Merge pull request #1303 from MikeSpreitzer/updoc1

Clarified remark about authorizers determining groups
2016-10-10 15:39:58 -07:00
parent b1b7c7969c 12f5e30309
commit 99e12c694a
1 changed files with 2 additions and 2 deletions
@@ -52,8 +52,8 @@ On GCE, Client Certificates, Password, Plain Tokens, and JWT Tokens are all enab
 If the request cannot be authenticated, it is rejected with HTTP status code 401.
 Otherwise, the user is authenticated as a specific `username`, and the user name
 is available to subsequent steps to use in their decisions.  Some authenticators
-may also provide the group memberships of the user, while other authenticators
-do not (and expect the authorizer to determine these).
+also provide the group memberships of the user, while other authenticators
+do not.

 While Kubernetes uses "usernames" for access control decisions and in request logging,
 it does not have a `user` object nor does it store usernames or other information about