mirror of
https://github.com/kemko/nomad.git
synced 2026-01-01 16:05:42 +03:00
53b083b8c5
* Move commands from docs to its own root-level directory * temporarily use modified dev-portal branch with nomad ia changes * explicitly clone nomad ia exp branch * retrigger build, fixed dev-portal broken build * architecture, concepts and get started individual pages * fix get started section destinations * reference section * update repo comment in website-build.sh to show branch * docs nav file update capitalization * update capitalization to force deploy * remove nomad-vs-kubernetes dir; move content to what is nomad pg * job section * Nomad operations category, deploy section * operations category, govern section * operations - manage * operations/scale; concepts scheduling fix * networking * monitor * secure section * remote auth-methods folder and move up pages to sso; linkcheck * Fix install2deploy redirects * fix architecture redirects * Job section: Add missing section index pages * Add section index pages so breadcrumbs build correctly * concepts/index fix front matter indentation * move task driver plugin config to new deploy section * Finish adding full URL to tutorials links in nav * change SSO to Authentication in nav and file system * Docs NomadIA: Move tutorials into NomadIA branch (#26132) * Move governance and policy from tutorials to docs * Move tutorials content to job-declare section * run jobs section * stateful workloads * advanced job scheduling * deploy section * manage section * monitor section * secure/acl and secure/authorization * fix example that contains an unseal key in real format * remove images from sso-vault * secure/traffic * secure/workload-identities * vault-acl change unseal key and root token in command output sample * remove lines from sample output * fix front matter * move nomad pack tutorials to tools * search/replace /nomad/tutorials links * update acl overview with content from deleted architecture/acl * fix spelling mistake * linkcheck - fix broken links * fix link to Nomad variables tutorial * fix link to Prometheus tutorial * move who uses Nomad to use cases page; move spec/config shortcuts add dividers * Move Consul out of Integrations; move namespaces to govern * move integrations/vault to secure/vault; delete integrations * move ref arch to docs; rename Deploy Nomad back to Install Nomad * address feedback * linkcheck fixes * Fixed raw_exec redirect * add info from /nomad/tutorials/manage-jobs/jobs * update page content with newer tutorial * link updates for architecture sub-folders * Add redirects for removed section index pages. Fix links. * fix broken links from linkcheck * Revert to use dev-portal main branch instead of nomadIA branch * build workaround: add intro-nav-data.json with single entry * fix content-check error * add intro directory to get around Vercel build error * workound for emtpry directory * remove mdx from /intro/ to fix content-check and git snafu * Add intro index.mdx so Vercel build should work --------- Co-authored-by: Tu Nguyen <im2nguyen@gmail.com>
366 lines
10 KiB
Plaintext
366 lines
10 KiB
Plaintext
---
|
|
layout: api
|
|
page_title: ACL auth methods - HTTP API
|
|
description: The /acl/auth-methods endpoints are used to configure and manage ACL auth methods.
|
|
---
|
|
|
|
# ACL auth methods HTTP API
|
|
|
|
The `/acl/auth-methods` and `/acl/auth-method` endpoints are used to manage ACL auth methods.
|
|
|
|
## Create auth method
|
|
|
|
This endpoint creates an ACL auth method. The request is always forwarded to the
|
|
authoritative region.
|
|
|
|
| Method | Path | Produces |
|
|
| ------ | --------------------- | ------------------ |
|
|
| `POST` | `/v1/acl/auth-method` | `application/json` |
|
|
|
|
The table below shows this endpoint's support for
|
|
[blocking queries](/nomad/api-docs#blocking-queries) and
|
|
[required ACLs](/nomad/api-docs#acls).
|
|
|
|
| Blocking Queries | ACL Required |
|
|
| ---------------- | ------------ |
|
|
| `NO` | `management` |
|
|
|
|
### Parameters
|
|
|
|
@include 'api-docs/auth-method-params.mdx'
|
|
|
|
### Sample payload
|
|
|
|
```json
|
|
{
|
|
"Name": "example-acl-auth-method",
|
|
"Type": "OIDC",
|
|
"TokenLocality": "local",
|
|
"TokenNameFormat": "${auth_method_type}-${value.user}",
|
|
"MaxTokenTTL": "1h0m0s",
|
|
"Default": false,
|
|
"Config": {
|
|
"OIDCDiscoveryURL": "https://my-corp-app-name.auth0.com/",
|
|
"OIDCClientID": "V1RPi2MYptMV1RPi2MYptMV1RPi2MYpt",
|
|
"OIDCClientSecret": "example-client-secret",
|
|
"OIDCScopes": [
|
|
"groups"
|
|
],
|
|
"BoundAudiences": [
|
|
"V1RPi2MYptMV1RPi2MYptMV1RPi2MYpt"
|
|
],
|
|
"AllowedRedirectURIs": [
|
|
"http://localhost:4646/oidc/callback"
|
|
],
|
|
"ClaimMappings": {
|
|
"http://example.com/first_name": "first_name",
|
|
"http://example.com/last_name": "last_name"
|
|
},
|
|
"ListClaimMappings": {
|
|
"http://nomad.com/groups": "groups"
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
### Sample request
|
|
|
|
```shell-session
|
|
$ curl \
|
|
--request POST \
|
|
--header "X-Nomad-Token: <NOMAD_TOKEN_SECRET_ID>" \
|
|
--data @payload.json \
|
|
https://localhost:4646/v1/acl/auth-method
|
|
```
|
|
|
|
### Sample response
|
|
|
|
```json
|
|
{
|
|
"MaxTokenTTL": "1h0m0s",
|
|
"Name": "example-acl-auth-method",
|
|
"Type": "OIDC",
|
|
"TokenLocality": "local",
|
|
"TokenNameFormat": "${auth_method_type}-${value.user}",
|
|
"Default": false,
|
|
"Config": {
|
|
"OIDCDiscoveryURL": "https://my-corp-app-name.auth0.com/",
|
|
"OIDCClientID": "v1rpi2myptmv1rpi2myptmv1rpi2mypt",
|
|
"OIDCClientSecret": "redacted",
|
|
"OIDCScopes": [
|
|
"groups"
|
|
],
|
|
"BoundAudiences": [
|
|
"v1rpi2myptmv1rpi2myptmv1rpi2mypt"
|
|
],
|
|
"AllowedRedirectURIs": [
|
|
"http://localhost:4646/oidc/callback"
|
|
],
|
|
"DiscoveryCaPem": null,
|
|
"SigningAlgs": null,
|
|
"ClaimMappings": {
|
|
"http://example.com/first_name": "first_name",
|
|
"http://example.com/last_name": "last_name"
|
|
},
|
|
"ListClaimMappings": {
|
|
"http://nomad.com/groups": "groups"
|
|
}
|
|
},
|
|
"CreateTime": "2022-12-08T11:04:43.46206Z",
|
|
"ModifyTime": "2022-12-08T11:04:43.46206Z",
|
|
"CreateIndex": 12,
|
|
"ModifyIndex": 12
|
|
}
|
|
```
|
|
|
|
## Update auth method
|
|
|
|
This endpoint updates an existing ACL auth method. The request is always
|
|
forwarded to the authoritative region.
|
|
|
|
| Method | Path | Produces |
|
|
| ------ | ---------------------------------- | ------------------ |
|
|
| `POST` | `/v1/acl/auth-method/:method_name` | `application/json` |
|
|
|
|
The table below shows this endpoint's support for [blocking
|
|
queries](/nomad/api-docs#blocking-queries) and [required ACLs](/nomad/api-docs#acls).
|
|
|
|
| Blocking Queries | ACL Required |
|
|
| ---------------- | ------------ |
|
|
| `NO` | `management` |
|
|
|
|
### Parameters
|
|
|
|
The parameters are the same as Create.
|
|
|
|
@include 'api-docs/auth-method-params.mdx'
|
|
|
|
### Sample Payload
|
|
|
|
```json
|
|
{
|
|
"Name": "example-acl-auth-method",
|
|
"Type": "OIDC",
|
|
"Tokenlocality": "global",
|
|
"TokenNameFormat": "${auth_method_type}-${value.user}",
|
|
"Maxtokenttl": "1h0m0s",
|
|
"Default": true,
|
|
"Config": {
|
|
"OIDCDiscoveryURL": "https://my-corp-app-name.auth0.com/",
|
|
"OIDCClientID": "V1RPi2MYptMV1RPi2MYptMV1RPi2MYpt",
|
|
"OIDCClientSecret": "example-client-secret",
|
|
"OIDCScopes": [
|
|
"groups"
|
|
],
|
|
"BoundAudiences": [
|
|
"V1RPi2MYptMV1RPi2MYptMV1RPi2MYpt"
|
|
],
|
|
"AllowedRedirectURIs": [
|
|
"http://localhost:4646/oidc/callback"
|
|
],
|
|
"ClaimMappings": {
|
|
"http://example.com/first_name": "first_name",
|
|
"http://example.com/last_name": "last_name"
|
|
},
|
|
"ListClaimMappings": {
|
|
"http://nomad.com/groups": "groups"
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
### Sample Request
|
|
|
|
```shell-session
|
|
$ curl \
|
|
--request POST \
|
|
--header "X-Nomad-Token: <NOMAD_TOKEN_SECRET_ID>" \
|
|
--data @payload.json \
|
|
https://localhost:4646/v1/acl/auth-method/example-acl-auth-method
|
|
```
|
|
|
|
### Sample Response
|
|
|
|
```json
|
|
{
|
|
"MaxTokenTTL": "1h0m0s",
|
|
"Name": "example-acl-auth-method",
|
|
"Type": "OIDC",
|
|
"TokenLocality": "global",
|
|
"TokenNameFormat": "${auth_method_type}-${value.user}",
|
|
"Default": true,
|
|
"Config": {
|
|
"OIDCDiscoveryURL": "https://my-corp-app-name.auth0.com/",
|
|
"OIDCClientID": "V1RPi2MYptMV1RPi2MYptMV1RPi2MYpt",
|
|
"OIDCClientSecret": "redacted",
|
|
"OIDCScopes": [
|
|
"groups"
|
|
],
|
|
"BoundAudiences": [
|
|
"V1RPi2MYptMV1RPi2MYptMV1RPi2MYpt"
|
|
],
|
|
"AllowedRedirectURIs": [
|
|
"http://localhost:4646/oidc/callback"
|
|
],
|
|
"ClaimMappings": {
|
|
"http://example.com/first_name": "first_name",
|
|
"http://example.com/last_name": "last_name"
|
|
},
|
|
"ListClaimMappings": {
|
|
"http://nomad.com/groups": "groups"
|
|
}
|
|
},
|
|
"CreateTime": "2022-12-08T11:04:43.46206Z",
|
|
"ModifyTime": "2022-12-08T11:04:43.46206Z",
|
|
"CreateIndex": 12,
|
|
"ModifyIndex": 32
|
|
}
|
|
```
|
|
|
|
## List auth methods
|
|
|
|
This endpoint lists all ACL auth methods. This lists the auth methods that have
|
|
been replicated to the region, and may lag behind the authoritative region.
|
|
|
|
| Method | Path | Produces |
|
|
| ------ | ---------------------- | ------------------ |
|
|
| `GET` | `/v1/acl/auth-methods` | `application/json` |
|
|
|
|
The table below shows this endpoint's support for
|
|
[blocking queries](/nomad/api-docs#blocking-queries),
|
|
[consistency modes](/nomad/api-docs#consistency-modes) and
|
|
[required ACLs](/nomad/api-docs#acls).
|
|
|
|
| Blocking Queries | Consistency Modes | ACL Required |
|
|
| ---------------- | ----------------- | ---- |
|
|
| `YES` | `all` | None |
|
|
|
|
### Sample request
|
|
|
|
```shell-session
|
|
$ curl \
|
|
--header "X-Nomad-Token: <NOMAD_TOKEN_SECRET_ID>" \
|
|
https://localhost:4646/v1/acl/auth-methods
|
|
```
|
|
|
|
### Sample response
|
|
|
|
```json
|
|
[
|
|
{
|
|
"CreateIndex": 12,
|
|
"Default": true,
|
|
"ModifyIndex": 32,
|
|
"Name": "example-acl-auth-method",
|
|
"Type": "OIDC"
|
|
}
|
|
]
|
|
```
|
|
|
|
## Read auth method by name
|
|
|
|
This endpoint reads an ACL Auth Method with the given name. This queries the
|
|
auth method that has been replicated to the region, and may lag behind the
|
|
authoritative region.
|
|
|
|
| Method | Path | Produces |
|
|
| ------ | ---------------------------------- | ------------------ |
|
|
| `GET` | `/v1/acl/auth-method/:method_name` | `application/json` |
|
|
|
|
The table below shows this endpoint's support for
|
|
[blocking queries](/nomad/api-docs#blocking-queries),
|
|
[consistency modes](/nomad/api-docs#consistency-modes) and
|
|
[required ACLs](/nomad/api-docs#acls).
|
|
|
|
| Blocking Queries | Consistency Modes | ACL Required |
|
|
| ---------------- | ----------------- | ------------------ |
|
|
| `YES` | `all` | `management` token |
|
|
|
|
### Parameters
|
|
|
|
- `:method_name` `(string: <required>)` - Specifies the name of the ACL auth
|
|
method. This is specified as part of the path.
|
|
|
|
### Sample request
|
|
|
|
```shell-session
|
|
$ curl \
|
|
--header "X-Nomad-Token: <NOMAD_TOKEN_SECRET_ID>" \
|
|
https://localhost:4646/v1/acl/auth-method/example-acl-auth-method
|
|
```
|
|
|
|
### Sample response
|
|
|
|
```json
|
|
{
|
|
"MaxTokenTTL": "1h0m0s",
|
|
"Name": "example-acl-auth-method",
|
|
"Type": "OIDC",
|
|
"TokenLocality": "global",
|
|
"TokenNameFormat": "${auth_method_type}-${value.user}",
|
|
"Default": true,
|
|
"Config": {
|
|
"OIDCDiscoveryURL": "https://my-corp-app-name.auth0.com/",
|
|
"OIDCClientID": "V1RPi2MYptMV1RPi2MYptMV1RPi2MYpt",
|
|
"OIDCClientSecret": "example-client-secret",
|
|
"OIDCScopes": [
|
|
"groups"
|
|
],
|
|
"BoundAudiences": [
|
|
"V1RPi2MYptMV1RPi2MYptMV1RPi2MYpt"
|
|
],
|
|
"AllowedRedirectURIs": [
|
|
"http://localhost:4646/oidc/callback"
|
|
],
|
|
"ClaimMappings": {
|
|
"http://example.com/first_name": "first_name",
|
|
"http://example.com/last_name": "last_name"
|
|
},
|
|
"ListClaimMappings": {
|
|
"http://nomad.com/groups": "groups"
|
|
}
|
|
},
|
|
"CreateTime": "2022-12-08T11:04:43.46206Z",
|
|
"ModifyTime": "2022-12-08T11:04:43.46206Z",
|
|
"CreateIndex": 12,
|
|
"ModifyIndex": 32
|
|
}
|
|
```
|
|
|
|
## Delete auth method
|
|
|
|
This endpoint deletes the ACL auth method as identified by its name. This
|
|
request is always forwarded to the authoritative region.
|
|
|
|
| Method | Path | Produces |
|
|
| -------- | ---------------------------------- | -------------- |
|
|
| `DELETE` | `/v1/acl/auth-method/:method_name` | `(empty body)` |
|
|
|
|
The table below shows this endpoint's support for
|
|
[blocking queries](/nomad/api-docs#blocking-queries) and
|
|
[required ACLs](/nomad/api-docs#acls).
|
|
|
|
| Blocking Queries | ACL Required |
|
|
| ---------------- | ------------ |
|
|
| `NO` | `management` |
|
|
|
|
### Parameters
|
|
|
|
- `method_name` `(string: <required>)` - Specifies the name of auth method to
|
|
delete and is specified as part of the path.
|
|
|
|
### Sample Request
|
|
|
|
```shell-session
|
|
$ curl \
|
|
--request DELETE \
|
|
--header "X-Nomad-Token: <NOMAD_TOKEN_SECRET_ID>" \
|
|
https://localhost:4646/v1/acl/auth-method/example-acl-auth-method
|
|
```
|
|
|
|
[private key jwt]: https://oauth.net/private-key-jwt/
|
|
[concepts-assertions]: /nomad/docs/secure/authentication/oidc#client-assertions
|
|
[x5t]: https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.7
|
|
[x5t#S256]: https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.8
|
|
[pkce]: https://oauth.net/2/pkce/
|