Github user revans2 commented on a diff in the pull request:
https://github.com/apache/storm/pull/2240#discussion_r130439781
--- Diff: docs/SECURITY.md ---
@@ -478,6 +478,35 @@ nimbus.groups:
### DRPC
-Hopefully more on this soon
+
+ Storm provides the Access Control List for the DRPC Authorizer.Users can
see org.apache.storm.security.auth.authorizer.DRPCSimpleACLAuthorizer for more
details.
+
+ There are several DRPC ACL related configurations.
+
+ | YAML Setting | Description |
+ |------------|----------------------|
+ | drpc.authorizer.acl | The class for DRPC ACL. |
+ | drpc.authorizer.acl.filename | File name of the DRPC Authorizer ACL.It
should be set to "drpc-auth-acl.yaml",users can see drpc-auth-acl.yaml.example
for more details. |
+ | drpc.authorizer.acl.strict| Whether the DRPCSimpleAclAuthorizer should
deny requests for operations involving functions that have no explicit ACL
entry. |
--- End diff --
This is kind of confusing, and that is because the config is kind of
confusing. Some configs go in the main storm.yaml
| YAML Setting | Description |
|------------|----------------------|
| drpc.authorizer | A class that will perform authorization for DRPC
operations. Set this to
`org.apache.storm.security.auth.authorizer.DRPCSimpleACLAuthorizer` when using
security. |
| drpc.authorizer.acl.strict | Whether the DRPCSimpleAclAuthorizer should
deny requests for operations involving functions that have no explicit ACL
entry. It is useful to set this to false for staging where users may want to
experiment, but true for production where you want users to be secure. Defaults
to false. |
| drpc.authorizer.acl.filename | This is the name of a file that the ACLs
will be loaded from. It is separate from storm.yaml to allow the file to be
updated without bringing down a DRPC server. Defaults to drpc-auth-acl.yaml |
The file pointed to by `drpc.authorizer.acl.filename` will have only one
config in it `drpc.authorizer.acl` this should be of the form
```yaml
drpc.authorizer.acl:
"functionName1":
"client.users":
- "alice"
- "bob"
"invocation.user": "bob"
```
In this the users `bob` and `alice` as `client.users` are allowed to run
DRPC requests against functionName1, but only `bob` as the `invocation.user` is
allowed to run the topology that actually processes those requests.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at [email protected] or file a JIRA ticket
with INFRA.
---
