|
| 1 | +# Authentication |
| 2 | + |
| 3 | + |
| 4 | +<details open> |
| 5 | +<summary>Table of Contents</summary> |
| 6 | + |
| 7 | +<!-- toc --> |
| 8 | +- [Authenticators](#authenticators) |
| 9 | +- [Authentication with environment variables](#authentication-with-environment-variables) |
| 10 | + * [IAM API key authentication](#iam-api-key-authentication) |
| 11 | + * [IAM Trusted profile (container) authentication](#iam-trusted-profile-container-authentication) |
| 12 | + * [IAM Trusted profile (VPC) authentication](#iam-trusted-profile-vpc-authentication) |
| 13 | + * [IAM Trusted profile (assume identity) authentication](#iam-trusted-profile-assume-identity-authentication) |
| 14 | + * [Session cookie authentication](#session-cookie-authentication) |
| 15 | + * [Bearer token authentication](#bearer-token-authentication) |
| 16 | + * [Basic authentication](#basic-authentication) |
| 17 | +- [Authentication with external configuration](#authentication-with-external-configuration) |
| 18 | +- [Programmatic authentication](#programmatic-authentication) |
| 19 | +</details> |
| 20 | + |
| 21 | +## Authenticators |
| 22 | + |
| 23 | +This library requires credentials to authenticate with IBM Cloudant. These credentials may be: |
| 24 | +* IBM Cloud IAM credentials (with authentication types `CONTAINER`, `VPC`, `IAMASSUME` and `IAM`) |
| 25 | + * [IBM Cloud account](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-managing-access-for-cloudant#introduction-iam-ai) user, service ID or trusted profile credentials |
| 26 | + that have access granted to the IBM Cloud Cloudant resource instance. |
| 27 | + * [IBM Cloudant service credentials](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-locating-your-service-credentials) generated by the IBM Cloud Cloudant resource instance. |
| 28 | +* Username and password credentials (with authentication types `COUCHDB_SESSION` and `BASIC`) |
| 29 | + * [IBM Cloudant service credentials](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-locating-your-service-credentials) generated for an IBM Cloud Cloudant resource instance not configured as `IAM only`. |
| 30 | + * IBM Cloudant [legacy credentials](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-work-with-your-account#basic-authentication) (username and password) for instances not in IBM Cloud. |
| 31 | + * IBM Cloudant [legacy API keys](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-work-with-your-account#api-keys). |
| 32 | + |
| 33 | +| Authentication type | Recommended for | `AUTH_TYPE` | Description | |
| 34 | +| --- | --- | --- | --- | |
| 35 | +| IAM Trusted Profiles (compute resource [container](https://github.com/IBM/python-sdk-core/blob/main/Authentication.md#container-authentication)) | Cloudant<BR>(SDK running in IBM Cloud IKS) | `CONTAINER` | Obtains a compute resource (CR) token from the container.<BR>Exchanges the CR token for an IAM `access_token`.<BR>Adds an `Authorization` header to each HTTP request with the `access_token` bearer.<BR>Automatically renews the access token when needed. | |
| 36 | +| IAM Trusted Profiles (compute resource [VPC](https://github.com/IBM/python-sdk-core/blob/main/Authentication.md#vpc-instance-authentication)) | Cloudant<BR>(SDK running in IBM Cloud VPC) | `VPC` | Obtains an identity token from the VPC instance metadata.<BR>Exchanges the identity token for an IAM `access_token`.<BR>Adds an `Authorization` header to each HTTP request with the `access_token` bearer.<BR>Automatically renews the access token when needed. | |
| 37 | +| IAM Trusted Profiles ([assume identity](https://github.com/IBM/python-sdk-core/blob/main/Authentication.md#identity-and-access-management-iam-authentication-grant-type-assume)) | Cloudant | `IAMASSUME` | Exchanges an IAM API key for an IAM `access_token` (same as `IAM` auth type).<BR>Uses that initial token to obtain a second `access_token` from IAM with the assumed identity information.<BR>Adds an `Authorization` header to each HTTP request with the `access_token` bearer.<BR>Automatically renews the access token when needed. | |
| 38 | +| [IAM API key](https://github.com/IBM/python-sdk-core/blob/main/Authentication.md#identity-and-access-management-iam-authentication-grant-type-apikey) | Cloudant | `IAM` | Exchanges an IAM API key for an IAM `access_token`.<BR>Adds an `Authorization` header to each HTTP request with the `access_token` bearer.<BR>Automatically renews the access token when needed. | |
| 39 | +| [Session cookie](#session-cookie-authentication) | [Cloudant](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-work-with-your-account#cookie-authentication)<BR>(legacy credentials & instances without IAM)<BR><BR>[Apache CouchDB](https://docs.couchdb.org/en/stable/api/server/authn.html#cookie-authentication) | `COUCHDB_SESSION` | Exchanges credentials with `/_session` endpoint to retrieve a cookie.<BR>Adds `Cookie` header and content to each HTTP request.<BR>Automatically renews session when needed. | |
| 40 | +| [Bearer token](https://github.com/IBM/python-sdk-core/blob/main/Authentication.md#bearer-token-authentication) | [Apache CouchDB](https://docs.couchdb.org/en/stable/api/server/authn.html#jwt-authentication)<BR>(using JWT authentication) | `BEARERTOKEN` | Adds an `Authorization` header to each HTTP request with the bearer token.<BR>No token management or renewal.<BR>Also compatible with IAM access tokens managed independently of the SDK. | |
| 41 | +| [Basic](https://github.com/IBM/python-sdk-core/blob/main/Authentication.md#basic-authentication) | [Apache CouchDB](https://docs.couchdb.org/en/stable/api/server/authn.html#basic-authentication)<BR>(if cookies are not enabled) | `BASIC` | Adds an `Authorization` header to each HTTP request with the base64 encoded basic credentials. | |
| 42 | +| [None](https://github.com/IBM/python-sdk-core/blob/main/Authentication.md#no-auth-authentication) | - | `NOAUTH` | Note that this authentication type only works for operations against a database allowing access for unauthenticated users. | |
| 43 | + |
| 44 | +The default authentication type for the SDK is `CONTAINER` unless supplying `APIKEY` configuration, which changes the default authentication type to `IAM`. |
| 45 | + |
| 46 | +## Authentication with environment variables |
| 47 | + |
| 48 | +The default service name is `CLOUDANT` so these examples use `CLOUDANT_` prefixed names. |
| 49 | + |
| 50 | +Any custom service name prefix is valid, provided it matches the name used to instantiate the SDK client |
| 51 | +and applied to all configuration options. |
| 52 | + |
| 53 | +### IAM API key authentication |
| 54 | + |
| 55 | +For Cloudant *IAM API key authentication*, set the following environmental variables by |
| 56 | +amending the values with your own |
| 57 | +[service credentials](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-locating-your-service-credentials). There is no need to set |
| 58 | +`CLOUDANT_AUTH_TYPE` to `IAM` because it is the default when supplying an `APIKEY`. |
| 59 | + |
| 60 | +```sh |
| 61 | +CLOUDANT_URL=https://~replaceWithYourUniqueHost~.cloudantnosqldb.appdomain.cloud # use your own Cloudant public or private URL |
| 62 | +CLOUDANT_APIKEY=a1b2c3d4e5f6f1g4h7j3k6l9m2p5q8s1t4v7x0z3 # use your own IAM API key |
| 63 | +``` |
| 64 | + |
| 65 | +### IAM Trusted profile (container) authentication |
| 66 | + |
| 67 | +For Cloudant *IAM Trusted profile compute resource container authentication*, set the following environmental variables, |
| 68 | +amending with your own correct values. There is no need to set |
| 69 | +`CLOUDANT_AUTH_TYPE` to `CONTAINER` because it is the default. |
| 70 | + |
| 71 | +```sh |
| 72 | +CLOUDANT_URL=https://~replaceWithYourUniqueHost~.cloudantnosqldb.appdomain.cloud # use your own Cloudant public or private URL |
| 73 | +CLOUDANT_IAM_PROFILE_ID=iam-Profile-00000000-aaaa-4444-bbbb-0123456789ab # use your own IAM profile ID |
| 74 | +``` |
| 75 | + |
| 76 | +Alternatives to `CLOUDANT_IAM_PROFILE_ID`: |
| 77 | +* `CLOUDANT_IAM_PROFILE_NAME` |
| 78 | + |
| 79 | +### IAM Trusted profile (VPC) authentication |
| 80 | + |
| 81 | +For Cloudant *IAM Trusted profile compute resource vpc authentication*, set the following environmental variables, |
| 82 | +amending with your own correct values. |
| 83 | + |
| 84 | +```sh |
| 85 | +CLOUDANT_AUTH_TYPE=VPC |
| 86 | +CLOUDANT_URL=https://~replaceWithYourUniqueHost~.cloudantnosqldb.appdomain.cloud # use your own Cloudant public or private URL |
| 87 | +CLOUDANT_IAM_PROFILE_ID=iam-Profile-00000000-aaaa-4444-bbbb-0123456789ab # use your own IAM profile ID |
| 88 | +``` |
| 89 | + |
| 90 | +Alternatives to `CLOUDANT_IAM_PROFILE_ID`: |
| 91 | +* `CLOUDANT_IAM_PROFILE_CRN` |
| 92 | +* No profile information (uses the default trusted profile linked to the compute resource) |
| 93 | + |
| 94 | +### IAM Trusted profile (assume identity) authentication |
| 95 | + |
| 96 | +For Cloudant *IAM Trusted profile assume authentication*, set the following environmental variables, |
| 97 | +amending with your own correct values. |
| 98 | + |
| 99 | +```sh |
| 100 | +CLOUDANT_AUTH_TYPE=IAMASSUME |
| 101 | +CLOUDANT_URL=https://~replaceWithYourUniqueHost~.cloudantnosqldb.appdomain.cloud # use your own Cloudant public or private URL |
| 102 | +CLOUDANT_IAM_PROFILE_ID=iam-Profile-00000000-aaaa-4444-bbbb-0123456789ab # use your own IAM profile ID |
| 103 | +``` |
| 104 | + |
| 105 | +Alternatives to `CLOUDANT_IAM_PROFILE_ID`: |
| 106 | +* `CLOUDANT_IAM_PROFILE_CRN` |
| 107 | +* `CLOUDANT_IAM_PROFILE_NAME` *and* `CLOUDANT_IAM_ACCOUNT_ID` (ID of the account that contains the named trusted profile) |
| 108 | + |
| 109 | +### Session cookie authentication |
| 110 | + |
| 111 | +For `COUCHDB_SESSION` authentication, set the following environmental variables |
| 112 | +amending with your own [service credentials](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-locating-your-service-credentials). |
| 113 | + |
| 114 | +```sh |
| 115 | +CLOUDANT_AUTH_TYPE=COUCHDB_SESSION |
| 116 | +CLOUDANT_URL=https://~replaceWithYourUniqueHost~.cloudantnosqldb.appdomain.cloud # use your own Cloudant public or private URL |
| 117 | +CLOUDANT_USERNAME=username # replace with your Cloudant legacy username |
| 118 | +CLOUDANT_PASSWORD=password # replace with your Cloudant legacy password or API key (not IAM) |
| 119 | +``` |
| 120 | + |
| 121 | +### Bearer token authentication |
| 122 | + |
| 123 | +Preferably use IAM authentication methods to automatically manage bearer tokens. |
| 124 | + |
| 125 | +For *bearer token authentication*, set the following environmental variables, |
| 126 | +amending with your own correct values. |
| 127 | + |
| 128 | +```sh |
| 129 | +CLOUDANT_AUTH_TYPE=BEARERTOKEN |
| 130 | +CLOUDANT_URL=https://~replaceWithYourUniqueHost~.cloudantnosqldb.appdomain.cloud # use your own Cloudant public or private URL |
| 131 | +CLOUDANT_BEARER_TOKEN=A1b2C3QiOiIyMDE4MDgxNDAwMDAwMDAwMDAwMDBjNzYwNzY2YjYxYjYwYjYwIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiJ1c2VyQGdtYWlsLmNvbSIsImF1ZCI6Imh0dHBzOi8vaWF1LmNsb3VkLmlibS5jb20iLCJpYXQiOjE2ODg4ODg4ODgsImV4cCI6MTY4ODg5MjQ4OCwiaXNzIjoiaHR0cHM6Ly9pYXUuY2xvdWQuaWJtLmNvbSIsInNjb3BlIjpbImNsb3VkLnJlYWRlciJdfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c # replace with your bearer token |
| 132 | +``` |
| 133 | + |
| 134 | +### Basic authentication |
| 135 | + |
| 136 | +Preferably use [session cookie authentication](#session-cookie-authentication) instead. |
| 137 | + |
| 138 | +To use *basic HTTP authentication* set the following environmental variables, |
| 139 | +amending with your own correct values. |
| 140 | + |
| 141 | +```sh |
| 142 | +CLOUDANT_AUTH_TYPE=BASIC |
| 143 | +CLOUDANT_URL=https://~replaceWithYourUniqueHost~.cloudantnosqldb.appdomain.cloud # use your own Cloudant public or private URL |
| 144 | +CLOUDANT_USERNAME=username # replace with your Cloudant legacy username |
| 145 | +CLOUDANT_PASSWORD=password # replace with your Cloudant legacy password or API key (not IAM) |
| 146 | +``` |
| 147 | + |
| 148 | +## Authentication with external configuration |
| 149 | + |
| 150 | +For more information about using an external configuration file, see the related documentation in |
| 151 | +[Cloudant API docs](https://cloud.ibm.com/apidocs/cloudant?code=python#authentication-with-external-configuration), |
| 152 | +or the |
| 153 | +[general SDK usage information](https://github.com/IBM/ibm-cloud-sdk-common#using-external-configuration). |
| 154 | + |
| 155 | +## Programmatic authentication |
| 156 | + |
| 157 | +To learn more about how to use programmatic authentication, see the related |
| 158 | +documentation in the |
| 159 | +[Cloudant API docs](https://cloud.ibm.com/apidocs/cloudant?code=python#programmatic-authentication) |
| 160 | +or in the |
| 161 | +[Python SDK Core document](https://github.com/IBM/python-sdk-core/blob/main/Authentication.md) about authentication. |
0 commit comments