Skip to content

Commit 6167d93

Browse files
p7novDerekBumlenkis
authored
Add tt-ee 2.5.1 authentication features (#4621)
Resolves tarantool/enterprise_doc#283, tarantool/enterprise_doc#284, tarantool/enterprise_doc#285 --token for tt tdg2 commands SSL options for tt crud and tt tdg2 commands Co-authored-by: Alexander Tulchinskiy <[email protected]> Co-authored-by: Elena Shebunyaeva <[email protected]>
1 parent 4a06933 commit 6167d93

File tree

3 files changed

+240
-13
lines changed

3 files changed

+240
-13
lines changed

‎doc/tooling/tt_cli/connect.rst‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -104,9 +104,9 @@ If no credentials are provided for a remote connection, the user is automaticall
104104
Encrypted connection
105105
~~~~~~~~~~~~~~~~~~~~
106106

107-
To connect to instances that use SSL encryption, provide the SSL certificate and
108-
SSL key files in the ``--sslcertfile`` and ``--sslkeyfile`` options. If necessary,
109-
add other SSL parameters -- ``--sslcafile`` and ``--sslciphers``.
107+
To connect to instances that use :ref:`SSL encryption <configuration_connections_ssl>`,
108+
provide the SSL certificate and SSL key files in the ``--sslcertfile`` and ``--sslkeyfile`` options.
109+
If necessary, add other SSL parameters -- ``--sslcafile`` and ``--sslciphers``.
110110

111111
Script evaluation
112112
~~~~~~~~~~~~~~~~~

‎doc/tooling/tt_cli/export.rst‎

Lines changed: 114 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -130,15 +130,23 @@ the ``customers.jsonl`` file:
130130
131131
$ tt tdg2 export localhost:3301 customers:customers.jsonl
132132
133-
If the ``customers`` type has four fields (``id``, ``firstname``, ``lastname``, and ``age``), the file with exported data might look like this:
133+
If token authentication is enabled in TDG2, pass the application token in the ``--token`` option:
134+
135+
.. code-block:: console
136+
137+
$ tt tdg2 export localhost:3301 customers:customers.jsonl \
138+
--token=2fc136cf-8cae-4655-a431-7c318967263d
139+
140+
If the ``customers`` type has four fields (``id``, ``firstname``, ``lastname``, and ``age``),
141+
the file with exported data might look like this:
134142

135143
.. code-block:: json
136144
137145
{"age":30,"first_name":"Samantha","id":1,"second_name":"Carter"}
138146
{"age":41,"first_name":"Fay","id":2,"second_name":"Rivers"}
139147
{"age":74,"first_name":"Milo","id":4,"second_name":"Walters"}
140148
141-
If an object contains a ``null`` value in a field, this field skipped:
149+
``null`` field values are skipped:
142150

143151
.. code-block:: json
144152
@@ -168,11 +176,55 @@ Set the ``tt tdg2 export`` batch size less or equal to 1000:
168176
169177
$ tt tdg2 export localhost:3301 customers:customers.jsonl --batch-size=1000
170178
179+
.. _tt-export-auth:
180+
181+
Authentication
182+
--------------
183+
184+
When connecting to the cluster with enabled authentication, specify access credentials
185+
in the ``--username`` and ``--password`` command options:
186+
187+
.. code-block:: console
188+
189+
$ tt crud export localhost:3301 customers:customers.csv \
190+
--username myuser --password p4$$w0rD
191+
192+
.. _tt-export-ssl:
193+
194+
Encrypted connection
195+
--------------------
196+
197+
To connect to instances that use :ref:`SSL encryption <configuration_connections_ssl>`,
198+
provide the SSL certificate and SSL key files in the ``--sslcertfile`` and ``--sslkeyfile`` options.
199+
If necessary, add other SSL parameters in the ``--ssl*`` options.
200+
201+
.. code-block:: console
202+
203+
$ tt crud export localhost:3301 customers:customers.csv \
204+
--username myuser --password p4$$w0rD \
205+
--auth pap-sha256 --sslcertfile certs/server.crt \
206+
--sslkeyfile certs/server.key
207+
208+
For connections that use SSL but don't require additional parameters, add the ``--use-ssl``
209+
option:
210+
211+
.. code-block:: console
212+
213+
$ tt crud export localhost:3301 customers:customers.csv \
214+
--username myuser --password p4$$w0rD \
215+
--use-ssl
216+
171217
.. _tt-export-options:
172218

173219
Options
174220
-------
175221

222+
.. option:: --auth STRING
223+
224+
**Applicable to:** ``tt crud export``, ``tt tdg2 export``
225+
226+
Authentication type: ``chap-sha1``, ``pap-sha256``, or ``auto``.
227+
176228
.. option:: --batch-queue-size INT
177229

178230
The maximum number of tuple batches in a queue between a fetch and write threads (the default is ``32``).
@@ -226,6 +278,66 @@ Options
226278

227279
Export data using a :ref:`read view <read_views>`.
228280

281+
.. option:: --sslcafile STRING
282+
283+
**Applicable to:** ``tt crud export``, ``tt tdg2 export``
284+
285+
The path to a trusted certificate authorities (CA) file for encrypted connections.
286+
287+
See also :ref:`tt-export-ssl`.
288+
289+
.. option:: --sslcertfile STRING
290+
291+
**Applicable to:** ``tt crud export``, ``tt tdg2 export``
292+
293+
The path to an SSL certificate file for encrypted connections.
294+
295+
See also :ref:`tt-export-ssl`.
296+
297+
.. option:: --sslciphersfile STRING
298+
299+
**Applicable to:** ``tt crud export``, ``tt tdg2 export``
300+
301+
The list of SSL cipher suites used for encrypted connections, separated by colons (``:``).
302+
303+
See also :ref:`tt-export-ssl`.
304+
305+
.. option:: --sslkeyfile STRING
306+
307+
**Applicable to:** ``tt crud export``, ``tt tdg2 export``
308+
309+
The path to a private SSL key file for encrypted connections.
310+
311+
See also :ref:`tt-export-ssl`.
312+
313+
.. option:: --sslpassword STRING
314+
315+
**Applicable to:** ``tt crud export``, ``tt tdg2 export``
316+
317+
The password for the SSL key file for encrypted connections.
318+
319+
See also :ref:`tt-export-ssl`.
320+
321+
.. option:: --sslpasswordfile STRING
322+
323+
**Applicable to:** ``tt crud export``, ``tt tdg2 export``
324+
325+
A file with list of passwords to the SSL key file for encrypted connections.
326+
327+
See also :ref:`tt-export-auth`.
328+
329+
.. option:: --token STRING
330+
331+
**Applicable to:** ``tt tdg2 export``
332+
333+
An application token for connecting to TDG2.
334+
335+
.. option:: --use-ssl STRING
336+
337+
Use SSL without providing any additional SSL parameters.
338+
339+
See also :ref:`tt-export-ssl`.
340+
229341
.. option:: --username STRING
230342

231343
A username for connecting to the instance.

‎doc/tooling/tt_cli/import.rst‎

Lines changed: 123 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,13 @@ The objects are described in the ``customers.jsonl`` file.
184184
185185
$ tt tdg2 import localhost:3301 customers.jsonl:customers
186186
187+
If token authentication is enabled in TDG2, pass the application token in the ``--token`` option:
188+
189+
.. code-block:: console
190+
191+
$ tt tdg2 import localhost:3301 customers.jsonl:customers \
192+
--token=2fc136cf-8cae-4655-a431-7c318967263d
193+
187194
The input file can look like this:
188195

189196
.. code-block:: json
@@ -220,11 +227,58 @@ To automatically confirm a batch import operation, add the ``--force`` option:
220227
--force
221228
222229
230+
.. _tt-import-auth:
231+
232+
Authentication
233+
--------------
234+
235+
When connecting to the cluster with enabled authentication, specify access credentials
236+
in the ``--username`` and ``--password`` command options:
237+
238+
.. code-block:: console
239+
240+
$ tt crud import localhost:3301 customers.csv:customers \
241+
--header --match=header \
242+
--username myuser --password p4$$w0rD
243+
244+
.. _tt-import-ssl:
245+
246+
Encrypted connection
247+
--------------------
248+
249+
To connect to instances that use :ref:`SSL encryption <configuration_connections_ssl>`,
250+
provide the SSL certificate and SSL key files in the ``--sslcertfile`` and ``--sslkeyfile`` options.
251+
If necessary, add other SSL parameters in the ``--ssl*`` options.
252+
253+
.. code-block:: console
254+
255+
$ tt crud import localhost:3301 customers.csv:customers \
256+
--header --match=header \
257+
--username myuser --password p4$$w0rD \
258+
--auth pap-sha256 --sslcertfile certs/server.crt \
259+
--sslkeyfile certs/server.key
260+
261+
For connections that use SSL but don't require additional parameters, add the ``--use-ssl``
262+
option:
263+
264+
.. code-block:: console
265+
266+
$ tt crud import localhost:3301 customers.csv:customers \
267+
--header --match=header \
268+
--username myuser --password p4$$w0rD \
269+
--use-ssl
270+
223271
.. _tt-import-options:
224272

225273
Options
226274
-------
227275

276+
.. option:: --auth STRING
277+
278+
**Applicable to:** ``tt crud import``, ``tt tdg2 import``
279+
280+
Authentication type: ``chap-sha1``, ``pap-sha256``, or ``auto``.
281+
228282
.. option:: --batch-size INT
229283

230284
**Applicable to:** ``tt crud import``, ``tt tdg2 import``
@@ -377,6 +431,65 @@ Options
377431
For CSV, double quotes are used by default (``"``).
378432
The double symbol of this option acts as the escaping symbol within input data.
379433

434+
.. option:: --rollback-on-error
435+
436+
**Applicable to:** ``tt crud import``
437+
438+
Specify whether any operation failed on a storage leads to rolling back batch
439+
import on this storage.
440+
441+
.. note::
442+
443+
``tt tdg2 import`` always works as if ``--rollback-on-error`` is ``true``.
444+
445+
.. option:: --sslcafile STRING
446+
447+
**Applicable to:** ``tt crud import``, ``tt tdg2 import``
448+
449+
The path to a trusted certificate authorities (CA) file for encrypted connections.
450+
451+
See also :ref:`tt-import-ssl`.
452+
453+
.. option:: --sslcertfile STRING
454+
455+
**Applicable to:** ``tt crud import``, ``tt tdg2 import``
456+
457+
The path to an SSL certificate file for encrypted connections.
458+
459+
See also :ref:`tt-import-ssl`.
460+
461+
.. option:: --sslciphersfile STRING
462+
463+
**Applicable to:** ``tt crud import``, ``tt tdg2 import``
464+
465+
The list of SSL cipher suites used for encrypted connections, separated by colons (``:``).
466+
467+
See also :ref:`tt-import-ssl`.
468+
469+
.. option:: --sslkeyfile STRING
470+
471+
**Applicable to:** ``tt crud import``, ``tt tdg2 import``
472+
473+
The path to a private SSL key file for encrypted connections.
474+
475+
See also :ref:`tt-import-ssl`.
476+
477+
.. option:: --sslpassword STRING
478+
479+
**Applicable to:** ``tt crud import``, ``tt tdg2 import``
480+
481+
The password for the SSL key file for encrypted connections.
482+
483+
See also :ref:`tt-import-ssl`.
484+
485+
.. option:: --sslpasswordfile STRING
486+
487+
**Applicable to:** ``tt crud import``, ``tt tdg2 import``
488+
489+
A file with a list of passwords to the SSL key file for encrypted connections.
490+
491+
See also :ref:`tt-import-auth`.
492+
380493
.. option:: -success STRING
381494

382495
The name of a file with rows that were imported (the default is ``success``).
@@ -394,17 +507,19 @@ Options
394507

395508
Symbols specified in this option cannot intersect with ``--dec-sep``.
396509

397-
.. option:: --username STRING
510+
.. option:: --token STRING
398511

399-
A username for connecting to the instance.
512+
**Applicable to:** ``tt tdg2 import``
400513

401-
.. option:: --rollback-on-error
514+
An application token for connecting to TDG2.
402515

403-
**Applicable to:** ``tt crud import``
516+
.. option:: --use-ssl STRING
404517

405-
Specify whether any operation failed on a storage leads to rollback of a batch
406-
import on this storage.
518+
Use SSL without providing any additional SSL parameters.
407519

408-
.. note::
520+
See also :ref:`tt-import-ssl`.
521+
522+
.. option:: --username STRING
523+
524+
A username for connecting to the instance.
409525

410-
``tt tdg2 import`` always works as if ``--rollback-on-error`` is ``true``.

0 commit comments

Comments
 (0)