mirror of
https://github.com/neondatabase/neon.git
synced 2026-01-13 16:32:56 +00:00
ce5333656f
Current state with authentication. Page server validates JWT token passed as a password during connection phase and later when performing an action such as create branch tenant parameter of an operation is validated to match one submitted in token. To allow access from console there is dedicated scope: PageServerApi, this scope allows access to all tenants. See code for access validation in: PageServerHandler::check_permission. Because we are in progress of refactoring of communication layer involving wal proposer protocol, and safekeeper<->pageserver. Safekeeper now doesn’t check token passed from compute, and uses “hardcoded” token passed via environment variable to communicate with pageserver. Compute postgres now takes token from environment variable and passes it as a password field in pageserver connection. It is not passed through settings because then user will be able to retrieve it using pg_settings or SHOW .. I’ve added basic test in test_auth.py. Probably after we add authentication to remaining network paths we should enable it by default and switch all existing tests to use it.
24 lines
581 B
Rust
24 lines
581 B
Rust
//
|
|
use std::path::PathBuf;
|
|
use std::time::Duration;
|
|
|
|
pub mod receive_wal;
|
|
pub mod replication;
|
|
pub mod s3_offload;
|
|
pub mod send_wal;
|
|
pub mod timeline;
|
|
pub mod wal_service;
|
|
|
|
#[derive(Debug, Clone)]
|
|
pub struct WalAcceptorConf {
|
|
pub data_dir: PathBuf,
|
|
pub daemonize: bool,
|
|
pub no_sync: bool,
|
|
pub listen_addr: String,
|
|
pub pageserver_addr: Option<String>,
|
|
// TODO (create issue) this is temporary, until protocol between PG<->SK<->PS rework
|
|
pub pageserver_auth_token: Option<String>,
|
|
pub ttl: Option<Duration>,
|
|
pub recall_period: Option<Duration>,
|
|
}
|