7

When configuring the microservices, and topology manager, we have to make use of pre-defined roles that grant various permissions. These are summarised here in the documentation.

The roles are cm, cd, provider and implementer. I have seen examples of cm and cd in use (via the cmuser and cduser accounts configured in the cd_ambient_conf.xml of the discovery/token service.), but it is not always clear when one should choose one and when the other. I have not seen any examples of using provider or implementer.

I'm left wondering what scenarios are envisaged where provider and implementer would be useful. Can we also add our own roles, and if so, when would this make sense? Is there an easy way to know when to use cmuser and cduser?

Improve this question

1 Answer 1

Reset to default
4

One of the use case of Roles is to shield certain resources (endpoints) of services from Read/Write operations. For example, when we have OAuth & Rules enabled (in cd_ambient_conf.xml), only users in CD and implementer roles can perform GET/POST requests on content service.

The provider role is used when registering capabilities with discovery service (clientId=registration).

implementer role is similar to CD role except for the access to deployer endpoints.

Currently the shielding of resources are internal to CD services and only option available is enable/disable is completely. So, adding new roles is not currently supported.

This is documented here.

Improve this answer
6
  • So if I understand you correctly, the discovery-registration jar uses the provider role. I still don't get what the purpose of the implementer role is. Under what circumstances would you use it?
    – Dominic Cronin
    Commented May 13, 2016 at 8:49
  • Implementer role is specific to CD side (for ex: can't publish). Recently updated answer to add link to the documentation page which describes this in detail. Can you please check it ?
    – vinayknl
    Commented May 13, 2016 at 9:12
  • I'd already read that page before I wrote my question. In fact, there's a link to it in my question. That's kind of the point, though - the documentation doesn't say anything about why you might need the implementer role.
    – Dominic Cronin
    Commented May 13, 2016 at 9:46
  • Sorry, missed that link. Agree that there is no specific detail about why and when to use implementer role, but as you can see in that page, the only difference between cd and implementer role is access to one of the end point in deployer (/deployer/isAlive). Other than that it is same as cd role.
    – vinayknl
    Commented May 13, 2016 at 11:27
  • Yeah - that's the thing. There must be a reason why there are two distinct roles, so I've asked this question to try to get some insights into why?
    – Dominic Cronin
    Commented May 13, 2016 at 12:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.