2018-10-24 14:24:29 +00:00
|
|
|
---
|
|
|
|
|
layout: "docs"
|
|
|
|
|
page_title: "Commands: ACL Token Management"
|
|
|
|
|
sidebar_current: "docs-commands-acl-token"
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
# Consul ACL Tokens
|
|
|
|
|
|
|
|
|
|
Command: `consul acl token`
|
|
|
|
|
|
|
|
|
|
The `acl token` command is used to manage Consul's ACL tokens. There are
|
|
|
|
|
subcommands for the individual operations that can be performed.
|
|
|
|
|
|
|
|
|
|
* [`create`](#create)
|
|
|
|
|
* [`clone`](#clone)
|
|
|
|
|
* [`read`](#read)
|
|
|
|
|
* [`update`](#update)
|
|
|
|
|
* [`delete`](#delete)
|
|
|
|
|
* [`list`](#list)
|
|
|
|
|
|
|
|
|
|
ACL tokens are also accessible via the [HTTP API](/api/acl.html).
|
|
|
|
|
|
|
|
|
|
Usage: `consul acl token <subcommand> [options] [args]`
|
|
|
|
|
|
|
|
|
|
-> **Note:** All of the examples show for the subcommands will require a valid Consul token with the appropriate permissions.
|
|
|
|
|
Either set the `CONSUL_HTTP_TOKEN` environment variable to the tokens secret ID or pass the secret ID as the value of the `-token`
|
|
|
|
|
parameter.
|
|
|
|
|
|
|
|
|
|
## Identitying Tokens
|
|
|
|
|
|
|
|
|
|
In several of the subcommands a token will have to be identified to be read, modified or deleted. Those subcommands support
|
|
|
|
|
specifying the token by its ID using the `-id` parameter. The ID may be specified as a unique UUID prefix instead of the entire
|
|
|
|
|
UUID. As long as it is unique it will be resolve to the full UUID and used. Additionally builtin token names will be accepted as
|
|
|
|
|
the value of the `-id`.
|
|
|
|
|
|
|
|
|
|
Builtin Policies:
|
|
|
|
|
|
|
|
|
|
| Token UUID | Token Name |
|
|
|
|
|
| ------------------------------------ | ----------------- |
|
|
|
|
|
| 00000000-0000-0000-0000-000000000002 | anonymous |
|
|
|
|
|
|
|
|
|
|
## Common Subcommand Options
|
|
|
|
|
|
|
|
|
|
All of the `consul acl token` subcommands support the following options:
|
|
|
|
|
|
|
|
|
|
<%= partial "docs/commands/http_api_options_client" %>
|
|
|
|
|
<%= partial "docs/commands/http_api_options_server" %>
|
|
|
|
|
|
|
|
|
|
## `create`
|
|
|
|
|
|
|
|
|
|
Command: `consul acl token create`
|
|
|
|
|
|
|
|
|
|
This command creates new tokens. When creating a new token, policies may be linked using
|
|
|
|
|
either the `-policy-id` or the `-policy-name options. When specifying policies by IDs you
|
|
|
|
|
may use a unique prefix of the UUID as a shortcut for specifying the entire UUID.
|
|
|
|
|
|
|
|
|
|
### Usage
|
|
|
|
|
|
|
|
|
|
#### Options
|
|
|
|
|
|
|
|
|
|
* [Common Subcommand Options](#common-subcommand-options)
|
|
|
|
|
|
|
|
|
|
* `-description=<string>` - A description of the token.
|
|
|
|
|
|
|
|
|
|
* `-local` - Create this as a datacenter local token.
|
|
|
|
|
|
|
|
|
|
* `-policy-id=<value>` - ID of a policy to use for this token. May be specified multiple times.
|
|
|
|
|
|
|
|
|
|
* `-policy-name=<value>` - Name of a policy to use for this token. May be specified multiple times.
|
|
|
|
|
|
|
|
|
|
* `-meta` - Indicates that token metadata such as the content hash and raft indices should be shown
|
|
|
|
|
for each entry.
|
|
|
|
|
|
|
|
|
|
### Examples
|
|
|
|
|
|
|
|
|
|
Create a new token:
|
|
|
|
|
|
|
|
|
|
```sh
|
|
|
|
|
$ consul acl token create -description "Read Nodes and Services" -policy-id 06acc965
|
|
|
|
|
AccessorID: 986193b5-e2b5-eb26-6264-b524ea60cc6d
|
|
|
|
|
SecretID: ec15675e-2999-d789-832e-8c4794daa8d7
|
|
|
|
|
Description: Read Nodes and Services
|
|
|
|
|
Local: false
|
|
|
|
|
Create Time: 2018-10-22 15:33:39.01789 -0400 EDT
|
|
|
|
|
Policies:
|
|
|
|
|
06acc965-df4b-5a99-58cb-3250930c6324 - node-services-read
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
Create a new local token:
|
|
|
|
|
|
|
|
|
|
```sh
|
|
|
|
|
$ consul acl token create -description "Read Nodes and Services" -policy-id 06acc965 -local
|
|
|
|
|
AccessorID: 4fdf0ec8-d251-3865-079c-7247c974fc50
|
|
|
|
|
SecretID: 02143514-abf2-6c23-0aa1-ec2107e68f6b
|
|
|
|
|
Description: Read Nodes and Services
|
|
|
|
|
Local: true
|
|
|
|
|
Create Time: 2018-10-22 15:34:19.330265 -0400 EDT
|
|
|
|
|
Policies:
|
|
|
|
|
06acc965-df4b-5a99-58cb-3250930c6324 - node-services-read
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
Create a new policy and link with policies by name:
|
|
|
|
|
|
|
|
|
|
```sh
|
|
|
|
|
$ consul acl token create -description "Super User" -policy-name global-management
|
|
|
|
|
AccessorID: 59f86a9b-d3b6-166c-32a0-be4ab3f94caa
|
|
|
|
|
SecretID: ada7f751-f654-8872-7f93-498e799158b6
|
|
|
|
|
Description: Super User
|
|
|
|
|
Local: false
|
|
|
|
|
Create Time: 2018-10-22 15:35:28.787003 -0400 EDT
|
|
|
|
|
Policies:
|
|
|
|
|
00000000-0000-0000-0000-000000000001 - global-management
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## `clone`
|
|
|
|
|
|
|
|
|
|
Command: `consul acl token clone`
|
|
|
|
|
|
|
|
|
|
This command clones an existing token.
|
|
|
|
|
|
|
|
|
|
### Usage
|
|
|
|
|
|
|
|
|
|
Usage: `consul acl token clone [options]
|
|
|
|
|
|
|
|
|
|
#### Options
|
|
|
|
|
|
|
|
|
|
* [Common Subcommand Options](#common-subcommand-options)
|
|
|
|
|
|
|
|
|
|
* `-description=<string>` - A description of the new cloned token.
|
|
|
|
|
|
|
|
|
|
* `-id=<string>` - The Accessor ID of the token to clone. It may be specified
|
|
|
|
|
as a unique ID prefix but will error if the prefix matches multiple token
|
|
|
|
|
Accessor IDs. The special value of 'anonymous' may be provided instead of
|
|
|
|
|
the anonymous tokens accessor ID
|
|
|
|
|
|
|
|
|
|
### Examples
|
|
|
|
|
|
|
|
|
|
Clone a token:
|
|
|
|
|
|
|
|
|
|
```sh
|
|
|
|
|
$ consul acl token clone -id 59f8 -description "Clone of Super User"
|
|
|
|
|
Token cloned successfully.
|
|
|
|
|
AccessorID: dcfa52ed-9288-b3ff-056d-255ef69d2d88
|
|
|
|
|
SecretID: 0005d17e-5bb2-7e8b-7bfa-15f2eee9ad14
|
|
|
|
|
Description: Clone of Super User
|
|
|
|
|
Local: false
|
|
|
|
|
Create Time: 2018-10-22 16:26:02.909096 -0400 EDT
|
|
|
|
|
Policies:
|
|
|
|
|
00000000-0000-0000-0000-000000000001 - global-management
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## `read`
|
|
|
|
|
|
|
|
|
|
Command: `consul acl token read`
|
|
|
|
|
|
|
|
|
|
This command reads and displays a token details.
|
|
|
|
|
|
|
|
|
|
### Usage
|
|
|
|
|
|
|
|
|
|
Usage: `consul acl token read [options] [args]`
|
|
|
|
|
|
|
|
|
|
#### Options
|
|
|
|
|
|
|
|
|
|
* [Common Subcommand Options](#common-subcommand-options)
|
|
|
|
|
|
|
|
|
|
* `-id=<string>` - The ID of the policy to read. It may be specified as a unique ID
|
|
|
|
|
prefix but will error if the prefix matches multiple policy IDs.
|
|
|
|
|
|
|
|
|
|
* `-meta` - Indicates that policy metadata such as the content hash and raft
|
2018-11-02 17:00:39 +00:00
|
|
|
indices should be shown for each entry.
|
2018-10-24 14:24:29 +00:00
|
|
|
|
|
|
|
|
* `-name=<string>` - The name of the policy to read.
|
|
|
|
|
|
|
|
|
|
* `-self` - Indicates that the current HTTP token should be read by secret ID
|
|
|
|
|
instead of expecting a -id option.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### Examples
|
|
|
|
|
|
|
|
|
|
Get token details:
|
|
|
|
|
|
|
|
|
|
```sh
|
|
|
|
|
$ consul acl token read -id 986
|
|
|
|
|
AccessorID: 986193b5-e2b5-eb26-6264-b524ea60cc6d
|
|
|
|
|
SecretID: ec15675e-2999-d789-832e-8c4794daa8d7
|
|
|
|
|
Description: Read Nodes and Services
|
|
|
|
|
Local: false
|
|
|
|
|
Create Time: 2018-10-22 15:33:39.01789 -0400 EDT
|
|
|
|
|
Policies:
|
|
|
|
|
06acc965-df4b-5a99-58cb-3250930c6324 - node-services-read
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
Get token details using the token secret ID:
|
|
|
|
|
|
|
|
|
|
```sh
|
|
|
|
|
$consul acl token read -self
|
|
|
|
|
AccessorID: 4d123dff-f460-73c3-02c4-8dd64d136e01
|
|
|
|
|
SecretID: 86cddfb9-2760-d947-358d-a2811156bf31
|
|
|
|
|
Description: Bootstrap Token (Global Management)
|
|
|
|
|
Local: false
|
|
|
|
|
Create Time: 2018-10-22 11:27:04.479026 -0400 EDT
|
|
|
|
|
Policies:
|
|
|
|
|
00000000-0000-0000-0000-000000000001 - global-management
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
Get token details (Builtin Tokens)
|
|
|
|
|
|
|
|
|
|
```sh
|
|
|
|
|
$ consul acl token read -id anonymous
|
|
|
|
|
AccessorID: 00000000-0000-0000-0000-000000000002
|
|
|
|
|
SecretID: anonymous
|
|
|
|
|
Description: Anonymous Token
|
|
|
|
|
Local: false
|
|
|
|
|
Create Time: 0001-01-01 00:00:00 +0000 UTC
|
|
|
|
|
Policies:
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## `update`
|
|
|
|
|
|
|
|
|
|
Command: `consul acl token update`
|
|
|
|
|
|
|
|
|
|
This command will update a token. Some parts of the token like whether the
|
|
|
|
|
token is local to the datacenter cannot be changed.
|
|
|
|
|
|
|
|
|
|
### Usage
|
|
|
|
|
|
|
|
|
|
Usage: `consul acl token update [options]`
|
|
|
|
|
|
|
|
|
|
#### Options
|
|
|
|
|
|
|
|
|
|
* [Common Subcommand Options](#common-subcommand-options)
|
|
|
|
|
|
|
|
|
|
* `-description=<string>` - A description of the token
|
|
|
|
|
|
|
|
|
|
* `-id=<string>` - The Accessor ID of the token to read. It may be specified as a
|
|
|
|
|
unique ID prefix but will error if the prefix matches multiple token Accessor IDs
|
|
|
|
|
|
|
|
|
|
* `-merge-policies` - Merge the new policies with the existing policies
|
|
|
|
|
|
|
|
|
|
* `-meta` - Indicates that token metadata such as the content hash and Raft indices should be
|
|
|
|
|
shown for each entry.
|
|
|
|
|
|
|
|
|
|
* `-policy-id=<value>` - ID of a policy to use for this token. May be specified multiple times.
|
|
|
|
|
|
|
|
|
|
* `-policy-name=<value>` - Name of a policy to use for this token. May be specified multiple times.
|
|
|
|
|
|
|
|
|
|
### Examples
|
|
|
|
|
|
|
|
|
|
Update the anonymous token:
|
|
|
|
|
|
|
|
|
|
```sh
|
|
|
|
|
$ consul acl token update -id anonymous -policy-id 06acc
|
|
|
|
|
Token updated successfully.
|
|
|
|
|
AccessorID: 00000000-0000-0000-0000-000000000002
|
|
|
|
|
SecretID: anonymous
|
|
|
|
|
Description: Anonymous Token
|
|
|
|
|
Local: false
|
|
|
|
|
Create Time: 0001-01-01 00:00:00 +0000 UTC
|
|
|
|
|
Policies:
|
|
|
|
|
06acc965-df4b-5a99-58cb-3250930c6324 - node-services-read
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
Update a token description and take the policies from the existing token:
|
|
|
|
|
|
|
|
|
|
```sh
|
|
|
|
|
$ consul acl token update -id 986193 -description "WonderToken" -merge-policies
|
|
|
|
|
Token updated successfully.
|
|
|
|
|
AccessorID: 986193b5-e2b5-eb26-6264-b524ea60cc6d
|
|
|
|
|
SecretID: ec15675e-2999-d789-832e-8c4794daa8d7
|
|
|
|
|
Description: WonderToken
|
|
|
|
|
Local: false
|
|
|
|
|
Create Time: 2018-10-22 15:33:39.01789 -0400 EDT
|
|
|
|
|
Policies:
|
|
|
|
|
06acc965-df4b-5a99-58cb-3250930c6324 - node-services-read
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## `delete`
|
|
|
|
|
|
|
|
|
|
Command: `consul acl token delete`
|
|
|
|
|
|
|
|
|
|
This command deletes a token.
|
|
|
|
|
|
|
|
|
|
### Usage
|
|
|
|
|
|
|
|
|
|
Usage: `consul acl token delete [options]`
|
|
|
|
|
|
|
|
|
|
#### Options
|
|
|
|
|
|
|
|
|
|
* [Common Subcommand Options](#common-subcommand-options)
|
|
|
|
|
|
|
|
|
|
* `-id=<string>` - The ID of the token to delete. It may be specified as a
|
|
|
|
|
unique ID prefix but will error if the prefix matches multiple token IDs.
|
|
|
|
|
|
|
|
|
|
### Examples
|
|
|
|
|
|
|
|
|
|
Delete a token:
|
|
|
|
|
|
|
|
|
|
```sh
|
|
|
|
|
$ consul acl token delete -id 35b8
|
|
|
|
|
Token "35b8ecb0-707c-ee18-2002-81b238b54b38" deleted successfully
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## `list`
|
|
|
|
|
|
|
|
|
|
Command: `consul acl token list`
|
|
|
|
|
|
|
|
|
|
This command lists all tokens. By default it will not show metadata.
|
|
|
|
|
|
|
|
|
|
### Usage
|
|
|
|
|
|
|
|
|
|
Usage: `consul acl token list`
|
|
|
|
|
|
|
|
|
|
#### Options
|
|
|
|
|
|
|
|
|
|
* [Common Subcommand Options](#common-subcommand-options)
|
|
|
|
|
|
|
|
|
|
* `-meta` - Indicates that token metadata such as the content hash and
|
|
|
|
|
Raft indices should be shown for each entry.
|
|
|
|
|
|
|
|
|
|
### Examples
|
|
|
|
|
|
|
|
|
|
Default listing.
|
|
|
|
|
|
|
|
|
|
```sh
|
|
|
|
|
$ consul acl token list
|
|
|
|
|
AccessorID: 4d123dff-f460-73c3-02c4-8dd64d136e01
|
|
|
|
|
Description: Bootstrap Token (Global Management)
|
|
|
|
|
Local: false
|
|
|
|
|
Create Time: 2018-10-22 11:27:04.479026 -0400 EDT
|
|
|
|
|
Legacy: false
|
|
|
|
|
Policies:
|
|
|
|
|
00000000-0000-0000-0000-000000000001 - global-management
|
|
|
|
|
|
|
|
|
|
AccessorID: 59f86a9b-d3b6-166c-32a0-be4ab3f94caa
|
|
|
|
|
Description: Super User
|
|
|
|
|
Local: false
|
|
|
|
|
Create Time: 2018-10-22 15:35:28.787003 -0400 EDT
|
|
|
|
|
Legacy: false
|
|
|
|
|
Policies:
|
|
|
|
|
00000000-0000-0000-0000-000000000001 - global-management
|
|
|
|
|
|
|
|
|
|
AccessorID: 00000000-0000-0000-0000-000000000002
|
|
|
|
|
Description: Anonymous Token
|
|
|
|
|
Local: false
|
|
|
|
|
Create Time: 0001-01-01 00:00:00 +0000 UTC
|
|
|
|
|
Legacy: false
|
|
|
|
|
Policies:
|
|
|
|
|
06acc965-df4b-5a99-58cb-3250930c6324 - node-services-read
|
|
|
|
|
|
|
|
|
|
AccessorID: 986193b5-e2b5-eb26-6264-b524ea60cc6d
|
|
|
|
|
Description: WonderToken
|
|
|
|
|
Local: false
|
|
|
|
|
Create Time: 2018-10-22 15:33:39.01789 -0400 EDT
|
|
|
|
|
Legacy: false
|
|
|
|
|
Policies:
|
|
|
|
|
06acc965-df4b-5a99-58cb-3250930c6324 - node-services-read
|
|
|
|
|
```
|
