diff options
Diffstat (limited to 'docs/access.md')
| -rw-r--r-- | docs/access.md | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/docs/access.md b/docs/access.md index 909d915..3541efd 100644 --- a/docs/access.md +++ b/docs/access.md @@ -125,9 +125,11 @@ jq -n --arg c "$c" --rawfile s sig '{user: "alice", challenge: $c, signature: $s curl -s -X POST localhost:3000/auth/login/key -H 'Content-Type: application/json' -d @- ``` -A challenge is the node's, signed by it, valid for five minutes, and taken once (the -node remembers which in memory: after a restart, one captured in its five minutes -could be taken once more; it goes over TLS, as passwords do); +A challenge is the node's, signed by it, valid for five minutes (`--challenge-lifetime`), +and taken once (the node remembers which in memory: after a restart, one captured in +its five minutes could be taken once more; it goes over TLS, as passwords do). A user +logs in by key at most 100 times on a node within those minutes +(`--key-logins-per-user`), so one holding a key can't keep the others out; the signature must be by one of the user's keys, as the registry the node holds then says, and the user enabled (`401` if not, saying why). A swarm without a registry has no keys (`409`). |