From 73e1eee63fbcd1fcfdf1502cea9cf0ccad96a498 Mon Sep 17 00:00:00 2001 From: Fred Lifton Date: Tue, 25 Aug 2015 15:17:12 -0700 Subject: [PATCH] Final copy edits to api index and config Revises Sven's latest additions and incorporates review feedback from @Jlhawn. Signed-off-by: Fred Lifton --- api/index.md | 9 ++++++--- configuration.md | 12 +++++------- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/api/index.md b/api/index.md index 2514e2816d..8c69d6a476 100755 --- a/api/index.md +++ b/api/index.md @@ -38,9 +38,12 @@ User owned repositories can only be accessed by the owner and other individual user accounts, i.e., you cannot grant access to a user-owned repository to a team of users in an organization. If a repository requires this level of control, consider moving it within an organization namespace. -Users that have been given the Global "read-only", "read-write", or Managed "admin" -roles using the DTR web admin tool will have that access to all repositories. These -roles can be accessed or modified using the API using the `_global` organization. +When the DTR web admin tool is used to assign users global "read-only", +"read-write", or managed "admin" roles, they will have that access level to all +repositories. You can access and modify these roles with the API, using the +`_global` organization. However, you must have admin access in order to view and +edit the `_global` organization + ### Organization accounts diff --git a/configuration.md b/configuration.md index 8493e8168f..54ff3677dc 100644 --- a/configuration.md +++ b/configuration.md @@ -339,16 +339,14 @@ site. This is not recommended for any use other than testing. ### Managed authentication -With `Managed` authentication, the DTR admin can control users' access by setting username/password pairs. -These users can then be given Global "admin", "read-write" or "read-only" roles, or be assigned -[Organization, Team or User repository roles using the API](/docker-trusted-registry/api/). +With `Managed` authentication, the DTR admin can control users' access by setting username/password pairs. The admin can then [use the API](/docker-trusted-registry/api/) to give these users global "admin", "read-write" or "read-only" privileges while assigning them Organization, Team or User repository access. The "read-only" role can pull all images from the registry, "read-write" can push and pull all images, and the "admin" role can push and pull and also access the web administration UI and metrics dashboard. -When you create users that will be assigned roles via the API, you do not need -to select one of the roles on the DTR web admin UI. +When you create users and assign their roles via the API, you do not need +to assign those users roles using the DTR admin web UI. ![Managed authentication settings page](../assets/admin-settings-authentication-basic.png) @@ -368,8 +366,8 @@ Interval*. User passwords are not transferred during syncing; DTR will defer to > **Note**: LDAP syncing does not create new user accounts or teams in DTR. It > will only manage existing teams that have been specified to sync with LDAP. -> You can use the [DTR APIs](/docker-trusted-registry/api/) -> to create new users and teams from your LDAP server. +> Use the [DTR APIs](/docker-trusted-registry/api/) to create new users and +> teams from your LDAP server. You can configure the "userFilter" to select the set of users that are candidates for each of the "admin", global "read-write", and global "read-only" roles. Unlike "Managed"