Skip to content

Commit b1cb358

Browse files
committed
docs: align temporary identity docs with current implementation
1 parent 2b77d0e commit b1cb358

2 files changed

Lines changed: 82 additions & 514 deletions

File tree

docs/gateway-configuration/authentication-and-authorization.md

Lines changed: 32 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -69,76 +69,75 @@ Starting from Kura 5.5 the following restrictions will be applied by the Identit
6969

7070
## Temporary Identities
7171

72-
Kura 5.6 introduces the **TemporaryIdentityService**, a specialized service for creating and managing temporary, non-persistent identities. Temporary identities are designed for short-lived authentication scenarios where identity persistence is not required.
72+
Kura 6 introduces temporary identity support in the **IdentityService**, a set of APIs for creating and managing temporary, non-persistent identities. Temporary identities are designed for short-lived authentication scenarios where identity persistence is not required.
7373

7474
### Key Characteristics
7575

7676
- **Non-Persistent**: Temporary identities exist only in memory and are never persisted to disk or configuration snapshots
77-
- **Token-Based Authentication**: Each temporary identity is associated with a unique authentication token
77+
- **Password-Based Authentication**: Each temporary identity uses a generated password for authentication
7878
- **Automatic Lifecycle Management**: Temporary identities can be programmatically created and deleted as needed
7979
- **Permission-Based Authorization**: Temporary identities support the same permission model as regular identities
80-
- **No Password Management**: Temporary identities use token-based authentication and do not require password management
8180

8281
### Primary Use Case: Container Identity Integration
8382

8483
The main use case for temporary identities is the **Container Identity Integration** feature, which automatically provisions authentication credentials for containerized applications. When a container is configured with identity integration enabled:
8584

8685
1. Kura creates a temporary identity with the specified permissions
87-
2. Generates a unique authentication token for the identity
88-
3. Provides the token to the container via environment variables
86+
2. Generates a temporary password for the identity
87+
3. Provides the identity name and password to the container via environment variables
8988
4. Automatically cleans up the temporary identity when the container stops
9089

91-
This allows containers to securely access Kura's REST APIs without manual credential configuration or exposing persistent credentials.
90+
This allows containers to securely access Kura's REST APIs without manual credential configuration or exposing persistent credentials. Password-based REST authentication requires **Basic Authentication Enabled** in the **RestService** configuration.
9291

93-
### TemporaryIdentityService API
92+
### Temporary Identity API
9493

95-
The `TemporaryIdentityService` provides the following operations:
94+
Temporary identities are managed through the `IdentityService` APIs using an `IdentityConfiguration` and a lifetime:
9695

9796
#### Create Temporary Identity
9897
```java
99-
String createTemporaryIdentity(String identityName, Set<Permission> permissions)
98+
void createTemporaryIdentity(IdentityConfiguration configuration, Duration lifetime)
10099
```
101-
Creates a temporary identity with the given name and permissions, returning an authentication token.
100+
Creates a temporary identity with the given configuration and lifetime.
102101

103102
#### Delete Temporary Identity
104103
```java
105-
boolean deleteTemporaryIdentity(String token)
104+
boolean deleteIdentity(String identityName)
106105
```
107-
Deletes a temporary identity identified by its token.
108-
109-
#### Validate Temporary Token
110-
```java
111-
String validateTemporaryToken(String token)
112-
```
113-
Validates a token and returns the associated identity name.
114-
115-
#### Check Temporary Permission
116-
```java
117-
void checkTemporaryPermission(String token, Permission permission)
118-
```
119-
Verifies that a temporary identity has a specific permission.
106+
Deletes a temporary identity by name (also works for regular identities).
120107

121108
### Usage Example
122109

123110
```java
124-
import org.eclipse.kura.identity.TemporaryIdentityService;
111+
import java.time.Duration;
112+
import java.util.Arrays;
113+
import java.util.Optional;
114+
import org.eclipse.kura.identity.IdentityConfiguration;
115+
import org.eclipse.kura.identity.IdentityService;
125116
import org.eclipse.kura.identity.Permission;
117+
import org.eclipse.kura.identity.PasswordConfiguration;
118+
import org.eclipse.kura.identity.AssignedPermissions;
126119

127120
// Create temporary identity with specific permissions
128121
Set<Permission> permissions = new HashSet<>();
129122
permissions.add(new Permission("rest.system"));
130123
permissions.add(new Permission("rest.configuration"));
131124

132-
String token = temporaryIdentityService.createTemporaryIdentity(
133-
"container_myapp",
134-
permissions
125+
final String identityName = "container_myapp";
126+
final char[] password = "temporary-password".toCharArray();
127+
128+
PasswordConfiguration passwordConfiguration = new PasswordConfiguration(false, true, Optional.of(password), Optional.empty());
129+
AssignedPermissions assignedPermissions = new AssignedPermissions(permissions);
130+
IdentityConfiguration configuration = new IdentityConfiguration(
131+
identityName,
132+
Arrays.asList(passwordConfiguration, assignedPermissions)
135133
);
136134

137-
// Token can now be used for REST API authentication
138-
// ...
135+
identityService.createTemporaryIdentity(configuration, Duration.ofHours(1));
136+
137+
// Identity name and password can now be used for REST API authentication
139138

140139
// Clean up when no longer needed
141-
temporaryIdentityService.deleteTemporaryIdentity(token);
140+
identityService.deleteIdentity(identityName);
142141
```
143142

144143
### Differences from Regular Identities
@@ -161,7 +160,7 @@ temporaryIdentityService.deleteTemporaryIdentity(token);
161160
### Further Reading
162161

163162
- [Container Identity Integration](../core-services/container-orchestration-provider-usage.md#container-identity-integration) - Detailed guide on using temporary identities with containers
164-
- [How to Use Temporary Identity Service](../java-application-development/how-to-use-temporary-identity-service.md) - Developer guide for using the TemporaryIdentityService API
163+
- [How to Use Temporary Identities](../java-application-development/how-to-use-temporary-identity-service.md) - Developer guide for using IdentityService temporary identity APIs
165164
- [REST Identity API](../references/rest-apis/rest-identity-api-v2.md) - REST APIs for identity management (regular identities only)
166165

167166
## UserAdmin persistence
@@ -313,4 +312,4 @@ Example:
313312
"name": "kura.permission.kura.wires.admin",
314313
"basicMembers": ["kura.user.appadmin"]
315314
}
316-
```
315+
```

0 commit comments

Comments
 (0)