Skip to content

Commit 22943bd

Browse files
author
docs-action
committed
1 parent 0962f55 commit 22943bd

File tree

2 files changed

+37
-1
lines changed

2 files changed

+37
-1
lines changed

v1.48/assets/js/search-data.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
},"4": {
3030
"doc": "Access Control Lists (ACLs) -Deprecated-",
3131
"title": "Basic Auth Functionality",
32-
"content": "New lakeFS versions will provide basic auth functionality featuring a single Admin user with a single set of credentials. Existing lakeFS installations that have a single user and a single set of credentials will migrate seamlessly to the new version. Installations that have more than one user / credentials will require to run a command and choose which set of user + credentials to migrate (more details here) . ",
32+
"content": "New lakeFS versions will provide basic auth functionality featuring a single Admin user with a single set of credentials. Existing lakeFS installations that have a single user and a single set of credentials will migrate seamlessly to the new version. Installations that have more than one user / credentials will require to run a command and choose which set of user + credentials to migrate (more details here) . Credentials Replacement . In a single user setup, replacing credentials can be done as follows: . | Delete the existing user: lakectl auth users delete --id <user-id> . | Shut down the lakeFS server - Required for invalidating the old credentials on the server | Create a new user, with the same name and new credentials: lakefs superuser --user-name <user-id> . This will generate a new set of credentials, and will print it out to the screen: . credentials: access_key_id: *** (omitted) secret_access_key: *** (omitted) . | Re-run lakeFS server | . Calling the superuser command with pre-defined --access-key-id and --secret-access-key is possible, but should be done with caution. Make sure that --secret-access-key is not empty, as providing an access key without a secret key will trigger an ACL import flow (see Migration of existing user). In case you already deleted the user by following step (1), this import operation will fail and result in an unrecoverable state, from which a clean installation is the only way out. ",
3333
"url": "/v1.48/security/access-control-lists.html#basic-auth-functionality",
3434

3535
"relUrl": "/security/access-control-lists.html#basic-auth-functionality"

v1.48/security/access-control-lists.html

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -598,6 +598,42 @@ <h2 id="basic-auth-functionality">
598598
Existing lakeFS installations that have a single user and a single set of credentials will migrate seamlessly to the new version.<br />
599599
Installations that have more than one user / credentials will require to run a command and choose which set of user + credentials to migrate
600600
(more details <a href="#migration-of-existing-user">here</a>)</p>
601+
<h3 id="credentials-replacement">
602+
603+
604+
<a href="#credentials-replacement" class="anchor-heading"><svg viewBox="0 0 16 16" aria-hidden="true"><use xlink:href="#svg-link"></use></svg></a> Credentials Replacement
605+
606+
607+
</h3>
608+
609+
610+
<p>In a single user setup, replacing credentials can be done as follows:</p>
611+
<ol>
612+
<li>Delete the existing user:
613+
<div class="language-shell highlighter-rouge"><div class="highlight"><pre class="highlight"><code> lakectl auth <span class="nb">users </span>delete <span class="nt">--id</span> &lt;user-id&gt;
614+
</code></pre></div> </div>
615+
</li>
616+
<li>Shut down the lakeFS server - Required for invalidating the old credentials on the server</li>
617+
<li>Create a new user, with the same name and new credentials:
618+
<div class="language-shell highlighter-rouge"><div class="highlight"><pre class="highlight"><code> lakefs superuser <span class="nt">--user-name</span> &lt;user-id&gt;
619+
</code></pre></div> </div>
620+
<p>This will generate a new set of credentials, and will print it out to the screen:</p>
621+
<div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code> credentials:
622+
access_key_id: *** (omitted)
623+
secret_access_key: *** (omitted)
624+
</code></pre></div> </div>
625+
</li>
626+
<li>Re-run lakeFS server</li>
627+
</ol>
628+
629+
<blockquote class="note warning">
630+
<p>Calling the <code class="language-plaintext highlighter-rouge">superuser</code> command with pre-defined <code class="language-plaintext highlighter-rouge">--access-key-id</code> and <code class="language-plaintext highlighter-rouge">--secret-access-key</code> is possible,
631+
but should be done with caution. Make sure that <code class="language-plaintext highlighter-rouge">--secret-access-key</code> is <strong>not empty</strong>,
632+
as providing an access key without a secret key will trigger an ACL import flow
633+
(see <a href="#migration-of-existing-user">Migration of existing user</a>).
634+
In case you already deleted the user by following step (1), this import operation will <strong>fail</strong> and result in an
635+
<strong>unrecoverable</strong> state, from which a clean installation is the only way out.</p>
636+
</blockquote>
601637
<h2 id="acls">
602638

603639

0 commit comments

Comments
 (0)