Skip to content

Commit 66a078f

Browse files
leto-bleto-b
authored
remove openid from cli (#830)
1 parent a117542 commit 66a078f

File tree

16 files changed

+8
-1672
lines changed

16 files changed

+8
-1672
lines changed

‎src/UserGuide/Master/Tree/Tools-System/CLI_apache.md‎

Lines changed: 1 addition & 110 deletions
Original file line numberDiff line numberDiff line change
@@ -133,117 +133,8 @@ Special commands of Cli are below.
133133
| `help` | Get hints for CLI special commands |
134134
| `exit/quit` | Exit CLI |
135135

136-
### 2.4 Note on using the CLI with OpenID Connect Auth enabled on Server side
137136

138-
Openid connect (oidc) uses keycloack as the authority authentication service of oidc service
139-
140-
141-
#### configuration
142-
143-
The configuration is located in iotdb-system.properties , set the author_provider_class is org.apache.iotdb.commons.auth.authorizer.OpenIdAuthorizer Openid service is enabled, and the default value is org.apache.iotdb.db.auth.authorizer.LocalFileAuthorizer Indicates that the openid service is not enabled.
144-
145-
```
146-
authorizer_provider_class=org.apache.iotdb.commons.auth.authorizer.OpenIdAuthorizer
147-
```
148-
149-
If the openid service is turned on, openid_URL is required,openID_url value is http://ip:port/realms/{realmsName}
150-
151-
```
152-
openID_url=http://127.0.0.1:8080/realms/iotdb/
153-
```
154-
155-
#### keycloack configuration
156-
157-
1、Download the keycloack file (This tutorial is version 21.1.0) and start keycloack in keycloack/bin
158-
159-
```shell
160-
Shell >cd bin
161-
Shell >./kc.sh start-dev
162-
```
163-
164-
2、use url(https://ip:port) login keycloack, the first login needs to create a user
165-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/login_keycloak.png?raw=true)
166-
167-
3、Click administration console
168-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/AdministrationConsole.png?raw=true)
169-
170-
4、In the master menu on the left, click Create realm and enter Realm name to create a new realm
171-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/add_Realm_1.jpg?raw=true)
172-
173-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/add_Realm_2.jpg?raw=true)
174-
175-
176-
5、Click the menu clients on the left to create clients
177-
178-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/client.jpg?raw=true)
179-
180-
6、Click user on the left menu to create user
181-
182-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/user.jpg?raw=true)
183-
184-
7、Click the newly created user ID, click the credentials navigation, enter the password and close the temporary option. The configuration of keycloud is completed
185-
186-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/pwd.jpg?raw=true)
187-
188-
8、To create a role, click Roles on the left menu and then click the Create Role button to add a role
189-
190-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/add_role1.jpg?raw=true)
191-
192-
9、 Enter `iotdb_admin` in the Role Name and click the save button. Tip: `iotdb_admin` here cannot be any other name, otherwise even after successful login, you will not have permission to use iotdb's query, insert, create database, add users, roles and other functions
193-
194-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/add_role2.jpg?raw=true)
195-
196-
10、Click on the User menu on the left and then click on the user in the user list to add the `iotdb_admin` role we just created for that user
197-
198-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/add_role3.jpg?raw=true)
199-
200-
11、 Select Role Mappings, select the `iotdb_admin` role in Assign Role
201-
202-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/add_role4.jpg?raw=true)
203-
204-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/add_role5.jpg?raw=true)
205-
206-
207-
Tip: If the user role is adjusted, you need to regenerate the token and log in to iotdb again to take effect
208-
209-
The above steps provide a way for keycloak to log into iotdb. For more ways, please refer to keycloak configuration
210-
211-
If OIDC is enabled on server side then no username / passwort is needed but a valid Access Token from the OIDC Provider.
212-
So as username you use the token and the password has to be empty, e.g.
213-
214-
```shell
215-
Shell > bash sbin/start-cli.sh -h 10.129.187.21 -p 6667 -u {my-access-token} -pw ""
216-
```
217-
218-
Among them, you need to replace {my access token} (note, including {}) with your token, that is, the value corresponding to access_token. The password is empty and needs to be confirmed again.
219-
220-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/iotdbpw.jpeg?raw=true)
221-
222-
223-
How to get the token is dependent on your OpenID Connect setup and not covered here.
224-
In the simplest case you can get this via the command line with the `passwort-grant`.
225-
For example, if you use keycloack as OIDC and you have a realm with a client `iotdb` defined as public you could use
226-
the following `curl` command to fetch a token (replace all `{}` with appropriate values).
227-
228-
```shell
229-
curl -X POST "https://{your-keycloack-server}/realms/{your-realm}/protocol/openid-connect/token" \
230-
-H "Content-Type: application/x-www-form-urlencoded" \
231-
-d "username={username}" \
232-
-d "password={password}" \
233-
-d 'grant_type=password' \
234-
-d "client_id=iotdb-client"
235-
```
236-
237-
The response looks something like
238-
239-
```json
240-
{"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJxMS1XbTBvelE1TzBtUUg4LVNKYXAyWmNONE1tdWNXd25RV0tZeFpKNG93In0.eyJleHAiOjE1OTAzOTgwNzEsImlhdCI6MTU5MDM5Nzc3MSwianRpIjoiNjA0ZmYxMDctN2NiNy00NTRmLWIwYmQtY2M2ZDQwMjFiNGU4IiwiaXNzIjoiaHR0cDovL2F1dGguZGVtby5wcmFnbWF0aWNpbmR1c3RyaWVzLmRlL2F1dGgvcmVhbG1zL0lvVERCIiwiYXVkIjoiYWNjb3VudCIsInN1YiI6ImJhMzJlNDcxLWM3NzItNGIzMy04ZGE2LTZmZThhY2RhMDA3MyIsInR5cCI6IkJlYXJlciIsImF6cCI6ImlvdGRiIiwic2Vzc2lvbl9zdGF0ZSI6IjA2MGQyODYyLTE0ZWQtNDJmZS1iYWY3LThkMWY3ODQ2NTdmMSIsImFjciI6IjEiLCJhbGxvd2VkLW9yaWdpbnMiOlsibG9jYWxob3N0OjgwODAiXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbIm9mZmxpbmVfYWNjZXNzIiwidW1hX2F1dGhvcml6YXRpb24iLCJpb3RkYl9hZG1pbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoiZW1haWwgcHJvZmlsZSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ1c2VyIn0.nwbrJkWdCNjzFrTDwKNuV5h9dDMg5ytRKGOXmFIajpfsbOutJytjWTCB2WpA8E1YI3KM6gU6Jx7cd7u0oPo5syHhfCz119n_wBiDnyTZkFOAPsx0M2z20kvBLN9k36_VfuCMFUeddJjO31MeLTmxB0UKg2VkxdczmzMH3pnalhxqpnWWk3GnrRrhAf2sZog0foH4Ae3Ks0lYtYzaWK_Yo7E4Px42-gJpohy3JevOC44aJ4auzJR1RBj9LUbgcRinkBy0JLi6XXiYznSC2V485CSBHW3sseXn7pSXQADhnmGQrLfFGO5ZljmPO18eFJaimdjvgSChsrlSEmTDDsoo5Q","expires_in":300,"refresh_expires_in":1800,"refresh_token":"eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJhMzZlMGU0NC02MWNmLTQ5NmMtOGRlZi03NTkwNjQ5MzQzMjEifQ.eyJleHAiOjE1OTAzOTk1NzEsImlhdCI6MTU5MDM5Nzc3MSwianRpIjoiNmMxNTBiY2EtYmE5NC00NTgxLWEwODEtYjI2YzhhMmI5YmZmIiwiaXNzIjoiaHR0cDovL2F1dGguZGVtby5wcmFnbWF0aWNpbmR1c3RyaWVzLmRlL2F1dGgvcmVhbG1zL0lvVERCIiwiYXVkIjoiaHR0cDovL2F1dGguZGVtby5wcmFnbWF0aWNpbmR1c3RyaWVzLmRlL2F1dGgvcmVhbG1zL0lvVERCIiwic3ViIjoiYmEzMmU0NzEtYzc3Mi00YjMzLThkYTYtNmZlOGFjZGEwMDczIiwidHlwIjoiUmVmcmVzaCIsImF6cCI6ImlvdGRiIiwic2Vzc2lvbl9zdGF0ZSI6IjA2MGQyODYyLTE0ZWQtNDJmZS1iYWY3LThkMWY3ODQ2NTdmMSIsInNjb3BlIjoiZW1haWwgcHJvZmlsZSJ9.ayNpXdNX28qahodX1zowrMGiUCw2AodlHBQFqr8Ui7c","token_type":"bearer","not-before-policy":0,"session_state":"060d2862-14ed-42fe-baf7-8d1f784657f1","scope":"email profile"}
241-
```
242-
243-
The interesting part here is the access token with the key `access_token`.
244-
This has to be passed as username (with parameter `-u`) and empty password to the CLI.
245-
246-
### 2.5 Batch Operation of Cli
137+
### 2.4 Batch Operation of Cli
247138

248139
-e parameter is designed for the Cli/shell tool in the situation where you would like to manipulate IoTDB in batches through scripts. By using the -e parameter, you can operate IoTDB without entering the cli's input mode.
249140

‎src/UserGuide/Master/Tree/Tools-System/CLI_timecho.md‎

Lines changed: 1 addition & 110 deletions
Original file line numberDiff line numberDiff line change
@@ -119,117 +119,8 @@ Special commands of Cli are below.
119119
| `help` | Get hints for CLI special commands |
120120
| `exit/quit` | Exit CLI |
121121

122-
## 4. Note on using the CLI with OpenID Connect Auth enabled on Server side
123122

124-
Openid connect (oidc) uses keycloack as the authority authentication service of oidc service
125-
126-
127-
#### configuration
128-
129-
The configuration is located in iotdb-system.properties , set the author_provider_class is org.apache.iotdb.commons.auth.authorizer.OpenIdAuthorizer Openid service is enabled, and the default value is org.apache.iotdb.db.auth.authorizer.LocalFileAuthorizer Indicates that the openid service is not enabled.
130-
131-
```
132-
authorizer_provider_class=org.apache.iotdb.commons.auth.authorizer.OpenIdAuthorizer
133-
```
134-
135-
If the openid service is turned on, openid_URL is required,openID_url value is http://ip:port/realms/{realmsName}
136-
137-
```
138-
openID_url=http://127.0.0.1:8080/realms/iotdb/
139-
```
140-
141-
#### keycloack configuration
142-
143-
1、Download the keycloack file (This tutorial is version 21.1.0) and start keycloack in keycloack/bin
144-
145-
```shell
146-
Shell >cd bin
147-
Shell >./kc.sh start-dev
148-
```
149-
150-
2、use url(https://ip:port) login keycloack, the first login needs to create a user
151-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/login_keycloak.png?raw=true)
152-
153-
3、Click administration console
154-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/AdministrationConsole.png?raw=true)
155-
156-
4、In the master menu on the left, click Create realm and enter Realm name to create a new realm
157-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/add_Realm_1.jpg?raw=true)
158-
159-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/add_Realm_2.jpg?raw=true)
160-
161-
162-
5、Click the menu clients on the left to create clients
163-
164-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/client.jpg?raw=true)
165-
166-
6、Click user on the left menu to create user
167-
168-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/user.jpg?raw=true)
169-
170-
7、Click the newly created user ID, click the credentials navigation, enter the password and close the temporary option. The configuration of keycloud is completed
171-
172-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/pwd.jpg?raw=true)
173-
174-
8、To create a role, click Roles on the left menu and then click the Create Role button to add a role
175-
176-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/add_role1.jpg?raw=true)
177-
178-
9、 Enter `iotdb_admin` in the Role Name and click the save button. Tip: `iotdb_admin` here cannot be any other name, otherwise even after successful login, you will not have permission to use iotdb's query, insert, create database, add users, roles and other functions
179-
180-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/add_role2.jpg?raw=true)
181-
182-
10、Click on the User menu on the left and then click on the user in the user list to add the `iotdb_admin` role we just created for that user
183-
184-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/add_role3.jpg?raw=true)
185-
186-
11、 Select Role Mappings, select the `iotdb_admin` role in Assign Role
187-
188-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/add_role4.jpg?raw=true)
189-
190-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/add_role5.jpg?raw=true)
191-
192-
193-
Tip: If the user role is adjusted, you need to regenerate the token and log in to iotdb again to take effect
194-
195-
The above steps provide a way for keycloak to log into iotdb. For more ways, please refer to keycloak configuration
196-
197-
If OIDC is enabled on server side then no username / passwort is needed but a valid Access Token from the OIDC Provider.
198-
So as username you use the token and the password has to be empty, e.g.
199-
200-
```shell
201-
Shell > bash sbin/start-cli.sh -h 10.129.187.21 -p 6667 -u {my-access-token} -pw ""
202-
```
203-
204-
Among them, you need to replace {my access token} (note, including {}) with your token, that is, the value corresponding to access_token. The password is empty and needs to be confirmed again.
205-
206-
![avatar](/img/UserGuide/CLI/Command-Line-Interface/iotdbpw.jpeg?raw=true)
207-
208-
209-
How to get the token is dependent on your OpenID Connect setup and not covered here.
210-
In the simplest case you can get this via the command line with the `passwort-grant`.
211-
For example, if you use keycloack as OIDC and you have a realm with a client `iotdb` defined as public you could use
212-
the following `curl` command to fetch a token (replace all `{}` with appropriate values).
213-
214-
```shell
215-
curl -X POST "https://{your-keycloack-server}/realms/{your-realm}/protocol/openid-connect/token" \
216-
-H "Content-Type: application/x-www-form-urlencoded" \
217-
-d "username={username}" \
218-
-d "password={password}" \
219-
-d 'grant_type=password' \
220-
-d "client_id=iotdb-client"
221-
```
222-
223-
The response looks something like
224-
225-
```json
226-
{"access_token":"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJxMS1XbTBvelE1TzBtUUg4LVNKYXAyWmNONE1tdWNXd25RV0tZeFpKNG93In0.eyJleHAiOjE1OTAzOTgwNzEsImlhdCI6MTU5MDM5Nzc3MSwianRpIjoiNjA0ZmYxMDctN2NiNy00NTRmLWIwYmQtY2M2ZDQwMjFiNGU4IiwiaXNzIjoiaHR0cDovL2F1dGguZGVtby5wcmFnbWF0aWNpbmR1c3RyaWVzLmRlL2F1dGgvcmVhbG1zL0lvVERCIiwiYXVkIjoiYWNjb3VudCIsInN1YiI6ImJhMzJlNDcxLWM3NzItNGIzMy04ZGE2LTZmZThhY2RhMDA3MyIsInR5cCI6IkJlYXJlciIsImF6cCI6ImlvdGRiIiwic2Vzc2lvbl9zdGF0ZSI6IjA2MGQyODYyLTE0ZWQtNDJmZS1iYWY3LThkMWY3ODQ2NTdmMSIsImFjciI6IjEiLCJhbGxvd2VkLW9yaWdpbnMiOlsibG9jYWxob3N0OjgwODAiXSwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbIm9mZmxpbmVfYWNjZXNzIiwidW1hX2F1dGhvcml6YXRpb24iLCJpb3RkYl9hZG1pbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7ImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoiZW1haWwgcHJvZmlsZSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ1c2VyIn0.nwbrJkWdCNjzFrTDwKNuV5h9dDMg5ytRKGOXmFIajpfsbOutJytjWTCB2WpA8E1YI3KM6gU6Jx7cd7u0oPo5syHhfCz119n_wBiDnyTZkFOAPsx0M2z20kvBLN9k36_VfuCMFUeddJjO31MeLTmxB0UKg2VkxdczmzMH3pnalhxqpnWWk3GnrRrhAf2sZog0foH4Ae3Ks0lYtYzaWK_Yo7E4Px42-gJpohy3JevOC44aJ4auzJR1RBj9LUbgcRinkBy0JLi6XXiYznSC2V485CSBHW3sseXn7pSXQADhnmGQrLfFGO5ZljmPO18eFJaimdjvgSChsrlSEmTDDsoo5Q","expires_in":300,"refresh_expires_in":1800,"refresh_token":"eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJhMzZlMGU0NC02MWNmLTQ5NmMtOGRlZi03NTkwNjQ5MzQzMjEifQ.eyJleHAiOjE1OTAzOTk1NzEsImlhdCI6MTU5MDM5Nzc3MSwianRpIjoiNmMxNTBiY2EtYmE5NC00NTgxLWEwODEtYjI2YzhhMmI5YmZmIiwiaXNzIjoiaHR0cDovL2F1dGguZGVtby5wcmFnbWF0aWNpbmR1c3RyaWVzLmRlL2F1dGgvcmVhbG1zL0lvVERCIiwiYXVkIjoiaHR0cDovL2F1dGguZGVtby5wcmFnbWF0aWNpbmR1c3RyaWVzLmRlL2F1dGgvcmVhbG1zL0lvVERCIiwic3ViIjoiYmEzMmU0NzEtYzc3Mi00YjMzLThkYTYtNmZlOGFjZGEwMDczIiwidHlwIjoiUmVmcmVzaCIsImF6cCI6ImlvdGRiIiwic2Vzc2lvbl9zdGF0ZSI6IjA2MGQyODYyLTE0ZWQtNDJmZS1iYWY3LThkMWY3ODQ2NTdmMSIsInNjb3BlIjoiZW1haWwgcHJvZmlsZSJ9.ayNpXdNX28qahodX1zowrMGiUCw2AodlHBQFqr8Ui7c","token_type":"bearer","not-before-policy":0,"session_state":"060d2862-14ed-42fe-baf7-8d1f784657f1","scope":"email profile"}
227-
```
228-
229-
The interesting part here is the access token with the key `access_token`.
230-
This has to be passed as username (with parameter `-u`) and empty password to the CLI.
231-
232-
## 5. Batch Operation of Cli
123+
## 4. Batch Operation of Cli
233124

234125
-e parameter is designed for the Cli/shell tool in the situation where you would like to manipulate IoTDB in batches through scripts. By using the -e parameter, you can operate IoTDB without entering the cli's input mode.
235126

0 commit comments

Comments
 (0)