security implementation

[xiang90]

Security feedback

• decouple the enable and root user creation
• add root role, so we can have multiple admin users
• doc: /security/user -> /security/users
• add everyone user and role when enabling security, which has all access to key space. the no user:pass falls into everyone.
• prefix matching
• never return error message from store
• security needs to be enabled each time reboot, it returns {"enabled":false} when I check it
• enable after reboot returns {"errorCode":105,"message":"Key already exists","cause":"/2/users/root","index":11}
• delete users/root return {"message":"Can't delete root user; disable security instead."}, but it is not enabled
• password can be empty
• both create/update return 201 created
• return hashed password when updating password
• fix the examples in the rfc
• log the admin operations
• update role fails to work, and returns the old role json as HTTP result

[barakmich]

not an "everyone" user, but a "guest" role

[barakmich]

There may be some error messages from the store, but not the same way

[barakmich]

enable/disable should be fixed, which are some of the bugs mentioned

[xiang90]

Fixed via #2384

[benmccann]

Fixed by what? :-) That's a self-referential link :-)

[barakmich]

@benmccann #2654 -- Typo, with the same first and last numbers.