43 lines
1.5 KiB
Markdown
43 lines
1.5 KiB
Markdown
# Token Authentication
|
|
## Supported version
|
|
7.0.0+
|
|
|
|
## Why do we need token authentication after TLS?
|
|
TLS is about transport security, which makes sure that a network can be trusted.
|
|
On the other hand, token authentication is about monitoring **whether application data can be trusted**.
|
|
|
|
## Token
|
|
In the current version, token is considered a simple string.
|
|
|
|
### Set Token
|
|
1. Set token in agent.config file
|
|
```properties
|
|
# Authentication active is based on backend setting, see application.yml for more details.
|
|
agent.authentication = ${SW_AGENT_AUTHENTICATION:xxxx}
|
|
```
|
|
|
|
2. Set token in `application.yml` file
|
|
```yaml
|
|
······
|
|
receiver-sharing-server:
|
|
default:
|
|
authentication: ${SW_AUTHENTICATION:""}
|
|
······
|
|
```
|
|
|
|
## Authentication failure
|
|
The Skywalking OAP verifies every request from the agent, and only allows requests whose token matches the one configured in `application.yml` to pass through.
|
|
|
|
If the token does not match, you will see the following log in the agent:
|
|
```
|
|
org.apache.skywalking.apm.dependencies.io.grpc.StatusRuntimeException: PERMISSION_DENIED
|
|
```
|
|
|
|
## FAQ
|
|
### Can I use token authentication instead of TLS?
|
|
No, you shouldn't. Of course it's technically possible, but token and TLS are used for untrusted network environments. In these circumstances,
|
|
TLS has a higher priority. Tokens can be trusted only under TLS protection, and they can be easily stolen if sent through a non-TLS network.
|
|
|
|
### Do you support other authentication mechanisms, such as ak/sk?
|
|
Not for now. But we welcome contributions on this feature.
|