f64ce759e0
feat(iam): add SetUserStatus and UpdateAccessKey actions (#7745) Add ability to enable/disable users and access keys without deleting them. ## Changes ### Protocol Buffer Updates - Add `disabled` field (bool) to Identity message for user status - false (default) = enabled, true = disabled - No backward compatibility hack needed since zero value is correct - Add `status` field (string: Active/Inactive) to Credential message ### New IAM Actions - SetUserStatus: Enable or disable a user (requires admin) - UpdateAccessKey: Change access key status (self-service or admin) ### Behavior - Disabled users: All API requests return AccessDenied - Inactive access keys: Signature validation fails - Status check happens early in auth flow for performance - Backward compatible: existing configs default to enabled (disabled=false) ### Use Cases 1. Temporary suspension: Disable user access during investigation 2. Key rotation: Deactivate old key before deletion 3. Offboarding: Disable rather than delete for audit purposes 4. Emergency response: Quickly disable compromised credentials Fixes #7745
60 lines
1.2 KiB
Protocol Buffer
60 lines
1.2 KiB
Protocol Buffer
syntax = "proto3";
|
|
|
|
package iam_pb;
|
|
|
|
option go_package = "github.com/seaweedfs/seaweedfs/weed/pb/iam_pb";
|
|
option java_package = "seaweedfs.client";
|
|
option java_outer_classname = "IamProto";
|
|
|
|
//////////////////////////////////////////////////
|
|
|
|
service SeaweedIdentityAccessManagement {
|
|
|
|
}
|
|
|
|
//////////////////////////////////////////////////
|
|
|
|
message S3ApiConfiguration {
|
|
repeated Identity identities = 1;
|
|
repeated Account accounts = 2;
|
|
}
|
|
|
|
message Identity {
|
|
string name = 1;
|
|
repeated Credential credentials = 2;
|
|
repeated string actions = 3;
|
|
Account account = 4;
|
|
bool disabled = 5; // User status: false = enabled (default), true = disabled
|
|
}
|
|
|
|
message Credential {
|
|
string access_key = 1;
|
|
string secret_key = 2;
|
|
string status = 3; // Access key status: "Active" or "Inactive"
|
|
}
|
|
|
|
message Account {
|
|
string id = 1;
|
|
string display_name = 2;
|
|
string email_address = 3;
|
|
}
|
|
|
|
/*
|
|
message Policy {
|
|
repeated Statement statements = 1;
|
|
}
|
|
|
|
message Statement {
|
|
repeated Action action = 1;
|
|
repeated Resource resource = 2;
|
|
}
|
|
|
|
message Action {
|
|
string action = 1;
|
|
}
|
|
message Resource {
|
|
string bucket = 1;
|
|
// string path = 2;
|
|
}
|
|
*/
|