whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #2749 from liggitt/anonymous-auth

Browse Source 
Clarify anonymous auth enablement
This commit is contained in:
Andrew Chen
2017-03-21 16:41:07 -07:00
committed by GitHub
parent ff7b67dd3b 730fada1af
commit 8fe6182953
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/admin/authentication.md
+8 -5
View File
@@ -515,9 +515,6 @@ changes](https://github.com/kubernetes/kubernetes/pull/25536) for more details.
## Anonymous requests ## Anonymous requests
Anonymous access is enabled by default, and can be disabled by passing `--anonymous-auth=false`
option to the API server during startup.
When enabled, requests that are not rejected by other configured authentication methods are When enabled, requests that are not rejected by other configured authentication methods are
treated as anonymous requests, and given a username of `system:anonymous` and a group of treated as anonymous requests, and given a username of `system:anonymous` and a group of
`system:unauthenticated`. `system:unauthenticated`.
@@ -526,8 +523,14 @@ For example, on a server with token authentication configured, and anonymous acc
a request providing an invalid bearer token would receive a `401 Unauthorized` error. a request providing an invalid bearer token would receive a `401 Unauthorized` error.
A request providing no bearer token would be treated as an anonymous request. A request providing no bearer token would be treated as an anonymous request.
If you rely on authentication alone to authorize access, either change to use an In 1.5.1-1.5.x, anonymous access is disabled by default, and can be enabled by
authorization mode other than `AlwaysAllow`, or set `--anonymous-auth=false`. passing the `--anonymous-auth=false` option to the API server.
In 1.6+, anonymous access is enabled by default if an authorization mode other than `AlwaysAllow`
is used, and can be disabled by passing the `--anonymous-auth=false` option to the API server.
Starting in 1.6, the ABAC and RBAC authorizers require explicit authorization of the
`system:anonymous` user or the `system:unauthenticated` group, so legacy policy rules
that grant access to the `*` user or `*` group do not include anonymous users.
## Plugin Development ## Plugin Development