Skip to content

Commit d45ccb3

Browse files
committed
Adds **Revoking grants from a user** paragraph
Fixes #5152
1 parent ad07f4f commit d45ccb3

File tree

2 files changed

+34
-0
lines changed

2 files changed

+34
-0
lines changed
Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# grant privileges
2+
sampleuser:
3+
password: '123456'
4+
roles: [ writers_space_reader ]
5+
privileges:
6+
- permissions: [ read, write ]
7+
spaces: [ books ]
8+
9+
# take away a privilege:
10+
sampleuser:
11+
password: '123456'
12+
roles: [ writers_space_reader ]
13+
privileges:
14+
- permissions: [ read ]
15+
spaces: [ books ]
16+
17+
# take away all previously granted privileges:
18+
sampleuser:
19+
password: '123456'
20+
roles: [ writers_space_reader ]
21+
privileges: []
22+
# - permissions: [ read ]
23+
# spaces: [ books ]

doc/platform/connections_and_auth/credentials.rst

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,18 @@ In this example, ``sampleuser`` gets privileges to select and modify data in the
8080

8181
You can find the full example here: `credentials <https://github.com/tarantool/doc/tree/latest/doc/code_snippets/snippets/config/instances.enabled/credentials>`_.
8282

83+
.. _configuration_credentials_managing_users_roles_revoking_privileges:
8384

85+
Revoking privileges from a user
86+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
87+
88+
To take a previously granted privilege away, specify the ``permission`` field without the
89+
previously allowed privilege, or with an empty ``privileges`` array. Further options may retain commented-out, if necessary:
90+
91+
.. literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials/revoke.yaml
92+
:language: yaml
93+
:start-at: sampleuser:
94+
:dedent:
8495

8596
.. _configuration_credentials_loading_secrets:
8697

0 commit comments

Comments
 (0)