lasdf1234 commented on code in PR #11281: URL: https://github.com/apache/gravitino/pull/11281#discussion_r3316823342
########## docs/security/how-to-use-built-in-idp.md: ########## @@ -0,0 +1,249 @@ +--- +title: How to use built-in IDP (local authentication) +slug: /how-to-use-built-in-idp +license: "This software is licensed under the Apache License version 2." +--- + +## Introduction + +Apache Gravitino can store **built-in IDP** (identity provider) users and groups in the relational +metadata store through the `idp-basic` plugin. This gives you a self-contained way to manage +**global** login identities (usernames, password hashes, and group membership) without an external +OAuth server. + +Built-in IDP is aimed at POC, offline, and isolated deployments. It is **not** a replacement for +enterprise IDPs such as Okta, Azure AD, or Keycloak. Use it only where a lightweight local identity +store is acceptable; restrict management APIs to **service admins**, store password hashes only, +and prefer [HTTPS](./security/how-to-use-https.md) when credentials travel over the network. + +This guide describes how to enable and operate the management APIs in `plugins:idp-basic`. For +design background, see +[Design of local authentication support](../design-docs/gravitino-local-authentication.md). For Review Comment: Got remove design doc. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
