search

cloudant / nodejs-cloudant

Cloudant Node.js client library
Apache License 2.0
255 stars 90 forks source link

iamauth key vs api key #354

Closed NathanHazout closed 5 years ago

NathanHazout commented 5 years ago

I am a little confused by something.

On the instance level, I have access to a IAM apikey, which I am able to use using the iamauth plugin as such: { iamauth: { iamApiKey: apikey }

However in Cloudant I am also able to generate key/password pairs. I'm not sure what to call them, the naming is confusing (instance credentials vs api credentials?)

I can use this pair as described in the readme: var cloudant = Cloudant({ account:"me", key:api.key, password:api.password });

However, can I use this key/pass pair with IAM? Is it relevant? Passing the key to the iamauth plugin does not seem to work.

ricellis commented 5 years ago

However in Cloudant I am also able to generate key/password pairs. I'm not sure what to call them

In the documentation we refer to these as IBM Cloudant legacy API keys.

However, can I use this key/pass pair with IAM? Is it relevant?

No, the legacy API keys can only be used as a Cloudant user/password, they cannot be exchanged with the IAM service.

Passing the key to the iamauth plugin does not seem to work.

That is the correct and expected behaviour, only IAM API key credentials can be used with the iamauth plugin.

You can read more on the differences between IAM API keys and IBM Cloudant legacy API keys in the Cloudant documentation. In general if you are able to use IAM credentials you probably don't need to use any Cloudant legacy API keys.

NathanHazout commented 5 years ago

Thanks, So let's say I don't want to use any "legacy" stuff. How do I grant access to a specific table?

It seems the newer IAM keys are global for the entire instance?

NathanHazout commented 5 years ago

I think I found the answer to my question here:

https://console.bluemix.net/docs/services/Cloudant/guides/iam.html#advantages-and-disadvantages-of-the-two-access-control-mechanisms

In the IAM "Disadvantages" column, it says: "No database-level permissions (yet)."

So if I want database-level permissions, no choice but to stick to legacy permissions...

ricellis commented 5 years ago

Oh yeah, at the moment there is only the one IAM permission; I believe others will be available eventually.

mikerhodes commented 5 years ago

And yes, it's still a case of "not there yet" for the database level permissions. Sorry on that, I know it's a bit frustrating and we've been working to solve it but it goes slowly.