Skip to content

Add implementation for "live" / remote user, permission and key management #3

Description

@andrepxx

It shall be possible to perform user, permission and key management without interrupting the service by stopping and restarting the server.

Therefore, a new admin permission shall be introduced, which grants an account administrative privileges.

An account with these privileges shall be able to perform user, permission and key management functions, which are currently performed "offline", in an "online" manner with an authenticated session on a running server.

This includes the following functions.

  • listing existing users
  • retrieve an existing user's permissions
  • retrieve public keys associated with an existing user
  • export a public key associated with an existing user in PEM format
  • retrieve device tokens associated with an existing user
  • creating new users
  • removing existing users
  • changing an existing user's password
  • adding (granting) a permission to an existing user
  • removing (revoking) a permission from an existing user
  • add a public key for an existing user
  • remove a public key from an existing user
  • issue a device token for an existing user
  • removing a device token from an existing user

This list may not be complete.

The general strategy for implementation is as follows.

  • Add (server-side) method to "controller.Controller" starting with the "admin" prefix, checking for the "admin" permission, performing the required request on "user.Manager" and returning the response in an appropriate (JSON-based) format.
  • Integrate newly-created (server-side) method to the "controller.controllerStruct.dispatch" method.
  • Add (client-side) method to "remote.Session" performing the request on the server and returning an "io.ReadCloser".
  • Add method to "controller/client.Controller" evaluating the command-line arguments and invoking "remote.Session".
  • Integrate newly-created (client-side) method to the "controller/client.controllerStruct.Interpret" (client-side equivalent of server-side "dispatch") method.
  • Add description for new remote command to "README.md".

Hints:

  • Synchronization may be necessary to prevent data corruption or exploitation.
  • It may be necessary to handle "incomplete" users (e. g. user already created, but credentials not yet set) in specific ways and / or introduce new commands to flag users as either "in the process of being edited" (currently not usable or not yet usable for authentication and session establishment) or "being complete" (usable for session establishment).
  • The documentation must be updated to reflect the fact that live user management is possible.

Intermediate implementation steps might be published or not, as deemed appropriate.

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions