diff options
Diffstat (limited to 'docs/access.md')
| -rw-r--r-- | docs/access.md | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/docs/access.md b/docs/access.md index 3541efd..5983c7c 100644 --- a/docs/access.md +++ b/docs/access.md @@ -31,7 +31,12 @@ password hashes: every member reads the document). doesn't read is left out, and anything but `false` disables. * **`keys`**: the user's SSH keys, each by a name of its choosing, as an `authorized_keys` line has it (`"laptop": "ssh-ed25519 AAAA…"`; Ed25519 only): what - it signs values with (Values signed by their users, below). + it signs values with (Values signed by their users, below) and logs in with. A user + manages its own, whatever else it may do: `GET /auth/keys`, `PUT /auth/keys/<name>` + with the line, `DELETE /auth/keys/<name>`; under a strict policy, by signing its + entry with only its keys changed (`continuum-signed key-add laptop + ~/.ssh/id_ed25519.pub`, `key-remove laptop`), with a key it holds already. Every + node takes that from the user itself, as from one who may manage users. ## A new swarm |