diff --git a/docs-chef-io/content/server/api_chef_server.md b/docs-chef-io/content/server/api_chef_server.md index e57c6d1461..a8114f2ac1 100644 --- a/docs-chef-io/content/server/api_chef_server.md +++ b/docs-chef-io/content/server/api_chef_server.md @@ -862,16 +862,14 @@ The response will return something like the following: ### /users -A user is an individual account that is created to allow access to the Chef Infra Server. For example: - -- A hosted Chef Infra Server account -- The user that operates the workstation from which a Chef Infra Server will be managed +A user is an individual account created to allow access to Chef Infra Server. +For example, a user that operates the workstation or host that Chef Infra Server is managed from. The `/users` endpoint has the following methods: `GET` and `POST`. {{< warning >}} -This endpoint may only be accessed by the `pivotal` user, which is created as part of the installation process for the Chef Infra Server. (See the "Query for Users and Orgs" example below for an example of how to access this endpoint with the `pivotal` user.) +This endpoint may only be accessed by the `pivotal` user, which is created as part of the Chef Infra Server installation process. (See the "Query for Users and Orgs" example below for an example of how to access this endpoint with the `pivotal` user.) {{< /warning >}} diff --git a/docs-chef-io/content/server/auth.md b/docs-chef-io/content/server/auth.md index 411e8e7241..10b840cbf1 100644 --- a/docs-chef-io/content/server/auth.md +++ b/docs-chef-io/content/server/auth.md @@ -30,14 +30,14 @@ gh_repo = "chef-server" #### Knife -RSA public key-pairs are used to authenticate knife with the Chef Infra -Server every time knife attempts to access the Chef Infra Server. This -ensures that each instance of knife is properly registered with the Chef +RSA public key-pairs are used to authenticate knife with Chef Infra +Server every time knife attempts to access Chef Infra Server. This +ensures that each instance of knife is properly registered with Chef Infra Server and that only trusted users can make changes to the data. Knife can also use the `knife exec` subcommand to make specific, -authenticated requests to the Chef Infra Server. knife plugins can also -make authenticated requests to the Chef Infra Server by leveraging the +authenticated requests to Chef Infra Server. knife plugins can also +make authenticated requests to Chef Infra Server by leveraging the `knife exec` subcommand. #### chef-validator @@ -61,9 +61,9 @@ Server. #### Workstations Each workstation stores its private key in the user's `~/.chef` directory. -This private key is generated by the Chef Infra Server and must be download +This private key is generated by Chef Infra Server and must be download from the server and copied to the `~/.chef` directory manually. If you -require a new private key, generate it with the Chef Infra Server and +require a new private key, generate it with Chef Infra Server and copy it to the `~/.chef` directory again. {{< readfile file="content/reusable/md/chef_repo_description.md" >}} @@ -79,20 +79,17 @@ validation key files and optionally a [config.rb]({{< relref "workstation/config {{< readfile file="content/server/reusable/md/plugin_knife_using_authenticated_requests.md" >}} -#### From the Web Interface +#### From Chef Manage -The Chef Infra Server user interface uses the Chef Infra Server API to -perform most operations. This ensures that authentication requests to -the Chef Infra Server are authorized. This authentication process is -handled automatically and is not something that users of the hosted Chef -Infra Server will need to manage. For the on-premises Chef Infra Server, -the authentication keys used by the web interface will need to be -maintained by the individual administrators who are responsible for -managing the server. +Chef Manage, which runs Chef Infra Server's user interface, uses the Chef Infra Server API to perform most operations. +This ensures that authentication requests to Chef Infra Server are authorized. +This authentication process is handled automatically and is not something that users need to manage. +For on-premises Chef Infra Server deployments, +the administrators who are responsible for managing the server must maintain the authentication keys used by Chef Manage. -#### Other Options +#### Other options -The most common ways to interact with the Chef Infra Server using the +The most common ways to interact with Chef Infra Server using the Chef Infra Server API abstract the API from the user. That said, the Chef Infra Server API can be interacted with directly. The following sections describe a few of the ways that are available for doing that. @@ -195,7 +192,7 @@ bash chef_api_request GET "/clients" An API request can be made using PyChef, which is a Python library that meets the `Mixlib::Authentication` requirements so that it can easily -interact with the Chef Infra Server. The following example shows how an +interact with Chef Infra Server. The following example shows how an authenticated request can be made using the Chef Infra Server API and PyChef: @@ -226,7 +223,7 @@ Chef Infra Client or knife. For more about PyChef, see: **Ruby** On a system with Chef Infra Client installed, use Ruby to make an -authenticated request to the Chef Infra Server: +authenticated request to Chef Infra Server: ```ruby require 'chef/config' @@ -328,9 +325,9 @@ ExecuteUserChoice() ``` Another way Ruby can be used with the Chef Infra Server API is to get -objects from the Chef Infra Server, and then interact with the returned +objects from Chef Infra Server, and then interact with the returned data using Ruby methods. Whenever possible, the Chef Infra Server API -will return an object of the relevant type. The returned object is then +returns an object of the relevant type. The returned object is then available to be called by other methods. For example, the `api.get` method can be used to return a node named `foobar`, and then `.destroy` can be used to delete that node: @@ -392,7 +389,7 @@ You can update a user's key pair on Chef Infra Server with knife using either th ### knife user reregister -Use [`knife user reregister`]({{< relref "/workstation/knife_user#reregister" >}}) to regenerate an RSA key pair for a user. Knife will store the public key on the Chef Infra Server and the private key will be displayed in the standard output, or use the `--file` option to write to a named file. +Use [`knife user reregister`]({{< relref "/workstation/knife_user#reregister" >}}) to regenerate an RSA key pair for a user. Knife will store the public key on Chef Infra Server and the private key will be displayed in the standard output, or use the `--file` option to write to a named file. ```sh knife user reregister USERNAME (options) @@ -427,7 +424,7 @@ To update a user's key pair: knife user key create USERNAME --key-name KEYNAME --expiration-date YYYY-MM-DDTHH:MM:SSZ --file FILENAME ``` - Knife will open your text editor with a data file containing the username, key name, and key pair expiration date that will be sent to the Chef Infra Server. + Knife will open your text editor with a data file containing the username, key name, and key pair expiration date that will be sent to Chef Infra Server. Modify the username, key name, and key expiration date to match the new key pair that you are creating, then save the file and close your editor. @@ -471,4 +468,4 @@ For more information about Chef Infra Server Authorization, see ## Chef Infra Server API For more information about using the Chef Infra Server API endpoints see -[Chef Infra Server API]({{< relref "api_chef_server" >}}). +the [Chef Infra Server API]({{< relref "api_chef_server" >}}) documentation. diff --git a/docs-chef-io/content/server/reusable/md/chef_auth_authentication.md b/docs-chef-io/content/server/reusable/md/chef_auth_authentication.md index 3d0c7182da..7acafdc004 100644 --- a/docs-chef-io/content/server/reusable/md/chef_auth_authentication.md +++ b/docs-chef-io/content/server/reusable/md/chef_auth_authentication.md @@ -5,4 +5,4 @@ The authentication process ensures that Chef Infra Server only responds to reque * Chef Workstation saves the private key in `~/.chef/` * Chef Infra Client saves the private key in `/etc/chef` -Both Chef Infra Client and Chef Workstation communicate with the Chef Infra Server using the Chef Infra Server API. Each time that Chef Infra Client or Chef Workstation makes a request to Chef Infra Server, they use a special group of HTTP headers and sign the rest with their private key. The Chef Infra Server then uses the public key to verify the headers and the contents. +Both Chef Infra Client and Chef Workstation communicate with Chef Infra Server using the Chef Infra Server API. Each time that Chef Infra Client or Chef Workstation makes a request to Chef Infra Server, they use a special group of HTTP headers and sign the rest with their private key. Chef Infra Server then uses the public key to verify the headers and contents. diff --git a/docs-chef-io/content/server/reusable/md/ctl_chef_server_summary.md b/docs-chef-io/content/server/reusable/md/ctl_chef_server_summary.md index c57b472b09..e0bd9dba57 100644 --- a/docs-chef-io/content/server/reusable/md/ctl_chef_server_summary.md +++ b/docs-chef-io/content/server/reusable/md/ctl_chef_server_summary.md @@ -1,4 +1,4 @@ -The Chef Infra Server includes a command-line utility named +Chef Infra Server includes a command-line utility named chef-server-ctl. This command-line tool is used to start and stop individual services, reconfigure the Chef Infra Server, run chef-pedant, and then tail Chef Infra Server log files. \ No newline at end of file diff --git a/docs-chef-io/content/server/reusable/md/server_rbac_permissions_object.md b/docs-chef-io/content/server/reusable/md/server_rbac_permissions_object.md index df3cadc7b8..e811b131c2 100644 --- a/docs-chef-io/content/server/reusable/md/server_rbac_permissions_object.md +++ b/docs-chef-io/content/server/reusable/md/server_rbac_permissions_object.md @@ -1,4 +1,4 @@ -The Chef Infra Server includes the following object permissions: +Chef Infra Server includes the following object permissions: | Permission | Description | | --- | --- | diff --git a/docs-chef-io/content/server/server_orgs.md b/docs-chef-io/content/server/server_orgs.md index a23a83378b..d7f1fab532 100644 --- a/docs-chef-io/content/server/server_orgs.md +++ b/docs-chef-io/content/server/server_orgs.md @@ -32,16 +32,16 @@ role-based access control:

image

-An organization is the top-level entity for role-based access control in the Chef Infra Server. Each organization contains the default groups (admins, clients, and users, plus billing_admins for the hosted Chef Infra Server), at least one user and at least one node (on which the Chef Infra Client is installed). The Chef Infra Server supports multiple organizations. The Chef Infra Server includes a single default organization that is defined during setup. Additional organizations can be created after the initial setup and configuration of the Chef Infra Server. +An organization is the top-level entity for role-based access control in the Chef Infra Server. Each organization contains the default groups (admins, clients, and users), at least one user and at least one node (on which the Chef Infra Client is installed). Chef Infra Server supports multiple organizations. Chef Infra Server includes a single default organization that is defined during setup. Additional organizations can be created after the initial setup and configuration of the Chef Infra Server.

image

A group is used to define access to object types and objects in the Chef Infra Server and also to assign permissions that determine what types of tasks are available to members of that group who are authorized to perform them. Groups are configured per-organization.

-

Individual users who are members of a group will inherit the permissions assigned to the group. The Chef Infra Server includes the following default groups: admins, clients, and users. For users of the hosted Chef Infra Server, an additional default group is provided: billing_admins.

+

Individual users who are members of a group will inherit the permissions assigned to the group. Chef Infra Server includes the following default groups: admins, clients, and users.

image

-A user is any non-administrator human being who will manage data that is uploaded to the Chef Infra Server from a workstation or who will log on to the Chef management console web user interface. The Chef Infra Server includes a single default user that is defined during setup and is automatically assigned to the admins group. +A user is any non-administrator human being who will manage data that is uploaded to the Chef Infra Server from a workstation or who will log on to the Chef management console web user interface. Chef Infra Server includes a single default user that is defined during setup and is automatically assigned to the admins group.

image

@@ -103,7 +103,7 @@ when: #### Global Permissions -The Chef Infra Server includes the following global permissions: +Chef Infra Server includes the following global permissions: @@ -189,7 +189,7 @@ the Chef Manage browser interface from that point forward because they are incom ## Groups -The Chef Infra Server includes the following default groups: +Chef Infra Server includes the following default groups:
@@ -208,10 +208,6 @@ The Chef Infra Server includes the following default groups: - - - -
The admins group defines the list of users who have administrative rights to all objects and object types for a single organization.
billing_adminsThe billing_admins group defines the list of users who have permission to manage billing information. This permission exists only for the hosted Chef Infra Server.
clients The clients group defines the list of nodes on which a Chef Infra Client is installed and under management by Chef. In general, think of this permission as "all of the non-human actors---Chef Infra Client, in nearly every case---that get data from, and/or upload data to, the Chef server". Newly-created Chef Infra Client instances are added to this group automatically.