influxdata / influxdata/influxdb

Add Instance level privileges/tokens

Open
#23,189 11 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

__Proposal:__
I'd love to see instance-level permission management.
This is what I mean by Instance-level
```
- Instance
- Organizations
- Buckets
```

As of now, It's not possible to access InfluxDB with a ReadOnly/WriteOnly token that is valid for multiple organizations,
exception made for the "operator token", the equivalent of sysadmin, which should not be used for applications.

__Current behavior:__
There is no way to create a token that allows access to more than one Organization

__Desired behavior:__
Create and manage tokens that allow access to more than one Organization

__Alternatives considered:__
I've tried with the v1 authorization (for backward compatibility), but the created user is still organization scoped. There is no way around it.

__Use case:__
My personal use case is to have a single token with write-only permission on multiple Organizations, I have a centralized system, in which all the data pass through a single Telegraf gateway.
Using InflxDB1 I've got no problems, as I just need a user with Write permission on all databases... by translating this into InfluxDB2, the best fit is to turn a DB into an Organization, but I can't have a token to access them all... which means the routing (made by the telegraf gateway) becomes hell.
The whole idea started from a telegraf feature request https://github.com/influxdata/telegraf/issues/10778, you may find some more details about my use case there.

edit: typos

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named. Start by reviewing the existing organization-scoped authorization model and the linked Telegraf feature request; done means users can create and manage read-only or write-only tokens valid across multiple organizations without using the operator token.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
authorization, databases
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.