search

SoftInstigate / angular-restheart

AngularJS client module for RESTHeart
8 stars 3 forks source link

Multiple Users #4

Closed jsEveryDay closed 8 years ago

jsEveryDay commented 8 years ago

This is not really an issue or really related to angular-restheart I just love how fast and how awesomly resthart runs but I cant see it being used in production. Among other things, to auth restheart user credentials are in security.yml

So if i have 1000 users then i will define them here? If I have a registration form, I will have to make it save the credentials here? and lastly, how could passwords be stored in plaintext?

Im trying to understand the logic of authenticating through RestHeart.

ujibang commented 8 years ago

Hi @jsEveryDay ,

please refer to the Security documentation section.

The IDM (Identity Manager, responsible of authenticating users) can be configured: by default the SimpleFileIdentityManager is used but you can set the DbIdentityManager or even provide your custom implementation.

The following is the security section of the restheart.yml configuration file:

### Security

# The security is configured by setting:

# idm: the Identity Manager responsible of authentication
# access-manager: the Access Manager responsible of authorization
# The RESTHeart security is pluggable and you can provide you own implementation of both IDM and AM.
# the provided default implementations of IDM and AM are SimpleFileIdentityManager, DbIdentityManager and SimpleAccessManager.
# conf-file paths are either absolute (starting with /) or relative to the restheart.jar directory

idm:
    implementation-class: org.restheart.security.impl.SimpleFileIdentityManager
    conf-file: ../etc/security.yml
access-manager:
    implementation-class: org.restheart.security.impl.SimpleAccessManager
    conf-file: ../etc/security.yml

In our experience (we have developed several web and mobile applications using RESTHeart), the DbIdentityManager (which also provides caching capabilities) fulfills most use cases. On the other hand, usually a custom Access Manager must be implemented.

mkjsix commented 8 years ago

@jsEveryDay the security section contains a document which provides an example on how to provision multiple users in one shot: https://softinstigate.atlassian.net/wiki/x/C4AWAQ So, if you choose the mentioned DbIdentityManager you don't have to keep any password in a text file, everything will be in MongoDB.