This upstreams some improvements around authn & authz for remote connections.
The stub "unimplemented" authenticate function in ECU is replaced with an interface. The default ECU config continues to simply return an error, so there is no change in out-of-the-box functionality, however a user can hook their own SSO system in via a replacement ECU binary that provides an implementation, rather than having to fork the whole ECU or implement some brittle way of auto-patching the authenticate function.
The common IPC package now provides a method for testing whether the user is authenticated, and three levels of authorization for remote users based on group memberships: admin, operator, and reader.
The engine applies authorization levels when the user is authenticated.
Users can be authorized for access to particular vservers, which helps treat Seesaw as a shared service with customers allowed to access their own vservers, but not others.
config.proto now defines AccessGroup, as a way of distributing groups of users. Vserver config can then refer to these groups (with GROUP type access grants).
This upstreams some improvements around authn & authz for remote connections.
authenticatefunction in ECU is replaced with an interface. The default ECU config continues to simply return an error, so there is no change in out-of-the-box functionality, however a user can hook their own SSO system in via a replacement ECU binary that provides an implementation, rather than having to fork the whole ECU or implement some brittle way of auto-patching theauthenticatefunction.AccessGroup, as a way of distributing groups of users. Vserver config can then refer to these groups (with GROUP type access grants).