Hello Andrea,
I completely agree with your counterproposal. It solves some practical
problems for me and makes it easier to understand for users. My mistake
was that I saw service security as something completely separate from
r/w/a security, but it is not.
I will modify the proposal.
Thanks.
Kind Regards
Niels
On 22-01-15 12:08, Andrea Aime wrote:
On Tue, Jan 20, 2015 at 3:53 PM, Niels Charlier <ni...@scitus.be
<mailto:ni...@scitus.be>> wrote:
Hello Group,
There has been a request to allow a basic combination of layer and
service security in the integrated geoserver security subsystem.
I have made a proposal to that end:
https://github.com/geoserver/geoserver/wiki/GSIP-125---Layer-with-Service-Security
I'm very concerned about the suggested syntax and the mixing rules
interpretations,
the current design is significantly simpler and should not be broken.
The current rules use a simple "most specific rule wins" approach,
which can and
should be maintained.
The syntax should be:
workspace.layer[.service.request].r/w/a
The r/w/a should be maintained as knowing the request service and
request tells
you if the action is read/write/admin only in the common cases, but
won't work
for WPS processes, which can do pretty much all three operations inside.
So if someone writes something like this:
topp.states.r=ROLE_RESTRICTED
topp.states.wms.GetCapabilities.r=*
topp.states.wms.GetMap.r=*
It would mean that reading the topp:states layer is normally not
allowed, unless
one is using WMS GetCapabilities/GetMap.
It is also to be stressed in the proposal that the * cannot be placed
randomly,
if one starts with * everything after it must be a * too, as the
authorization subsystem
is hierarchical (see SecureTreeNode), it would not be able to match a
rule such as:
*.states.wms.GetMap.r=ROLE_WHATHEVER
This is the reason why we want to push GeoFence as a extension module,
with a possible future as a core module with a relationship with GeoServer
similar to the one with GeoWebCache (embedded by default, but usable
also outside), the IPTables paradigm used there might be harder
to parse for some (it is for me), but allows more general matches
to be expressed, there is no hierarchy restriction
Cheers
Andrea
PS: the proposal should say something about the GUI modifications too.
--
==
GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.
==
Ing. Andrea Aime
@geowolf
Technical Lead
GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549
http://www.geo-solutions.it
http://twitter.com/geosolutions_it
*AVVERTENZE AI SENSI DEL D.Lgs. 196/2003*
Le informazioni contenute in questo messaggio di posta elettronica e/o
nel/i file/s allegato/i sono da considerarsi strettamente riservate.
Il loro utilizzo è consentito esclusivamente al destinatario del
messaggio, per le finalità indicate nel messaggio stesso. Qualora
riceviate questo messaggio senza esserne il destinatario, Vi preghiamo
cortesemente di darcene notizia via e-mail e di procedere alla
distruzione del messaggio stesso, cancellandolo dal Vostro sistema.
Conservare il messaggio stesso, divulgarlo anche in parte,
distribuirlo ad altri soggetti, copiarlo, od utilizzarlo per finalità
diverse, costituisce comportamento contrario ai principi dettati dal
D.Lgs. 196/2003.
The information in this message and/or attachments, is intended solely
for the attention and use of the named addressee(s) and may be
confidential or proprietary in nature or covered by the provisions of
privacy act (Legislative Decree June, 30 2003, no.196 - Italy's New
Data Protection Code).Any use not in accord with its purpose, any
disclosure, reproduction, copying, distribution, or either
dissemination, either whole or partial, is strictly forbidden except
previous formal approval of the named addressee(s). If you are not the
intended recipient, please contact immediately the sender by
telephone, fax or e-mail and delete the information in this message
that has been received in error. The sender does not give any warranty
or accept liability as the content, accuracy or completeness of sent
messages and accepts no responsibility for changes made after they
were sent or for other risks which arise as a result of e-mail
transmission, viruses, etc.
-------------------------------------------------------
------------------------------------------------------------------------------
New Year. New Location. New Benefits. New Data Center in Ashburn, VA.
GigeNET is offering a free month of service with a new server in Ashburn.
Choose from 2 high performing configs, both with 100TB of bandwidth.
Higher redundancy.Lower latency.Increased capacity.Completely compliant.
http://p.sf.net/sfu/gigenet
_______________________________________________
Geoserver-devel mailing list
Geoserver-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/geoserver-devel
