[SOLVED] Restricted API token which can create backup only tokens

[B4dM4n]

Hi everyone,

I'm trying to realize the following permission structure for a "token exchange service" (hand out backup tokens to trusted hosts):

User automation@pbs:
    automation@pbs!api: Can create API tokens for it's own user
    
    automation@pbs!host1: Can create backups (role DatastoreBackup)
    ...
    automation@pbs!hostn: Can create backups (role DatastoreBackup)

My question now is: Can I create a restricted api token which can only create and modify tokens of the owning user and which permissions do the user and api token need?

The documentation of the /access/users/{userid}/token/{token-name} (the API viewer seems currently broken) endpoint say, the required permissions are:

Or
  Check: {"partial":false,"path":["access","users"],"privs":["Permissions.Modify"]}
  Check if user matches parameter 'userid'

When I give the token the following permission acl:1:/access/users:automate@pbs!api:Admin to the api token (since tokens don't have any permissions when created), I still get a permission check failed error when trying to create new tokens.

It seems like a token can't match the user matches parameter 'userid' check from the API documentation.

The only way I was able to create new tokens via an API token, was to give Admin permissions for /access/users to both, the user and the token. This implies, the token which should have been restricted, can now modify all users and permissions.

Is there a way to avoid the Admin permissions for the automation@pbs user?

The same issue is also present with the /access/acl endpoint, which is required to set the DatastoreBackup role for the new host tokens.

 

[fabian]

My question now is: Can I create a restricted api token which can only create and modify tokens of the owning user and which permissions do the user and api token need?

no, this is currently not possible.

The same issue is also present with the /access/acl endpoint, which is required to set the DatastoreBackup role for the new host tokens.

this is correct, it's currently also not possible to allow a token to modify "sibling token" ACLs (only).

both endpoints should work if you use the user itself - a user can always create tokens under its own scope, and can always modify ACLs for such tokens.

 

[B4dM4n]

Can I authenticate the user directly against the API or do I have to manage a login session/cookie manually?

I only found the Authorization: PBSAPIToken=... method in the docs for accessing the API.

 

[fabian]

you need to obtain a ticket via the ticket endpoint, and pass that with every request. a ticket is valid for up to two hours, and you can use it while it is valid to request a new one to extend your session.

 

[B4dM4n]

Thank you, using the ticket endpoint solved my issue. The user now only needs the DatastoreBackup role.