@ -30,6 +30,7 @@ import ( "github.com/hashicorp/boundary/internal/types/scope" "github.com/hashicorp/boundary/sdk/strutil" "github.com/hashicorp/go-bexpr" + "github.com/mitchellh/pointerstructure" "github.com/mr-tron/base58" "google.golang.org/grpc/codes" "google.golang.org/protobuf/proto" @@ -498,7 +499,7 @@ HostSetIterationLoop: "tags": tagMap[worker], } ok, err := eval.Evaluate(filterInput) - if err != nil { + if err != nil && !stderrors.Is(err, pointerstructure.ErrNotFound) { return nil, handlers.ApiErrorWithCodeAndMessage( codes.FailedPrecondition, fmt.Sprintf("Worker filter expression evaluation resulted in error: %s", err)) diff --git a/internal/tests/cluster/worker_tagging_test.go b/internal/tests/cluster/worker_tagging_test.go index 7dc916752..104fcc1da 100644 --- a/internal/tests/cluster/worker_tagging_test.go +++ b/internal/tests/cluster/worker_tagging_test.go @@ -56,6 +56,7 @@ func TestWorkerTagging(t *testing.T) { conf.Worker.Name = "w1" conf.Worker.Tags = map[string][]string{ "region": {"east"}, + "foo": {"bar"}, } w1 := worker.NewTestWorker(t, &worker.TestWorkerOpts{ Config: conf, @@ -122,6 +123,11 @@ func TestWorkerTagging(t *testing.T) { filter: `"/name" matches "w[23]" and "three" in "/tags/az"`, expWorkers: []string{w2Addr, w3Addr}, }, + { + name: "key not found doesn't error", + filter: `"bar" in "/tags/foo"`, + expWorkers: []string{w1Addr}, + }, } for _, tc := range cases { t.Run(tc.name, func(t *testing.T) { diff --git a/website/content/docs/concepts/filtering/worker-tags.mdx b/website/content/docs/concepts/filtering/worker-tags.mdx index 2097259da..c7f566558 100644 --- a/website/content/docs/concepts/filtering/worker-tags.mdx +++ b/website/content/docs/concepts/filtering/worker-tags.mdx @@ -74,6 +74,13 @@ nested under `tags` and include a `name` value: } ``` +!> If an expression fails due to a key not being found within the input data, +the worker is not included in the final set, so ensure that all workers that +should match a given filter are populated with tags referenced in the filter +string. As a corollary, it is not possible to distinguish between a worker that +is not included due to the expression itself and a worker that did not have +correct tags. + Following are some examples of using these values in filters: - Name regex: `"/name" matches "web-prod-us-east-[12]"`, which would @@ -83,5 +90,4 @@ Following are some examples of using these values in filters: values, so it must use the `in` operator to search in the collection. If you know that you have only one value, an equivalent would be `"/tags/region/0" == "us-east-1"`. -- Grouping: `("us-east-1" in "/tags/region" and "/name" == "web-prod-us-east-1") -or "webservers" in "/tags/type"` +- Grouping: `("us-east-1" in "/tags/region" and "/name" == "web-prod-us-east-1") or "webservers" in "/tags/type"` diff --git a/website/content/docs/concepts/security/permissions.mdx b/website/content/docs/concepts/security/permissions.mdx index 795fe9e32..5e10f2813 100644 --- a/website/content/docs/concepts/security/permissions.mdx +++ b/website/content/docs/concepts/security/permissions.mdx @@ -18,9 +18,9 @@ Each grant is a mapping that describes a resource or set of resources and the actions that should be allowed on them. Thus, each grant contains one or more of: -* An `id` field that indicates a specific resource or a wildcard to match all -* A `type` field that indicates a specific resource type or a wildcard to match all -* An `actions` field indicating which actions to allow the client to perform on the resources matched by `id` and `type` +- An `id` field that indicates a specific resource or a wildcard to match all +- A `type` field that indicates a specific resource type or a wildcard to match all +- An `actions` field indicating which actions to allow the client to perform on the resources matched by `id` and `type` Grant strings can be supplied via a human-friendly string syntax or via JSON. @@ -57,10 +57,10 @@ request. A role provides grants for a request if the grant scope ID matches the request's scope ID and one or more of the following are true: -* The user's ID is contained in the principal IDs set on the role -* A group the user belongs to is contained in the principal IDs set on the role -* The user is logged in and the `u_auth` user is contained in the principal IDs set on the role -* The role contains the `u_anon` user in the in the principal IDs set on the role +- The user's ID is contained in the principal IDs set on the role +- A group the user belongs to is contained in the principal IDs set on the role +- The user is logged in and the `u_auth` user is contained in the principal IDs set on the role +- The role contains the `u_anon` user in the in the principal IDs set on the role ## Permission Grant Formats @@ -89,20 +89,20 @@ For a given type, allow these actions. Example: Because type specifies only a collection as opposed to specific resources within that collection, only collection actions are allowed in this format. Currently, -this is `create` and `list`. +this is `create` and `list`. There is one additional restriction: this is only valid against "top-level" resource types, which currently are: -* Auth Methods -* Auth Tokens -* Groups -* Host Catalogs -* Roles -* Scopes -* Sessions -* Targets -* Users +- Auth Methods +- Auth Tokens +- Groups +- Host Catalogs +- Roles +- Scopes +- Sessions +- Targets +- Users The reason for this is that other types of resources are contained within one of these resource types; for instance, accounts are instantiated within an auth @@ -118,7 +118,7 @@ easiest to explain with an example: `id=hcst_1234567890;type=host-set;actions=create,read,update` In this example, the user is able to create, read, or update host sets within -the scope, but *only the host sets belonging to host catalog hcst_1234567890*. +the scope, but _only the host sets belonging to host catalog hcst_1234567890_. Pinning is essentially a way to use top-level resources to create mini permission boundaries for their subordinate resources. @@ -164,14 +164,14 @@ Such a grant is essentially a full administrator grant for a scope. A few template possibilities exist, which will at grant evaluation time substitute the given value into the ID field of the grant string: -* `{{account.id}}`: The substituted value is the account ID associated with the -token used to perform the action. As an example, -`id={{account.id}};actions=read,change-password"` is one of Boundary's default -grants to allow users that have authenticated with the Password auth method to -change their own password. +- `{{account.id}}`: The substituted value is the account ID associated with the + token used to perform the action. As an example, + `id={{account.id}};actions=read,change-password"` is one of Boundary's default + grants to allow users that have authenticated with the Password auth method to + change their own password. -* `{{user.id}}`: The substituted value is the user ID associated with the token -used to perform the action. +- `{{user.id}}`: The substituted value is the user ID associated with the token + used to perform the action. ## Resource Table @@ -206,11 +206,11 @@ wildcard or templated grant strings.
  • Type
    • -
      -
    • - account -
      • -
    +
      +
    • + account +
      • +
@@ -218,15 +218,19 @@ wildcard or templated grant strings.
  • create: Create an account
    • -
      -
    • type=<type>;actions=create
      • -
    +
      +
    • + type=<type>;actions=create +
      • +
  • list: List accounts
    • -
      -
    • type=<type>;actions=list
      • -
    +
      +
    • + type=<type>;actions=list +
      • +
    @@ -237,23 +241,23 @@ wildcard or templated grant strings.
    • ID
      • -
        -
      • - <id> -
        • -
      +
        +
      • + <id> +
        • +
    • Pin
      • -
        -
      • - <auth-method-id> -
        • -
      +
        +
      • + <auth-method-id> +
        • +
    • Type
      • -
        -
      • - account -
        • -
      +
        +
      • + account +
        • +
    @@ -261,38 +265,62 @@ wildcard or templated grant strings.
  • read: Read an account
    • -
      -
    • id=<id>;actions=read
      • -
    • id=<pin>;type=<type>;actions=read
      • -
    +
      +
    • + id=<id>;actions=read +
      • +
    • + id=<pin>;type=<type>;actions=read +
      • +
  • update: Update an account
    • -
      -
    • id=<id>;actions=update
      • -
    • id=<pin>;type=<type>;actions=update
      • -
    +
      +
    • + id=<id>;actions=update +
      • +
    • + id=<pin>;type=<type>;actions=update +
      • +
  • delete: Delete an account
    • -
      -
    • id=<id>;actions=delete
      • -
    • id=<pin>;type=<type>;actions=delete
      • -
    +
      +
    • + id=<id>;actions=delete +
      • +
    • + id=<pin>;type=<type>;actions=delete +
      • +
  • - set-password: Set a password on an account, without requring the current password + set-password: Set a password on an account, without + requring the current password
    • -
      -
    • id=<id>;actions=set-password
      • -
    • id=<pin>;type=<type>;actions=set-password
      • -
    +
      +
    • + id=<id>;actions=set-password +
      • +
    • + id=<pin>;type=<type>;actions=set-password +
      • +
  • - change-password: Change a password on an account given the current password + change-password: Change a password on an account given + the current password
    • -
      -
    • id=<id>;actions=change-password
      • -
    • id=<pin>;type=<type>;actions=change-password
      • -
    +
      +
    • + id=<id>;actions=change-password +
      • +
    • + + id=<pin>;type=<type>;actions=change-password + +
      • +
    @@ -310,11 +338,11 @@ wildcard or templated grant strings.
    • Type
      • -
        -
      • - auth-method -
        • -
      +
        +
      • + auth-method +
        • +
    @@ -322,15 +350,19 @@ wildcard or templated grant strings.
  • create: Create an auth method
    • -
      -
    • type=<type>;actions=create
      • -
    +
      +
    • + type=<type>;actions=create +
      • +
  • list: List auth methods
    • -
      -
    • type=<type>;actions=list
      • -
    +
      +
    • + type=<type>;actions=list +
      • +
    @@ -341,17 +373,17 @@ wildcard or templated grant strings.
    • ID
      • -
        -
      • - <id> -
        • -
      +
        +
      • + <id> +
        • +
    • Type
      • -
        -
      • - auth-method -
        • -
      +
        +
      • + auth-method +
        • +
    @@ -359,27 +391,35 @@ wildcard or templated grant strings.
  • read: Read an auth method
    • -
      -
    • id=<id>;actions=read
      • -
    +
      +
    • + id=<id>;actions=read +
      • +
  • update: Update an auth method
    • -
      -
    • id=<id>;actions=update
      • -
    +
      +
    • + id=<id>;actions=update +
      • +
  • delete: Delete an auth method
    • -
      -
    • id=<id>;actions=delete
      • -
    +
      +
    • + id=<id>;actions=delete +
      • +
  • authenticate: Authenticate to an auth method
    • -
      -
    • id=<id>;actions=authenticate
      • -
    +
      +
    • + id=<id>;actions=authenticate +
      • +
    @@ -397,11 +437,11 @@ wildcard or templated grant strings.
    • Type
      • -
        -
      • - auth-token -
        • -
      +
        +
      • + auth-token +
        • +
    @@ -409,9 +449,11 @@ wildcard or templated grant strings.
  • list: List auth tokens
    • -
      -
    • type=<type>;actions=list
      • -
    +
      +
    • + type=<type>;actions=list +
      • +
    @@ -422,17 +464,17 @@ wildcard or templated grant strings.
    • ID
      • -
        -
      • - <id> -
        • -
      +
        +
      • + <id> +
        • +
    • Type
      • -
        -
      • - auth-token -
        • -
      +
        +
      • + auth-token +
        • +
    @@ -440,15 +482,19 @@ wildcard or templated grant strings.
  • read: Read an auth token
    • -
      -
    • id=<id>;actions=read
      • -
    +
      +
    • + id=<id>;actions=read +
      • +
  • delete: Delete an auth token
    • -
      -
    • id=<id>;actions=delete
      • -
    +
      +
    • + id=<id>;actions=delete +
      • +
    @@ -467,11 +513,11 @@ wildcard or templated grant strings.
    • Type
      • -
        -
      • - group -
        • -
      +
        +
      • + group +
        • +
    @@ -479,15 +525,19 @@ wildcard or templated grant strings.
  • create: Create a group
    • -
      -
    • type=<type>;actions=create
      • -
    +
      +
    • + type=<type>;actions=create +
      • +
  • list: List groups
    • -
      -
    • type=<type>;actions=list
      • -
    +
      +
    • + type=<type>;actions=list +
      • +
    @@ -498,17 +548,17 @@ wildcard or templated grant strings.
    • ID
      • -
        -
      • - <id> -
        • -
      +
        +
      • + <id> +
        • +
    • Type
      • -
        -
      • - group -
        • -
      +
        +
      • + group +
        • +
    @@ -516,39 +566,51 @@ wildcard or templated grant strings.
  • read: Read a group
    • -
      -
    • id=<id>;actions=read
      • -
    +
      +
    • + id=<id>;actions=read +
      • +
  • update: Update a group
    • -
      -
    • id=<id>;actions=update
      • -
    +
      +
    • + id=<id>;actions=update +
      • +
  • delete: Delete a group
    • -
      -
    • id=<id>;actions=delete
      • -
    +
      +
    • + id=<id>;actions=delete +
      • +
  • add-members: Add members to a group
    • -
      -
    • id=<id>;actions=add-members
      • -
    +
      +
    • + id=<id>;actions=add-members +
      • +
  • set-members: Set the full set of members on a group
    • -
      -
    • id=<id>;actions=set-members
      • -
    +
      +
    • + id=<id>;actions=set-members +
      • +
  • remove-members: Remove members from a group
    • -
      -
    • id=<id>;actions=remove-members
      • -
    +
      +
    • + id=<id>;actions=remove-members +
      • +
    @@ -565,11 +627,11 @@ wildcard or templated grant strings.
    • Type
      • -
        -
      • - host -
        • -
      +
        +
      • + host +
        • +
    @@ -577,15 +639,19 @@ wildcard or templated grant strings.
  • create: Create a host
    • -
      -
    • type=<type>;actions=create
      • -
    +
      +
    • + type=<type>;actions=create +
      • +
  • list: List hosts
    • -
      -
    • type=<type>;actions=list
      • -
    +
      +
    • + type=<type>;actions=list +
      • +
    @@ -596,23 +662,23 @@ wildcard or templated grant strings.
    • ID
      • -
        -
      • - <id> -
        • -
      +
        +
      • + <id> +
        • +
    • Pin
      • -
        -
      • - <host-catalog-id> -
        • -
      +
        +
      • + <host-catalog-id> +
        • +
    • Type
      • -
        -
      • - host -
        • -
      +
        +
      • + host +
        • +
    @@ -620,24 +686,36 @@ wildcard or templated grant strings.
  • read: Read a host
    • -
      -
    • id=<id>;actions=read
      • -
    • id=<pin>;type=<type>;actions=read
      • -
    +
      +
    • + id=<id>;actions=read +
      • +
    • + id=<pin>;type=<type>;actions=read +
      • +
  • update: Update a host
    • -
      -
    • id=<id>;actions=update
      • -
    • id=<pin>;type=<type>;actions=update
      • -
    +
      +
    • + id=<id>;actions=update +
      • +
    • + id=<pin>;type=<type>;actions=update +
      • +
  • delete: Delete a host
    • -
      -
    • id=<id>;actions=delete
      • -
    • id=<pin>;type=<type>;actions=delete
      • -
    +
      +
    • + id=<id>;actions=delete +
      • +
    • + id=<pin>;type=<type>;actions=delete +
      • +
    @@ -654,11 +732,11 @@ wildcard or templated grant strings.
    • Type
      • -
        -
      • - host-catalog -
        • -
      +
        +
      • + host-catalog +
        • +
    @@ -666,15 +744,19 @@ wildcard or templated grant strings.
  • create: Create a host catalog
    • -
      -
    • type=<type>;actions=create
      • -
    +
      +
    • + type=<type>;actions=create +
      • +
  • list: List host catalogs
    • -
      -
    • type=<type>;actions=list
      • -
    +
      +
    • + type=<type>;actions=list +
      • +
    @@ -685,17 +767,17 @@ wildcard or templated grant strings.
    • ID
      • -
        -
      • - <id> -
        • -
      +
        +
      • + <id> +
        • +
    • Type
      • -
        -
      • - host-catalog -
        • -
      +
        +
      • + host-catalog +
        • +
    @@ -703,21 +785,27 @@ wildcard or templated grant strings.
  • read: Read a host catalog
    • -
      -
    • id=<id>;actions=read
      • -
    +
      +
    • + id=<id>;actions=read +
      • +
  • update: Update a host catalog
    • -
      -
    • id=<id>;actions=update
      • -
    +
      +
    • + id=<id>;actions=update +
      • +
  • delete: Delete a host catalog
    • -
      -
    • id=<id>;actions=delete
      • -
    +
      +
    • + id=<id>;actions=delete +
      • +
    @@ -734,11 +822,11 @@ wildcard or templated grant strings.
    • Type
      • -
        -
      • - host-set -
        • -
      +
        +
      • + host-set +
        • +
    @@ -746,15 +834,19 @@ wildcard or templated grant strings.
  • create: Create a host set
    • -
      -
    • type=<type>;actions=create
      • -
    +
      +
    • + type=<type>;actions=create +
      • +
  • list: List host sets
    • -
      -
    • type=<type>;actions=list
      • -
    +
      +
    • + type=<type>;actions=list +
      • +
    @@ -765,23 +857,23 @@ wildcard or templated grant strings.
    • ID
      • -
        -
      • - <id> -
        • -
      +
        +
      • + <id> +
        • +
    • Pin
      • -
        -
      • - <host-catalog-id> -
        • -
      +
        +
      • + <host-catalog-id> +
        • +
    • Type
      • -
        -
      • - host-set -
        • -
      +
        +
      • + host-set +
        • +
    @@ -789,45 +881,69 @@ wildcard or templated grant strings.
  • read: Read a host set
    • -
      -
    • id=<id>;actions=read
      • -
    • id=<pin>;type=<type>;actions=read
      • -
    +
      +
    • + id=<id>;actions=read +
      • +
    • + id=<pin>;type=<type>;actions=read +
      • +
  • update: Update a host set
    • -
      -
    • id=<id>;actions=update
      • -
    • id=<pin>;type=<type>;actions=update
      • -
    +
      +
    • + id=<id>;actions=update +
      • +
    • + id=<pin>;type=<type>;actions=update +
      • +
  • delete: Delete a host set
    • -
      -
    • id=<id>;actions=delete
      • -
    • id=<pin>;type=<type>;actions=delete
      • -
    +
      +
    • + id=<id>;actions=delete +
      • +
    • + id=<pin>;type=<type>;actions=delete +
      • +
  • add-hosts: Add hosts to a host-set
    • -
      -
    • id=<id>;actions=add-hosts
      • -
    • id=<pin>;type=<type>;actions=add-hosts
      • -
    +
      +
    • + id=<id>;actions=add-hosts +
      • +
    • + id=<pin>;type=<type>;actions=add-hosts +
      • +
  • set-hosts: Set the full set of hosts on a host set
    • -
      -
    • id=<id>;actions=set-hosts
      • -
    • id=<pin>;type=<type>;actions=set-hosts
      • -
    +
      +
    • + id=<id>;actions=set-hosts +
      • +
    • + id=<pin>;type=<type>;actions=set-hosts +
      • +
  • remove-hosts: Remove hosts from a host set
    • -
      -
    • id=<id>;actions=remove-hosts
      • -
    • id=<pin>;type=<type>;actions=remove-hosts
      • -
    +
      +
    • + id=<id>;actions=remove-hosts +
      • +
    • + id=<pin>;type=<type>;actions=remove-hosts +
      • +
    @@ -846,11 +962,11 @@ wildcard or templated grant strings.
    • Type
      • -
        -
      • - role -
        • -
      +
        +
      • + role +
        • +
    @@ -858,15 +974,19 @@ wildcard or templated grant strings.
  • create: Create a role
    • -
      -
    • type=<type>;actions=create
      • -
    +
      +
    • + type=<type>;actions=create +
      • +
  • list: List roles
    • -
      -
    • type=<type>;actions=list
      • -
    +
      +
    • + type=<type>;actions=list +
      • +
    @@ -877,17 +997,17 @@ wildcard or templated grant strings.
    • ID
      • -
        -
      • - <id> -
        • -
      +
        +
      • + <id> +
        • +
    • Type
      • -
        -
      • - role -
        • -
      +
        +
      • + role +
        • +
    @@ -895,57 +1015,76 @@ wildcard or templated grant strings.
  • read: Read a role
    • -
      -
    • id=<id>;actions=read
      • -
    +
      +
    • + id=<id>;actions=read +
      • +
  • update: Update a role
    • -
      -
    • id=<id>;actions=update
      • -
    +
      +
    • + id=<id>;actions=update +
      • +
  • delete: Delete a role
    • -
      -
    • id=<id>;actions=delete
      • -
    +
      +
    • + id=<id>;actions=delete +
      • +
  • add-principals: Add principals to a role
    • -
      -
    • id=<id>;actions=add-principals
      • -
    +
      +
    • + id=<id>;actions=add-principals +
      • +
  • - set-principals: Set the full set of principals on a role + set-principals: Set the full set of principals on a + role
    • -
      -
    • id=<id>;actions=set-principals
      • -
    +
      +
    • + id=<id>;actions=set-principals +
      • +
  • remove-principals: Remove principals from a role
    • -
      -
    • id=<id>;actions=remove-principals
      • -
    +
      +
    • + id=<id>;actions=remove-principals +
      • +
  • add-grants: Add grants to a role
    • -
      -
    • id=<id>;actions=add-grants
      • -
    +
      +
    • + id=<id>;actions=add-grants +
      • +
  • set-grants: Set the full set of grants on a role
    • -
      -
    • id=<id>;actions=set-grants
      • -
    +
      +
    • + id=<id>;actions=set-grants +
      • +
  • remove-grants: Remove grants from a role
    • -
      -
    • id=<id>;actions=remove-grants
      • -
    +
      +
    • + id=<id>;actions=remove-grants +
      • +
    @@ -963,11 +1102,11 @@ wildcard or templated grant strings.
    • Type
      • -
        -
      • - scope -
        • -
      +
        +
      • + scope +
        • +
    @@ -975,15 +1114,19 @@ wildcard or templated grant strings.
  • create: Create a scope
    • -
      -
    • type=<type>;actions=create
      • -
    +
      +
    • + type=<type>;actions=create +
      • +
  • list: List scopes
    • -
      -
    • type=<type>;actions=list
      • -
    +
      +
    • + type=<type>;actions=list +
      • +
    @@ -994,17 +1137,17 @@ wildcard or templated grant strings.
    • ID
      • -
        -
      • - <id> -
        • -
      +
        +
      • + <id> +
        • +
    • Type
      • -
        -
      • - scope -
        • -
      +
        +
      • + scope +
        • +
    @@ -1012,21 +1155,27 @@ wildcard or templated grant strings.
  • read: Read a scope
    • -
      -
    • id=<id>;actions=read
      • -
    +
      +
    • + id=<id>;actions=read +
      • +
  • update: Update a scope
    • -
      -
    • id=<id>;actions=update
      • -
    +
      +
    • + id=<id>;actions=update +
      • +
  • delete: Delete a scope
    • -
      -
    • id=<id>;actions=delete
      • -
    +
      +
    • + id=<id>;actions=delete +
      • +
    @@ -1043,11 +1192,11 @@ wildcard or templated grant strings.
    • Type
      • -
        -
      • - session -
        • -
      +
        +
      • + session +
        • +
    @@ -1055,9 +1204,11 @@ wildcard or templated grant strings.
  • list: List sessions
    • -
      -
    • type=<type>;actions=list
      • -
    +
      +
    • + type=<type>;actions=list +
      • +
    @@ -1068,17 +1219,17 @@ wildcard or templated grant strings.
    • ID
      • -
        -
      • - <id> -
        • -
      +
        +
      • + <id> +
        • +
    • Type
      • -
        -
      • - session -
        • -
      +
        +
      • + session +
        • +
    @@ -1086,27 +1237,37 @@ wildcard or templated grant strings.
  • read: Read a session
    • -
      -
    • id=<id>;actions=read
      • -
    +
      +
    • + id=<id>;actions=read +
      • +
  • cancel: Cancel a session
    • -
      -
    • id=<id>;actions=cancel
      • -
    +
      +
    • + id=<id>;actions=cancel +
      • +
  • - read:self: Read a session, which must belong to the calling user + read:self: Read a session, which must belong to the + calling user
    • -
      -
    • id=*;type=session;actions=read:self
      • -
    +
      +
    • + id=*;type=session;actions=read:self +
      • +
  • - cancel:self: Cancel a session, which must belong to the calling user + cancel:self: Cancel a session, which must belong to the + calling user
    • -
      -
    • id=*;type=session;actions=cancel:self
      • -
    +
      +
    • + id=*;type=session;actions=cancel:self +
      • +
    @@ -1123,11 +1284,11 @@ wildcard or templated grant strings.
    • Type
      • -
        -
      • - target -
        • -
      +
        +
      • + target +
        • +
    @@ -1135,15 +1296,19 @@ wildcard or templated grant strings.
  • create: Create a target
    • -
      -
    • type=<type>;actions=create
      • -
    +
      +
    • + type=<type>;actions=create +
      • +
  • list: List targets
    • -
      -
    • type=<type>;actions=list
      • -
    +
      +
    • + type=<type>;actions=list +
      • +
    @@ -1154,17 +1319,17 @@ wildcard or templated grant strings.
    • ID
      • -
        -
      • - <id> -
        • -
      +
        +
      • + <id> +
        • +
    • Type
      • -
        -
      • - target -
        • -
      +
        +
      • + target +
        • +
    @@ -1172,45 +1337,60 @@ wildcard or templated grant strings.
  • read: Read a target
    • -
      -
    • id=<id>;actions=read
      • -
    +
      +
    • + id=<id>;actions=read +
      • +
  • update: Update a target
    • -
      -
    • id=<id>;actions=update
      • -
    +
      +
    • + id=<id>;actions=update +
      • +
  • delete: Delete a target
    • -
      -
    • id=<id>;actions=delete
      • -
    +
      +
    • + id=<id>;actions=delete +
      • +
  • add-host-sets: Add host sets to a target
    • -
      -
    • id=<id>;actions=add-host-sets
      • -
    +
      +
    • + id=<id>;actions=add-host-sets +
      • +
  • - set-host-sets: Set the full set of host sets on a target + set-host-sets: Set the full set of host sets on a + target
    • -
      -
    • id=<id>;actions=set-host-sets
      • -
    +
      +
    • + id=<id>;actions=set-host-sets +
      • +
  • remove-host-sets: Remove host sets from a target
    • -
      -
    • id=<id>;actions=remove-host-sets
      • -
    +
      +
    • + id=<id>;actions=remove-host-sets +
      • +
  • authorize-session: Authorize a session via the target
    • -
      -
    • id=<id>;actions=authorize-session
      • -
    +
      +
    • + id=<id>;actions=authorize-session +
      • +
    @@ -1228,11 +1408,11 @@ wildcard or templated grant strings.
    • Type
      • -
        -
      • - user -
        • -
      +
        +
      • + user +
        • +
    @@ -1240,15 +1420,19 @@ wildcard or templated grant strings.
  • create: Create a user
    • -
      -
    • type=<type>;actions=create
      • -
    +
      +
    • + type=<type>;actions=create +
      • +
  • list: List users
    • -
      -
    • type=<type>;actions=list
      • -
    +
      +
    • + type=<type>;actions=list +
      • +
    @@ -1259,17 +1443,17 @@ wildcard or templated grant strings.
    • ID
      • -
        -
      • - <id> -
        • -
      +
        +
      • + <id> +
        • +
    • Type
      • -
        -
      • - user -
        • -
      +
        +
      • + user +
        • +
    @@ -1277,39 +1461,51 @@ wildcard or templated grant strings.
  • read: Read a user
    • -
      -
    • id=<id>;actions=read
      • -
    +
      +
    • + id=<id>;actions=read +
      • +
  • update: Update a user
    • -
      -
    • id=<id>;actions=update
      • -
    +
      +
    • + id=<id>;actions=update +
      • +
  • delete: Delete a user
    • -
      -
    • id=<id>;actions=delete
      • -
    +
      +
    • + id=<id>;actions=delete +
      • +
  • add-accounts: Add accounts to a user
    • -
      -
    • id=<id>;actions=add-accounts
      • -
    +
      +
    • + id=<id>;actions=add-accounts +
      • +
  • set-accounts: Set the full set of accounts on a user
    • -
      -
    • id=<id>;actions=set-accounts
      • -
    +
      +
    • + id=<id>;actions=set-accounts +
      • +
  • remove-accounts: Remove accounts from a user
    • -
      -
    • id=<id>;actions=remove-accounts
      • -
    +
      +
    • + id=<id>;actions=remove-accounts +
      • +