mirror of
https://github.com/qdrant/landing_page.git
synced 2026-10-06 19:38:30 +02:00
Merge pull request #2020 from qdrant/docs-security-jwt-remove-payload
Docs: remove payload filter from JWT
This commit is contained in:
Tim Visée
@@ -118,7 +118,7 @@ There are several different options (claims) you can use in the JWT payload that
|
||||
|
||||
**value_exists**: This claim validates the token against a specific key-value stored in a collection. By using this claim, you can revoke access by simply changing a value without having to invalidate the API key.
|
||||
|
||||
**access**: This claim defines the access level of the token. The access level can be global read (r) or manage (m). It can also be specific to a collection, or even a subset of a collection, using read (r) and read-write (rw).
|
||||
**access**: This claim defines the access level of the token. The access level can be global read (r) or manage (m). It can also be specific to a collection, using read (r) and read-write (rw).
|
||||
|
||||
Let’s look at a few example JWT payload configurations.
|
||||
|
||||
@@ -157,25 +157,6 @@ Suppose you have a ‘users’ collection and have defined specific roles for ea
|
||||
|
||||
Now, if you ever want to revoke access for a user, simply change the value of their role. All future requests will be invalid using a token payload of the above type.
|
||||
|
||||
**Scenario 3: 1-hour expiry time, and read-write access to a subset of a collection**
|
||||
|
||||
You can even specify access levels specific to subsets of a collection. This can be especially useful when you are leveraging [multitenancy](/documentation/guides/multiple-partitions/), and want to segregate access.
|
||||
```json
|
||||
{
|
||||
"exp": 1690995200,
|
||||
"access": [
|
||||
{
|
||||
"collection": "demo_collection",
|
||||
"access": "r",
|
||||
"payload": {
|
||||
"user_id": "user_123456"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
By combining the claims, you can fully customize the access level that a user or a role has within the vector store.
|
||||
|
||||
### Creating Role-Based Access Control (RBAC) Using JWT
|
||||
@@ -191,8 +172,6 @@ In a typical enterprise application, you will have a segregation of users based
|
||||
5. **Developer:** with read-write access to development- or testing-specific collections, but limited access to production data.
|
||||
6. **Guest:** with limited read-only access to publicly available collections.
|
||||
|
||||
In addition, you can create access levels within sections of a collection. In a multi-tenant application, where you have used payload-based partitioning, you can create read-only access for specific user roles for a subset of the collection that belongs to that user.
|
||||
|
||||
Your application requirements will eventually help you decide the roles and access levels you should create. For example, in an application managing customer data, you could create additional roles such as:
|
||||
|
||||
**Customer Support Representative**: read-write access to customer service-related data but no access to billing information.
|
||||
@@ -211,10 +190,7 @@ In such an application, an example JWT payload for a customer support representa
|
||||
"access": [
|
||||
{
|
||||
"collection": "customer_data",
|
||||
"access": "rw",
|
||||
"payload": {
|
||||
"department": "support"
|
||||
}
|
||||
"access": "rw"
|
||||
}
|
||||
],
|
||||
"value_exists": {
|
||||
|
||||
@@ -342,28 +342,6 @@ These are the available options, or **claims** in the JWT lingo. You can use the
|
||||
}
|
||||
```
|
||||
|
||||
You can also specify which subset of the collection the user is able to access by specifying a `payload` restriction that the points must have.
|
||||
|
||||
```json
|
||||
{
|
||||
"access": [
|
||||
{
|
||||
"collection": "my_collection",
|
||||
"access": "r",
|
||||
"payload": {
|
||||
"user_id": "user_123456"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
This `payload` claim will be used to implicitly filter the points in the collection. It will be equivalent to appending this filter to each request:
|
||||
|
||||
```json
|
||||
{ "filter": { "must": [{ "key": "user_id", "match": { "value": "user_123456" } }] } }
|
||||
```
|
||||
|
||||
### Table of access
|
||||
|
||||
Check out this table to see which actions are allowed or denied based on the access level.
|
||||
@@ -372,65 +350,65 @@ This is also applicable to using api keys instead of tokens. In that case, `api_
|
||||
|
||||
<div style="text-align: right"> <strong>Symbols:</strong> ✅ Allowed | ❌ Denied | 🟡 Allowed, but filtered </div>
|
||||
|
||||
| Action | manage | read-only | collection read-write | collection read-only | collection with payload claim (r / rw) |
|
||||
|--------|--------|-----------|----------------------|-----------------------|------------------------------------|
|
||||
| list collections | ✅ | ✅ | 🟡 | 🟡 | 🟡 |
|
||||
| get collection info | ✅ | ✅ | ✅ | ✅ | ❌ |
|
||||
| create collection | ✅ | ❌ | ❌ | ❌ | ❌ |
|
||||
| delete collection | ✅ | ❌ | ❌ | ❌ | ❌ |
|
||||
| update collection params | ✅ | ❌ | ❌ | ❌ | ❌ |
|
||||
| get collection cluster info | ✅ | ✅ | ✅ | ✅ | ❌ |
|
||||
| collection exists | ✅ | ✅ | ✅ | ✅ | ✅ |
|
||||
| update collection cluster setup | ✅ | ❌ | ❌ | ❌ | ❌ |
|
||||
| update aliases | ✅ | ❌ | ❌ | ❌ | ❌ |
|
||||
| list collection aliases | ✅ | ✅ | 🟡 | 🟡 | 🟡 |
|
||||
| list aliases | ✅ | ✅ | 🟡 | 🟡 | 🟡 |
|
||||
| create shard key | ✅ | ❌ | ❌ | ❌ | ❌ |
|
||||
| delete shard key | ✅ | ❌ | ❌ | ❌ | ❌ |
|
||||
| create payload index | ✅ | ❌ | ✅ | ❌ | ❌ |
|
||||
| delete payload index | ✅ | ❌ | ✅ | ❌ | ❌ |
|
||||
| list collection snapshots | ✅ | ✅ | ✅ | ✅ | ❌ |
|
||||
| create collection snapshot | ✅ | ❌ | ✅ | ❌ | ❌ |
|
||||
| delete collection snapshot | ✅ | ❌ | ✅ | ❌ | ❌ |
|
||||
| download collection snapshot | ✅ | ✅ | ✅ | ✅ | ❌ |
|
||||
| upload collection snapshot | ✅ | ❌ | ❌ | ❌ | ❌ |
|
||||
| recover collection snapshot | ✅ | ❌ | ❌ | ❌ | ❌ |
|
||||
| list shard snapshots | ✅ | ✅ | ✅ | ✅ | ❌ |
|
||||
| create shard snapshot | ✅ | ❌ | ✅ | ❌ | ❌ |
|
||||
| delete shard snapshot | ✅ | ❌ | ✅ | ❌ | ❌ |
|
||||
| download shard snapshot | ✅ | ✅ | ✅ | ✅ | ❌ |
|
||||
| upload shard snapshot | ✅ | ❌ | ❌ | ❌ | ❌ |
|
||||
| recover shard snapshot | ✅ | ❌ | ❌ | ❌ | ❌ |
|
||||
| list full snapshots | ✅ | ✅ | ❌ | ❌ | ❌ |
|
||||
| create full snapshot | ✅ | ❌ | ❌ | ❌ | ❌ |
|
||||
| delete full snapshot | ✅ | ❌ | ❌ | ❌ | ❌ |
|
||||
| download full snapshot | ✅ | ✅ | ❌ | ❌ | ❌ |
|
||||
| get cluster info | ✅ | ✅ | ❌ | ❌ | ❌ |
|
||||
| recover raft state | ✅ | ❌ | ❌ | ❌ | ❌ |
|
||||
| delete peer | ✅ | ❌ | ❌ | ❌ | ❌ |
|
||||
| get point | ✅ | ✅ | ✅ | ✅ | ❌ |
|
||||
| get points | ✅ | ✅ | ✅ | ✅ | ❌ |
|
||||
| upsert points | ✅ | ❌ | ✅ | ❌ | ❌ |
|
||||
| update points batch | ✅ | ❌ | ✅ | ❌ | ❌ |
|
||||
| delete points | ✅ | ❌ | ✅ | ❌ | ❌ / 🟡 |
|
||||
| update vectors | ✅ | ❌ | ✅ | ❌ | ❌ |
|
||||
| delete vectors | ✅ | ❌ | ✅ | ❌ | ❌ / 🟡 |
|
||||
| set payload | ✅ | ❌ | ✅ | ❌ | ❌ |
|
||||
| overwrite payload | ✅ | ❌ | ✅ | ❌ | ❌ |
|
||||
| delete payload | ✅ | ❌ | ✅ | ❌ | ❌ |
|
||||
| clear payload | ✅ | ❌ | ✅ | ❌ | ❌ |
|
||||
| scroll points | ✅ | ✅ | ✅ | ✅ | 🟡 |
|
||||
| query points | ✅ | ✅ | ✅ | ✅ | 🟡 |
|
||||
| search points | ✅ | ✅ | ✅ | ✅ | 🟡 |
|
||||
| search groups | ✅ | ✅ | ✅ | ✅ | 🟡 |
|
||||
| recommend points | ✅ | ✅ | ✅ | ✅ | ❌ |
|
||||
| recommend groups | ✅ | ✅ | ✅ | ✅ | ❌ |
|
||||
| discover points | ✅ | ✅ | ✅ | ✅ | ❌ |
|
||||
| count points | ✅ | ✅ | ✅ | ✅ | 🟡 |
|
||||
| version | ✅ | ✅ | ✅ | ✅ | ✅ |
|
||||
| readyz, healthz, livez | ✅ | ✅ | ✅ | ✅ | ✅ |
|
||||
| telemetry | ✅ | ✅ | ❌ | ❌ | ❌ |
|
||||
| metrics | ✅ | ✅ | ❌ | ❌ | ❌ |
|
||||
| Action | manage | read-only | collection read-write | collection read-only |
|
||||
|--------|--------|-----------|----------------------|-----------------------|
|
||||
| list collections | ✅ | ✅ | 🟡 | 🟡 |
|
||||
| get collection info | ✅ | ✅ | ✅ | ✅ |
|
||||
| create collection | ✅ | ❌ | ❌ | ❌ |
|
||||
| delete collection | ✅ | ❌ | ❌ | ❌ |
|
||||
| update collection params | ✅ | ❌ | ❌ | ❌ |
|
||||
| get collection cluster info | ✅ | ✅ | ✅ | ✅ |
|
||||
| collection exists | ✅ | ✅ | ✅ | ✅ |
|
||||
| update collection cluster setup | ✅ | ❌ | ❌ | ❌ |
|
||||
| update aliases | ✅ | ❌ | ❌ | ❌ |
|
||||
| list collection aliases | ✅ | ✅ | 🟡 | 🟡 |
|
||||
| list aliases | ✅ | ✅ | 🟡 | 🟡 |
|
||||
| create shard key | ✅ | ❌ | ❌ | ❌ |
|
||||
| delete shard key | ✅ | ❌ | ❌ | ❌ |
|
||||
| create payload index | ✅ | ❌ | ✅ | ❌ |
|
||||
| delete payload index | ✅ | ❌ | ✅ | ❌ |
|
||||
| list collection snapshots | ✅ | ✅ | ✅ | ✅ |
|
||||
| create collection snapshot | ✅ | ❌ | ✅ | ❌ |
|
||||
| delete collection snapshot | ✅ | ❌ | ✅ | ❌ |
|
||||
| download collection snapshot | ✅ | ✅ | ✅ | ✅ |
|
||||
| upload collection snapshot | ✅ | ❌ | ❌ | ❌ |
|
||||
| recover collection snapshot | ✅ | ❌ | ❌ | ❌ |
|
||||
| list shard snapshots | ✅ | ✅ | ✅ | ✅ |
|
||||
| create shard snapshot | ✅ | ❌ | ✅ | ❌ |
|
||||
| delete shard snapshot | ✅ | ❌ | ✅ | ❌ |
|
||||
| download shard snapshot | ✅ | ✅ | ✅ | ✅ |
|
||||
| upload shard snapshot | ✅ | ❌ | ❌ | ❌ |
|
||||
| recover shard snapshot | ✅ | ❌ | ❌ | ❌ |
|
||||
| list full snapshots | ✅ | ✅ | ❌ | ❌ |
|
||||
| create full snapshot | ✅ | ❌ | ❌ | ❌ |
|
||||
| delete full snapshot | ✅ | ❌ | ❌ | ❌ |
|
||||
| download full snapshot | ✅ | ✅ | ❌ | ❌ |
|
||||
| get cluster info | ✅ | ✅ | ❌ | ❌ |
|
||||
| recover raft state | ✅ | ❌ | ❌ | ❌ |
|
||||
| delete peer | ✅ | ❌ | ❌ | ❌ |
|
||||
| get point | ✅ | ✅ | ✅ | ✅ |
|
||||
| get points | ✅ | ✅ | ✅ | ✅ |
|
||||
| upsert points | ✅ | ❌ | ✅ | ❌ |
|
||||
| update points batch | ✅ | ❌ | ✅ | ❌ |
|
||||
| delete points | ✅ | ❌ | ✅ | ❌ | ❌ /
|
||||
| update vectors | ✅ | ❌ | ✅ | ❌ |
|
||||
| delete vectors | ✅ | ❌ | ✅ | ❌ | ❌ /
|
||||
| set payload | ✅ | ❌ | ✅ | ❌ |
|
||||
| overwrite payload | ✅ | ❌ | ✅ | ❌ |
|
||||
| delete payload | ✅ | ❌ | ✅ | ❌ |
|
||||
| clear payload | ✅ | ❌ | ✅ | ❌ |
|
||||
| scroll points | ✅ | ✅ | ✅ | ✅ |
|
||||
| query points | ✅ | ✅ | ✅ | ✅ |
|
||||
| search points | ✅ | ✅ | ✅ | ✅ |
|
||||
| search groups | ✅ | ✅ | ✅ | ✅ |
|
||||
| recommend points | ✅ | ✅ | ✅ | ✅ |
|
||||
| recommend groups | ✅ | ✅ | ✅ | ✅ |
|
||||
| discover points | ✅ | ✅ | ✅ | ✅ |
|
||||
| count points | ✅ | ✅ | ✅ | ✅ |
|
||||
| version | ✅ | ✅ | ✅ | ✅ |
|
||||
| readyz, healthz, livez | ✅ | ✅ | ✅ | ✅ |
|
||||
| telemetry | ✅ | ✅ | ❌ | ❌ |
|
||||
| metrics | ✅ | ✅ | ❌ | ❌ |
|
||||
|
||||
## TLS
|
||||
|
||||
|
||||
Reference in New Issue
Block a user