1
0
mirror of https://github.com/taigrr/nats.docs synced 2025-01-18 04:03:23 -08:00

a few updates with final review + adding Revocation and Managed Operators menu items under NSC

This commit is contained in:
ainsley 2019-09-23 17:36:58 -05:00
parent 52ffd97d8d
commit dfcb9f2bb0
4 changed files with 7 additions and 5 deletions

View File

@ -117,6 +117,8 @@
* [Streams](nats_tools/nsc/streams.md) * [Streams](nats_tools/nsc/streams.md)
* [Services](nats_tools/nsc/services.md) * [Services](nats_tools/nsc/services.md)
* [Signing Keys](nats_tools/nsc/signing_keys.md) * [Signing Keys](nats_tools/nsc/signing_keys.md)
* [Revocation](nats_tools/nsc/revocation.md)
* [Managed Operators](nats_tools/nsc/managed.md)
* [nats-account-server](nats_tools/nas/README.md) * [nats-account-server](nats_tools/nas/README.md)
* [Basics](nats_tools/nas/nas_conf.md) * [Basics](nats_tools/nas/nas_conf.md)
* [Inspecting JWTs](nats_tools/nas/inspecting_jwts.md) * [Inspecting JWTs](nats_tools/nas/inspecting_jwts.md)

View File

@ -2,7 +2,7 @@
NATS account configurations are built using the `nsc` tool. The NSC tool allows you to: NATS account configurations are built using the `nsc` tool. The NSC tool allows you to:
- Create and Edit Operators, Accounts, Users - Create and edit Operators, Accounts, Users
- Manage subscribe and publish permissions for Users - Manage subscribe and publish permissions for Users
- Add and delete Exports and Imports - Add and delete Exports and Imports
- Generate Activation tokens - Generate Activation tokens
@ -40,4 +40,4 @@ It can be found within the tool itself:
> nsc help > nsc help
``` ```
Or an online version [here](https://nats-io.github.io/nsc) Or an online version [here](https://nats-io.github.io/nsc).

View File

@ -1,6 +1,6 @@
# Working with Managed Operators # Working with Managed Operators
`nsc` can be used to administer multiple operators. Operators can be thought of as the owners of nats-servers, and fall into two categories: local and managed. The key difference, pardon the pun, is that managed operators are ones which you don't have the nkey for. An example of a managed operator is the Synadia service called NGS. Synadia has the keys. You can use `nsc` to administer multiple operators. Operators can be thought of as the owners of nats-servers, and fall into two categories: local and managed. The key difference, pardon the pun, is that managed operators are ones which you don't have the nkey for. An example of a managed operator is the Synadia service called NGS. Synadia has the keys.
Accounts, as represented by their JWTs, are signed by the operator. Some operators may use local copies of JWTs, others may use the [nats-account-server](../nas/README.md) to manage their JWTs. Synadia uses a custom server for their JWTs that works similarly to the open-sourced account server. Accounts, as represented by their JWTs, are signed by the operator. Some operators may use local copies of JWTs, others may use the [nats-account-server](../nas/README.md) to manage their JWTs. Synadia uses a custom server for their JWTs that works similarly to the open-sourced account server.
@ -37,7 +37,7 @@ Once you add a managed operator you can add accounts to it normally, with the ca
## Defining "Well Known Operators" ## Defining "Well Known Operators"
You tell `nsc` about an operator that you want people in your environment to use by name with a simple environment variable of the form `nsc_<operator name>_operator` the value of this environment variable should be the URL for getting the operator JWT. For example: To define a well known operator, you would tell `nsc` about an operator that you want people in your environment to use by name with a simple environment variable of the form `nsc_<operator name>_operator` the value of this environment variable should be the URL for getting the operator JWT. For example:
```bash ```bash
export nsc_zoom_operator=https://account-server-host/jwt/v1/operator export nsc_zoom_operator=https://account-server-host/jwt/v1/operator

View File

@ -249,7 +249,7 @@ Subscriber shows:
[#1] Received on [hello]: NATS [#1] Received on [hello]: NATS
``` ```
### User Authorization ## User Authorization
User authorization, as expected, also works with JWT authentication. With `nsc` you can specify authorization for specific subjects to which the user can or cannot publish or subscribe. By default a user doesn't have any limits on the subjects that it can publish or subscribe to. Any message stream or message published in the account is subscribable by the user. The user can also publish to any subject or imported service. Note that authorization, if configured, must be specified on a per user basis. User authorization, as expected, also works with JWT authentication. With `nsc` you can specify authorization for specific subjects to which the user can or cannot publish or subscribe. By default a user doesn't have any limits on the subjects that it can publish or subscribe to. Any message stream or message published in the account is subscribable by the user. The user can also publish to any subject or imported service. Note that authorization, if configured, must be specified on a per user basis.