Authentication
Relevant source files
The following files were used as context for generating this wiki page:
The Authentication module provides the core security infrastructure for the Milvus Rust SDK, enabling secure communication and resource access control. It implements Basic Authentication via gRPC interceptors and provides a comprehensive suite of management tools for users, roles, and fine-grained privileges.
The system is built on a Role-Based Access Control (RBAC) model. It allows administrators to define users, assign them to roles, and grant those roles specific permissions over global resources, databases, or individual collections. Security is enhanced through Base64 encoding of credentials during transmission and the use of gRPC metadata for token-based request authorization.
Sources: src/authentication.rs:1-15, src/client.rs:43-62
Client Connection and Interception
Authentication begins at the client level. The Client uses an AuthInterceptor to inject authorization headers into every gRPC request. This interceptor handles the storage and application of a Base64-encoded authentication token derived from the provided username and password.
Connection Flow
When a Client is built using the ClientBuilder, credentials are processed into a token format (username:password encoded in Base64). This token is then stored in the AuthInterceptor, which is part of a CombinedInterceptor that manages both authentication and database context.
Sources: src/client.rs:105-156, src/client.rs:43-57
User Management
The SDK provides methods to manage the lifecycle of user credentials within the Milvus system. Users are the primary entities that hold credentials for authentication.
| Method | Purpose | Key Request Object |
|---|---|---|
create_user | Registers a new user with a password | CreateCredentialRequest |
drop_user | Removes a user and their associated role bindings | DeleteCredentialRequest |
list_users | Retrieves all registered usernames | ListCredUsersRequest |
update_password | Securely updates an existing user's password | UpdateCredentialRequest |
describe_user | Returns user details and assigned roles | SelectUserRequest |
The describe_user method returns a mapping of usernames to their assigned roles, allowing for verification of the RBAC hierarchy.
Sources: src/authentication.rs:52-166, src/proto/milvus.proto.milvus.rs:887-915
Role-Based Access Control (RBAC)
RBAC allows for efficient permission management by grouping privileges into roles and assigning those roles to users.
Role Lifecycle
Roles can be created and deleted independently of users. The SDK supports "force dropping" a role, which removes it even if it is currently assigned to users.
Key Data Structures
The following protobuf messages define the RBAC entities:
- RoleEntity: Contains the
nameof the role. - UserEntity: Contains the
nameof the user. - GrantEntity: Connects a role to an object (Collection/Global) and a specific privilege.
Sources: src/proto/milvus.proto.milvus.rs:921-930, src/proto/milvus.proto.milvus.rs:1020-1033
Privilege Management
Privileges define what actions a role can perform on specific Milvus objects. The SDK supports two versions of the privilege API:
- V1 API: A legacy API requiring explicit object types (e.g., "Global", "Collection") and object names.
- V2 API: A newer, collection-focused API that simplifies granting permissions on specific collections.
Privilege Groups
To further simplify management, privileges can be bundled into "Privilege Groups". This allows multiple related permissions (like "Load" and "Get") to be managed as a single unit.
| Feature | Operations | Source File |
|---|---|---|
| Privilege Group | create, drop, list, add_privilege, revoke_privilege | src/authentication.rs:356-425 |
| V1 Privilege | grant_privilege, revoke_privilege | src/authentication.rs:545-654 |
| V2 Privilege | grant_privilege_v2, revoke_privilege_v2 | src/authentication.rs:493-705 |
Security Implementation Details
Credential Transmission
Passwords are not sent in plain text. The SDK encodes passwords using the base64::engine::general_purpose::STANDARD engine before inclusion in the gRPC request.
Sources: src/authentication.rs:65, src/client.rs:136
Error Handling
The authentication module uses status_to_result to convert server responses into Rust Result types. Common authentication-related errors defined in the protocol include:
PermissionDenied(3)CreateCredentialFailure(29)UpdateCredentialFailure(30)DeleteCredentialFailure(31)
Sources: src/proto/milvus.proto.common.rs:197-233, src/authentication.rs:71
Conclusion
The Authentication system in the Milvus Rust SDK provides a robust framework for securing vector database operations. By integrating gRPC interceptors for seamless token injection and offering a comprehensive API for RBAC management, it enables developers to implement secure, multi-tenant applications with granular control over users, roles, and resource privileges.