{"action":"created","comment":{"url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/pulls/comments/47084553","id":47084553,"diff_hunk":"@@ -4,436 +4,701 @@ title: Security\n category: Manager\n draft: false\n weight: 500\n-\n ---\n \n-Cloudify's security framework uses the [Flask-secuREST](https://github.com/cloudify-cosmo/flask-securest/tree/0.6)\n-package, which integrates with [Flask-RESTful](https://flask-restful.readthedocs.org/en/0.3.2/) to secure REST services.\n-\n-When security is enabled, all requests to the REST service are authenticated using the specified [userstore](https://github.com/cloudify-cosmo/flask-securest/tree/master#userstore) and [authentication provider](https://github.com/cloudify-cosmo/flask-securest/tree/master#authentication-provider) (see [Setting up a secured server](#setting-up-a-secured-server)), before they can reach their endpoint (except internal requests, as explained in the Advanced section below).<br>\n-For example, when a user of the Web-UI attempts to see the all blueprints, a request is sent to the REST service\n-\"blueprints\" endpoint, but it will only reach it if the user is logged in with valid credentials. <br>\n-Similarly, the CLI command \"cfy deployments create\" will only be successful if valid\n-credentials are sent with the REST call to the endpoint \"deployments\".\n-Of course, direct requests made using other clients (e.g. curl) must also include correct credentials, or they will\n-fail with an \"Unauthorized User\" error.\n-\n-\n-# Token Generation\n-\n-Tokens can be used as an authentication method.<br>\n-In order to send a token with each request, the user must first receive a token.\n-Tokens can be generated by many systems, and they will work as long as the token can be processed by\n-one of the registered authentication providers.\n-\n-To make things easier, Cloudify can also generate tokens through the REST service endpoint \"/tokens\".\n-To enable this feature a token generator must be configured.\n-\n-{{% gsNote title=\"Note \" %}}\n-The request to \"/tokens\" must itself be authenticated (using a username-password set, for example).\n-{{% /gsNote %}}\n-\n-\n-# Setting up a secured server\n-\n-## Manager Blueprint Configuration\n-The security configuration is located in the manager blueprint, in this path:\n-{{< gsHighlight  yaml  >}}\n-node_templates\n+Securing access to the manager focuses on the REST service - this is the only access point of clients to the management\n+server. <br>That is to say, clients communicate with the manager by sending http(s) requests to the REST service, which in\n+turn processes these requests and communicates with internal management components (e.g. RabbitMQ, Elasticsearch).\n+\n+![manager architecture]({{< img \"guide/security/manager_arch_for_security.png\" >}})\n+\n+When security is enabled, all requests to the manager are authenticated and authorized before reaching their endpoint. <br>\n+For example, when a Web-UI user attempts to upload a new blueprint a request is sent to the REST service's\n+*/blueprints* endpoint. The request will only reach the endpoint if the user is logged in and is authorized to upload\n+blueprints. <br>Similarly, a user that executes the CLI command `cfy deployments list` triggers a request to execute GET on\n+*/deployments*, which will only be successful if it includes valid credentials, identifying an authorized\n+user.\n+<br>Requests generated by other HTTP clients (e.g. curl) must also include correct credentials.<br>\n+If credentials are missing, invalid or represent an unauthorized user, the request fails with a \"401: Unauthorized User\"\n+error.\n+\n+Exceptions to the rule are open resources and internal requests:\n+\n+* The */version* endpoint is not a secured resource, and is therefore open to all users. <br>\n+* Internal requests (originated by Cloudify) bypass the authentication mechanism by using port 8101. This port must be","path":"content/manager/security.md","position":59,"original_position":59,"commit_id":"f5661157c068ec7f2c34b0ffa56faaba898309fc","original_commit_id":"f5661157c068ec7f2c34b0ffa56faaba898309fc","user":{"login":"dankilman","id":1008577,"avatar_url":"https://avatars.githubusercontent.com/u/1008577?v=3","gravatar_id":"","url":"https://api.github.com/users/dankilman","html_url":"https://github.com/dankilman","followers_url":"https://api.github.com/users/dankilman/followers","following_url":"https://api.github.com/users/dankilman/following{/other_user}","gists_url":"https://api.github.com/users/dankilman/gists{/gist_id}","starred_url":"https://api.github.com/users/dankilman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dankilman/subscriptions","organizations_url":"https://api.github.com/users/dankilman/orgs","repos_url":"https://api.github.com/users/dankilman/repos","events_url":"https://api.github.com/users/dankilman/events{/privacy}","received_events_url":"https://api.github.com/users/dankilman/received_events","type":"User","site_admin":false},"body":"... port 8101. Therefore, This port must ...","created_at":"2015-12-09T12:36:35Z","updated_at":"2015-12-09T12:36:35Z","html_url":"https://github.com/cloudify-cosmo/docs.getcloudify.org/pull/43#discussion_r47084553","pull_request_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/pulls/43","_links":{"self":{"href":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/pulls/comments/47084553"},"html":{"href":"https://github.com/cloudify-cosmo/docs.getcloudify.org/pull/43#discussion_r47084553"},"pull_request":{"href":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/pulls/43"}}},"pull_request":{"url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/pulls/43","id":52958930,"html_url":"https://github.com/cloudify-cosmo/docs.getcloudify.org/pull/43","diff_url":"https://github.com/cloudify-cosmo/docs.getcloudify.org/pull/43.diff","patch_url":"https://github.com/cloudify-cosmo/docs.getcloudify.org/pull/43.patch","issue_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/issues/43","number":43,"state":"open","locked":false,"title":"updated the security guide","user":{"login":"noakup","id":1745412,"avatar_url":"https://avatars.githubusercontent.com/u/1745412?v=3","gravatar_id":"","url":"https://api.github.com/users/noakup","html_url":"https://github.com/noakup","followers_url":"https://api.github.com/users/noakup/followers","following_url":"https://api.github.com/users/noakup/following{/other_user}","gists_url":"https://api.github.com/users/noakup/gists{/gist_id}","starred_url":"https://api.github.com/users/noakup/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/noakup/subscriptions","organizations_url":"https://api.github.com/users/noakup/orgs","repos_url":"https://api.github.com/users/noakup/repos","events_url":"https://api.github.com/users/noakup/events{/privacy}","received_events_url":"https://api.github.com/users/noakup/received_events","type":"User","site_admin":false},"body":"","created_at":"2015-12-08T09:52:35Z","updated_at":"2015-12-09T12:36:35Z","closed_at":null,"merged_at":null,"merge_commit_sha":"c1fc8de31a6ad308f9ffc36784de7106c422d3d0","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/pulls/43/commits","review_comments_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/pulls/43/comments","review_comment_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/pulls/comments{/number}","comments_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/issues/43/comments","statuses_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/statuses/f5661157c068ec7f2c34b0ffa56faaba898309fc","head":{"label":"cloudify-cosmo:CFY-4361-security-documentation-update","ref":"CFY-4361-security-documentation-update","sha":"f5661157c068ec7f2c34b0ffa56faaba898309fc","user":{"login":"cloudify-cosmo","id":6260555,"avatar_url":"https://avatars.githubusercontent.com/u/6260555?v=3","gravatar_id":"","url":"https://api.github.com/users/cloudify-cosmo","html_url":"https://github.com/cloudify-cosmo","followers_url":"https://api.github.com/users/cloudify-cosmo/followers","following_url":"https://api.github.com/users/cloudify-cosmo/following{/other_user}","gists_url":"https://api.github.com/users/cloudify-cosmo/gists{/gist_id}","starred_url":"https://api.github.com/users/cloudify-cosmo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cloudify-cosmo/subscriptions","organizations_url":"https://api.github.com/users/cloudify-cosmo/orgs","repos_url":"https://api.github.com/users/cloudify-cosmo/repos","events_url":"https://api.github.com/users/cloudify-cosmo/events{/privacy}","received_events_url":"https://api.github.com/users/cloudify-cosmo/received_events","type":"Organization","site_admin":false},"repo":{"id":37913171,"name":"docs.getcloudify.org","full_name":"cloudify-cosmo/docs.getcloudify.org","owner":{"login":"cloudify-cosmo","id":6260555,"avatar_url":"https://avatars.githubusercontent.com/u/6260555?v=3","gravatar_id":"","url":"https://api.github.com/users/cloudify-cosmo","html_url":"https://github.com/cloudify-cosmo","followers_url":"https://api.github.com/users/cloudify-cosmo/followers","following_url":"https://api.github.com/users/cloudify-cosmo/following{/other_user}","gists_url":"https://api.github.com/users/cloudify-cosmo/gists{/gist_id}","starred_url":"https://api.github.com/users/cloudify-cosmo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cloudify-cosmo/subscriptions","organizations_url":"https://api.github.com/users/cloudify-cosmo/orgs","repos_url":"https://api.github.com/users/cloudify-cosmo/repos","events_url":"https://api.github.com/users/cloudify-cosmo/events{/privacy}","received_events_url":"https://api.github.com/users/cloudify-cosmo/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/cloudify-cosmo/docs.getcloudify.org","description":"Documentation web site for Cloudify 3.x","fork":false,"url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org","forks_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/forks","keys_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/keys{/key_id}","collaborators_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/teams","hooks_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/hooks","issue_events_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/issues/events{/number}","events_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/events","assignees_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/assignees{/user}","branches_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/branches{/branch}","tags_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/tags","blobs_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/git/refs{/sha}","trees_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/git/trees{/sha}","statuses_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/statuses/{sha}","languages_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/languages","stargazers_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/stargazers","contributors_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/contributors","subscribers_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/subscribers","subscription_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/subscription","commits_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/commits{/sha}","git_commits_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/git/commits{/sha}","comments_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/comments{/number}","issue_comment_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/issues/comments{/number}","contents_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/contents/{+path}","compare_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/compare/{base}...{head}","merges_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/merges","archive_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/downloads","issues_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/issues{/number}","pulls_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/pulls{/number}","milestones_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/milestones{/number}","notifications_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/labels{/name}","releases_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/releases{/id}","created_at":"2015-06-23T10:45:22Z","updated_at":"2015-08-12T13:34:25Z","pushed_at":"2015-12-09T12:20:14Z","git_url":"git://github.com/cloudify-cosmo/docs.getcloudify.org.git","ssh_url":"git@github.com:cloudify-cosmo/docs.getcloudify.org.git","clone_url":"https://github.com/cloudify-cosmo/docs.getcloudify.org.git","svn_url":"https://github.com/cloudify-cosmo/docs.getcloudify.org","homepage":null,"size":9516,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":5,"mirror_url":null,"open_issues_count":9,"forks":5,"open_issues":9,"watchers":0,"default_branch":"master"}},"base":{"label":"cloudify-cosmo:master","ref":"master","sha":"75bc37daaa25cbddd84ef65be956afe60989e049","user":{"login":"cloudify-cosmo","id":6260555,"avatar_url":"https://avatars.githubusercontent.com/u/6260555?v=3","gravatar_id":"","url":"https://api.github.com/users/cloudify-cosmo","html_url":"https://github.com/cloudify-cosmo","followers_url":"https://api.github.com/users/cloudify-cosmo/followers","following_url":"https://api.github.com/users/cloudify-cosmo/following{/other_user}","gists_url":"https://api.github.com/users/cloudify-cosmo/gists{/gist_id}","starred_url":"https://api.github.com/users/cloudify-cosmo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cloudify-cosmo/subscriptions","organizations_url":"https://api.github.com/users/cloudify-cosmo/orgs","repos_url":"https://api.github.com/users/cloudify-cosmo/repos","events_url":"https://api.github.com/users/cloudify-cosmo/events{/privacy}","received_events_url":"https://api.github.com/users/cloudify-cosmo/received_events","type":"Organization","site_admin":false},"repo":{"id":37913171,"name":"docs.getcloudify.org","full_name":"cloudify-cosmo/docs.getcloudify.org","owner":{"login":"cloudify-cosmo","id":6260555,"avatar_url":"https://avatars.githubusercontent.com/u/6260555?v=3","gravatar_id":"","url":"https://api.github.com/users/cloudify-cosmo","html_url":"https://github.com/cloudify-cosmo","followers_url":"https://api.github.com/users/cloudify-cosmo/followers","following_url":"https://api.github.com/users/cloudify-cosmo/following{/other_user}","gists_url":"https://api.github.com/users/cloudify-cosmo/gists{/gist_id}","starred_url":"https://api.github.com/users/cloudify-cosmo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cloudify-cosmo/subscriptions","organizations_url":"https://api.github.com/users/cloudify-cosmo/orgs","repos_url":"https://api.github.com/users/cloudify-cosmo/repos","events_url":"https://api.github.com/users/cloudify-cosmo/events{/privacy}","received_events_url":"https://api.github.com/users/cloudify-cosmo/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/cloudify-cosmo/docs.getcloudify.org","description":"Documentation web site for Cloudify 3.x","fork":false,"url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org","forks_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/forks","keys_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/keys{/key_id}","collaborators_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/teams","hooks_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/hooks","issue_events_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/issues/events{/number}","events_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/events","assignees_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/assignees{/user}","branches_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/branches{/branch}","tags_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/tags","blobs_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/git/refs{/sha}","trees_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/git/trees{/sha}","statuses_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/statuses/{sha}","languages_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/languages","stargazers_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/stargazers","contributors_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/contributors","subscribers_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/subscribers","subscription_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/subscription","commits_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/commits{/sha}","git_commits_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/git/commits{/sha}","comments_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/comments{/number}","issue_comment_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/issues/comments{/number}","contents_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/contents/{+path}","compare_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/compare/{base}...{head}","merges_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/merges","archive_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/downloads","issues_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/issues{/number}","pulls_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/pulls{/number}","milestones_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/milestones{/number}","notifications_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/labels{/name}","releases_url":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/releases{/id}","created_at":"2015-06-23T10:45:22Z","updated_at":"2015-08-12T13:34:25Z","pushed_at":"2015-12-09T12:20:14Z","git_url":"git://github.com/cloudify-cosmo/docs.getcloudify.org.git","ssh_url":"git@github.com:cloudify-cosmo/docs.getcloudify.org.git","clone_url":"https://github.com/cloudify-cosmo/docs.getcloudify.org.git","svn_url":"https://github.com/cloudify-cosmo/docs.getcloudify.org","homepage":null,"size":9516,"stargazers_count":0,"watchers_count":0,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":5,"mirror_url":null,"open_issues_count":9,"forks":5,"open_issues":9,"watchers":0,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/pulls/43"},"html":{"href":"https://github.com/cloudify-cosmo/docs.getcloudify.org/pull/43"},"issue":{"href":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/issues/43"},"comments":{"href":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/issues/43/comments"},"review_comments":{"href":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/pulls/43/comments"},"review_comment":{"href":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/pulls/43/commits"},"statuses":{"href":"https://api.github.com/repos/cloudify-cosmo/docs.getcloudify.org/statuses/f5661157c068ec7f2c34b0ffa56faaba898309fc"}}}}