Introduction
Chef Infra Server is a hub used to configure data. Chef Infra Server cookbooks store policies applied to nodes, and the Chef Infra Client manages the metadata describing each registered node. Nodes seek configuration data from Chef Infra Server via Chef Infra Client. Communication between the Chef Infra Client and the Chef Workstation is monitored and handled by the Chef Infra Server API. Let us discuss how users and clients are managed in Chef Infra Server.
Authentication and Authorisation
Requests received by the Chef Infra Server are authenticated and authorised by Chef Infra Server API and a public key. This ensures that responses are sent only to trusted users and clients. Chef Infra Server uses public key encryption. Private and public keys are created while configuring the Chef Infra server or setting up the Chef Workstation. Chef Infra Server stores the public key, and the private key is stored by the Chef Infra Client and Chef Workstation in ~/.chef/ and /etc/chef, respectively.
Chef Infra Client performs authentication using RSA public key pairs whenever it needs access to data stored on the Chef Infra Server. This prevents a node from accessing restricted data and ensures that only registered nodes are managed.
Key storage
Keys can be stored in a node or workstation. Every node stores its private ley locally. The key is generated as part of the bootstrap process that initialises the Chef Infra Client on the node. A chef-validator performs authentication when Chef Infra Client runs on that node for the first time. For each subsequent run, it uses the generated private key for that client.
A workstation stores its private key in the ~/.chef directory. The Chef Infra Server generates the key and must be manually downloaded from the server and copied to the ~/.chef directory. The exact process is repeated if a new private key is generated. A chef-repo directory stores everything needed to define the infrastructure with Chef Infra on the workstation. This includes cookbooks, data bags and policies. The chef-repo directory must be synchronised with a version control system, and all data must be treated as source code.
The chef and knife commands upload data to the Chef Infra Server from a chef-repo directory. The Chef Infra Client uses the uploaded data to manage the registered nodes and ensure that it applies the right cookbooks, policy files, and settings in the correct order. The .chef directory is a hidden directory that stores validation key files.
API Authentication
A knife plugin is a set of one or more subcommands added to knife to give additional functionality that is not built-in. Knife plugins can authenticate API requests using specific methods, as shown below.
Authentication can also be performed from the web Chef Infra Server user interface. The authentication process is automated and not managed by the users of the hosted Chef Infra Server. The authentication keys used by the web interface are maintained by individual administrators responsible for managing the server.
34+ registered 
