influxdata / influxdata/influxdb
Add Instance level privileges/tokens
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
__Proposal:__
I'd love to see instance-level permission management.
This is what I mean by Instance-level
```
- Instance
- Organizations
- Buckets
```
As of now, It's not possible to access InfluxDB with a ReadOnly/WriteOnly token that is valid for multiple organizations,
exception made for the "operator token", the equivalent of sysadmin, which should not be used for applications.
__Current behavior:__
There is no way to create a token that allows access to more than one Organization
__Desired behavior:__
Create and manage tokens that allow access to more than one Organization
__Alternatives considered:__
I've tried with the v1 authorization (for backward compatibility), but the created user is still organization scoped. There is no way around it.
__Use case:__
My personal use case is to have a single token with write-only permission on multiple Organizations, I have a centralized system, in which all the data pass through a single Telegraf gateway.
Using InflxDB1 I've got no problems, as I just need a user with Write permission on all databases... by translating this into InfluxDB2, the best fit is to turn a DB into an Organization, but I can't have a token to access them all... which means the routing (made by the telegraf gateway) becomes hell.
The whole idea started from a telegraf feature request https://github.com/influxdata/telegraf/issues/10778, you may find some more details about my use case there.
edit: typos
Contributor guide
Research direction
No files, tests, or entry points are named. Start by reviewing the existing organization-scoped authorization model and the linked Telegraf feature request; done means users can create and manage read-only or write-only tokens valid across multiple organizations without using the operator token.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- authorization, databases
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100