[
https://issues.apache.org/jira/browse/ARTEMIS-4582?focusedWorklogId=907660&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-907660
]
ASF GitHub Bot logged work on ARTEMIS-4582:
-------------------------------------------
Author: ASF GitHub Bot
Created on: 29/Feb/24 17:53
Start Date: 29/Feb/24 17:53
Worklog Time Spent: 10m
Work Description: gtully commented on PR #4820:
URL:
https://github.com/apache/activemq-artemis/pull/4820#issuecomment-1971659697
I think this is good for comments and more eyes.
The MBean rbac uses `jmx.` prefixed settings.
the Management messages use a suffix on activemq.management to provide the
root of the hierarchy. The suffix enabled the feature. I wonder if using a
different prefix would be more consistent, rather than hanging off of the
activemq.management address. It would maybe be more consistent but
activemq.management is the target of those messages. Thoughts welcome.
Issue Time Tracking
-------------------
Worklog Id: (was: 907660)
Time Spent: 1h 10m (was: 1h)
> add view and update permissions to augment the manage rbac for control
> resources
> --------------------------------------------------------------------------------
>
> Key: ARTEMIS-4582
> URL: https://issues.apache.org/jira/browse/ARTEMIS-4582
> Project: ActiveMQ Artemis
> Issue Type: Improvement
> Components: Broker, Configuration, JMX, Web Console
> Affects Versions: 2.31.0
> Reporter: Gary Tully
> Assignee: Gary Tully
> Priority: Major
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> we have the manage permission that allows sending to the management address,
> to access any control resource. We don't however distinguish what a user can
> do.
> We should segment control operations into categories: CRUD provides a basis
> view for get/is (Read)
> update for set or operations that mutate or modify.
> We allow this sort of configuration via management.xml for jmx mbean access
> but using a different model based on object name.
> All of the mbeans delegate to the control resources.
> If we add these two additional permissions then we can have a single rbac
> model (that supports config reload) and more granularity on control resource
> access from the management address.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
