Merge "Remove unused code"

[aaa.git] / README.md

diff --git a/README.md b/README.md
index 057b98ffa2f478377f7e6feed1139a948874a5ca..c005c9df90de9ce881e1c73e8a6edc0b5fb38324 100644 (file)
--- a/README.md
+++ b/README.md
@@ -5,6 +5,8 @@ This project is aimed at providing a flexible, pluggable framework with out-of-t
 ## Caveats
 The following caveats are applicable to the current AAA implementation:
  - The database (H2) used by ODL AAA Authentication store is not-cluster enabled. When deployed in a clustered environment each node contains unique local credentials.
+ - AAA provides two local IdP Realm implementations; TokenAuthRealm and MdsalRealm.  Although the use of both Realms at the same time is possible through Shiro's multi-realm approach, it is considered bad practice to provide two local identity stores.  Thus, users should specify one or the other for $securityManager.realms entry in the aaa-app-config configuration.
+ - The MdsalRealm is not initialized with any Users, Roles, Domains, or Grants.  The ability to add OOB Identity Information is considered separate work, and is targeted for the Oxygen release.
 
 ## Quick Start
 
@@ -50,6 +52,18 @@ The access token can then be used to access protected resources on the controlle
 
     curl -s -H 'Authorization: Bearer d772d85e-34c7-3099-bea5-cfafd3c747cb' http://<controller>:<port>/restconf/operational/opendaylight-inventory:nodes
 
+### Defaults
+
+Although it is poor security practice, AAA's TokenAuthRealm creates some defaults out of the box.  In order to avoid default credentials, please see the aaa-cli-jar module, which allows installers to pre-install identity information.  Due to the fact that OpenDaylight does not have a proper installer project, default credentials become a chicken/egg problem.  The choice to utilize defaults was initially decided to help bootstrap interaction with ODL's restful web services.  AAA's TokenAuthRealm creates:
+* the "sdn" domain
+* the "admin" and "user" roles
+* the "admin" user with "admin" password
+* 2 grants
+  * admin user is granted admin role priveledges on sdn domain
+  * admin user is granted user role priveledges on sdn domain
+
+TokenAuthRealm's H2 file-based database, which stores the identity information, is secured with default credentials "foo"/"bar".  Default credentials on the local file-based database is a smaller concern, since without running an H2 Server instance on the local machine (ODL doesn't by default), the database is only accessible locally (i.e., user in front of keyboard).  However, these credentials can be adjusted too by setting "dbUsername" and "dbPassword" within etc/org.opendaylight.aaa.h2.cfg.
+
 ## Framework Overview
 
 ### Authentication
@@ -58,9 +72,7 @@ AAA supports 2 main authentication use-cases:  *direct* and *federated* authenti
 
 #### Direct
 
-In this use-case, a user presents some credentials (e.g., username/password) directly to the Opendaylight (ODL) controller token endpoint `/oauth2/token` and receives an access token, which then can be used to access protected resources on the controller, similar to the example we saw in the Quickstart section: 
-
-![](https://wiki.opendaylight.org/images/c/cc/Direct_authn.png)
+In this use-case, a user presents some credentials (e.g., username/password) directly to the Opendaylight (ODL) controller token endpoint `/oauth2/token` and receives an access token, which then can be used to access protected resources on the controller, similar to the example we saw in the Quickstart section.
 
 #### Federated