Temporary access

A temporary access gives a file role to a user name until a date, on top of the roles it already holds: a contractor for a delivery, support staff for a day. The name can be a local account or an identity brought by a JWT or the authorization service.

[[admin.roles]]
name = "support"
permissions = ["overview", "sessions", "grant"]

[admin.grants]
persist_file = "/var/lib/craft-file-gate/grants.json"   # or backend = "configmap"
max_duration_secs = 604800                              # 7 days

All keys: Reference [admin.grants].

• Who grants: an admin role that holds the grant permission, from the “Temporary access” tab of the console or POST /admin/grants (Authenticating). Any role of [[roles]] can be granted, never an admin role. A reason is mandatory; the grant and its revocation are in the trail (grant_add, grant_revoke).
• The name: the console offers the local accounts and the names that a file door authenticated in the last 7 days, on this instance. A name never seen is accepted with a warning: it opens nothing until someone connects under that name.
• The duration: 1 h, 8 h, 24 h, 48 h, 7 days or an end date, at most max_duration_secs.
• At the end (date reached or revocation): the SFTP sessions the access served and the REST transfers in progress under its mounts are cut, an upload in progress is abandoned; each following REST request is judged without it. A session opened before the grant does not see it.
• Several instances: the access lives in a file or the ConfigMap <release>-access (one of the two with [cluster]), reread every reread_interval_secs; another instance applies it and cuts it at its next reread. Clocks are assumed to be synchronized (NTP).