Thanks. This makes sense. I got my group creation working using the REST api.

Now here is my question about private groups and wildcard-users. I want a group that authorizes only a few select users (admin, john, and larry).

Your example group public.json looks like this:
{ "op": [{"username": "admin", "password": "password"}], "presenter": [{}], "public": true}

So first (before using the REST api) , I tried to make a private group manually in JSON files like this:

{
"op": [{"username": "admin", "password": "12345"}],
"presenter": [{}],
"description": "This is a private group to test password-based restrictions.",
"displayName": "Private 3",
"users":{"john":{"password":"224715","permissions":"present"},"larry":{"password":"925385","permissions":"present"}}
}

Being non-public, this doesn't appear in the public list of groups. Great.

But, a big problem!

Login [admin/12345] >>> logged in
Login [admin/ anything_else ] >>> "not authorized"
Login [john/224715] >>> logged in
Login [john/ anything_else ] >>> "not authorized"
Login [larry/925385] >>> logged in
Login [larry/ anything_else ] >>> "not authorized"

PROBLEM: Login [anyone_else/anything] >>> logged in

It seems I can only stop anonymous logins by adding a wildcard user with obscure password:
{
"op": [{"username": "admin", "password": "12345"}],
"presenter": [{}],
"description": "This is a private group to test password-based restrictions.",
"displayName": "Private Test Group",
"users":{"john":{"password":"224715","permissions":"present"},"larry":{"password":"925385","permissions":"present"}},
"wildcard-user":{"password":"98579223487","permissions":"present"}
}

Login [admin/12345] >>> logged in
Login [admin/monkey] >>> "not authorized"
Login [rando/98579223487] >>> logged in
Login [rando/anything_else] >>> "not authorized"

What am I doing wrong or do I have the wrong mental model?

-Marty

On Mon, Dec 2, 2024 at 4:08 AM Juliusz Chroboczek <jch@irif.fr> wrote:

Hello,

> In particular I tried to create a group using PUT method with JSON body and it
> works fine for simple groups

Good.

> But if I include a "users" list or a "wildcard-user" value, it fails with a
> "description is not sanitized" error.

Right. That's by design.

> Why is this "sanitized" check existing in UpdateDescription().

The API splits the group description into two parts:

- the "sanitised" group description itself;
- the users' database.

Every user, in turn, is split into two parts:

- the user description;
- the password.

So in order to create a group, you need to make 1 + 2n requests:

- create the group: PUT /api/v0/.groups/groupname
- for every user
- create the user: PUT /api/v0/.groups/groupname/.users/username
- set the password: PUT /api/v0/.groups/groupname/.users/username/.password

You use .wildcard-user for the wildcard user.

The main reason why I've used this organisation is that it makes
fine-grained access control possible: for example, a normal (non-admin)
user is allowed to change their own password, but they're of course not
allowed to change the rest of the group description. Conversely, an admin
is allowed to change the group description, but they're not allowed to GET
a password.

(There are other advantages, but they're less important, so I won't bore
you with them here.)

The main drawback, of course, is that it makes some operations
inefficient. For example, in order to display the list of users together
with their persmissions, you need to do this:

GET /api/v0/.groups/groupname/.users/
for every user
GET /api/v0/.groups/groupname/.users/username

(It also makes the operation non-atomic: if a user is deleted between the
first and the subsequent GET, then you'll unexpectedly get a 404 error.
Oh, well.)

If it becomes a problem in the future, I'll extend the API with operations
over collections, but until we gain more experience with the API, I'd
rather stick to simple operations only.

By the way: the main user of the API right now is the galenectl program,
which you're find in the Galene sources. Feel free to copy-paste code
from there.

I hope this helps,

-- Juliusz Chroboczek