GEODE-2924 Revise authorization permissions
For finer-grained security, identify new targets for CLUSTER
operations (DISK, GATEWAY, QUERY, JAR, LUCENE). And, revise 4
operations listed in this ticket.
This closes #660
Project: http://git-wip-us.apache.org/repos/asf/geode/repo
Commit: http://git-wip-us.apache.org/repos/asf/geode/commit/0b4a1a23
Tree: http://git-wip-us.apache.org/repos/asf/geode/tree/0b4a1a23
Diff: http://git-wip-us.apache.org/repos/asf/geode/diff/0b4a1a23
Branch: refs/heads/feature/GEM-1483
Commit: 0b4a1a23900d93125e9b9286aa91d170a89f3353
Parents: acf0668
Author: Karen Miller <[email protected]>
Authored: Thu Jul 27 10:28:33 2017 -0700
Committer: Karen Miller <[email protected]>
Committed: Fri Jul 28 09:35:17 2017 -0700
----------------------------------------------------------------------
.../implementing_authorization.html.md.erb | 21 +++++++++++++++-----
1 file changed, 16 insertions(+), 5 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/geode/blob/0b4a1a23/geode-docs/managing/security/implementing_authorization.html.md.erb
----------------------------------------------------------------------
diff --git
a/geode-docs/managing/security/implementing_authorization.html.md.erb
b/geode-docs/managing/security/implementing_authorization.html.md.erb
index d16280e..9fb55d3 100644
--- a/geode-docs/managing/security/implementing_authorization.html.md.erb
+++ b/geode-docs/managing/security/implementing_authorization.html.md.erb
@@ -56,13 +56,24 @@ which classifies whether the operation as
The operations are not hierarchical;
`MANAGE` does not imply `WRITE`, and `WRITE` does not imply `READ`.
-Some operations further specify a region name in the permission.
+Some `DATA` operations further specify a region name in the permission.
This permits restricting operations on that region to only those
authorized principals.
And within a region, some operations may specify a key.
This permits restricting operations on that key within that region to
only those authorized principals.
+Some `CLUSTER` operations further specify a finer-grained
+target for the operation.
+Specify the target with a string value of:
+
+- `DISK` to target operations that write to a disk store
+- `GATEWAY` to target operations that manage gateway senders and receivers
+- `QUERY` to target operations that manage both indexes and continuous
+ queries
+- `JAR` to target operations that deploy code to servers
+- `LUCENE` to target Lucene index operations
+
This table classifies the permissions assigned for operations common to
a Client-Server interaction.
@@ -110,7 +121,7 @@ This table classifies the permissions assigned for `gfsh`
operations.
| close durable-cq | DATA:MANAGE |
| compact disk-store | DATA:MANAGE |
| compact offline-disk-store | DATA:MANAGE |
-| configure pdx | DATA:MANAGE |
+| configure pdx | CLUSTER:MANAGE |
| create async-event-queue | DATA:MANAGE |
| create defined indexes | DATA:MANAGE |
| create disk-store | DATA:MANAGE |
@@ -146,7 +157,7 @@ This table classifies the permissions assigned for `gfsh`
operations.
| gc | CLUSTER:MANAGE |
| get ‑key=key1 ‑region=region1 | DATA:READ:RegionName:Key
|
| import data | DATA:WRITE:RegionName |
-| import cluster-configuration | DATA:MANAGE |
+| import cluster-configuration | CLUSTER:MANAGE |
| list async-event-queues | CLUSTER:READ |
| list clients | CLUSTER:READ |
| list deployed | CLUSTER:READ |
@@ -157,7 +168,7 @@ This table classifies the permissions assigned for `gfsh`
operations.
| list indexes | CLUSTER:READ |
| list lucene indexes | CLUSTER:READ |
| list members | CLUSTER:READ |
-| list regions | DATA:READ |
+| list regions | CLUSTER:READ |
| load-balance gateway-sender | DATA:MANAGE |
| locate entry | DATA:READ:RegionName:Key |
| netstat | CLUSTER:READ |
@@ -247,7 +258,7 @@ This table classifies the permissions assigned for JMX
operations.
| GatewaySenderMXBean.resume | DATA:MANAGE |
| GatewaySenderMXBean.start | DATA:MANAGE |
| GatewaySenderMXBean.stop | DATA:MANAGE |
-| LockServiceMXBean.becomeLockGrantor | DATA:MANAGE |
+| LockServiceMXBean.becomeLockGrantor | CLUSTER:MANAGE |
| MemberMXBean.compactAllDiskStores | DATA:MANAGE |
## Implement Authorization
