[CONF] Apache Qpid: ACL (page edited)

[confluence]

Page Edited : qpid : ACL ACL has been edited by Carl Trieloff (Aug 28, 2008). (View changes) Content: ACL file format for brokers.  Notes on file formats A line starting with the character '#' will be considered a comment, and are ignored. Since the '#' char (and others that are commonly used for comments) are commonly found in routing keys and other AMQP literals, it is simpler (for now) to hold off on allowing trailing comments (ie comments in which everything following a '#' is considered a comment). This could be reviewed later once the rest of the format is finalized. Empty lines ("") and lines that contain only whitespace (any combination of ' ', '\f', '\n', '\r', '\t', '\v') are ignored. All tokens are case sensitive. "name1" != "Name1" and "create" != "CREATE". Group lists may be extended to the following line by terminating the line with the '\' character. However, this may only occur after the group name or any of the names following the group name. Empty extension lines (ie just a '\' character) are not permitted. # Examples of extending group lists using a trailing '\' character group group1 name1 name2 \ name3 name4 \ name5 group group2 \ group1 \ name6 # The following are illegal: # '\' must be after group name group \ group3 name7 name8 # No empty extension lines group group4 name9 \ \ name10 Additional whitespace (ie more than one whitespace char) between and after tokens is ignored. However group and acl definitions must start with "group" or "acl" respectively and with no preceding whitespace. All acl rules are limited to a single line. Rules are interpreted from the top of the file down until the name match is obtained; at which point processing stops. The keyword "all" is reserved, and matches all individuals, groups and actions. It may be used in place of a group or individual name and/or an action - eg "acl allow all all", "acl deny all all" or "acl deny user1 all". The last line of the file (whether present or not) will be assumed to be "acl deny all all". If present in the file, any lines below this one are ignored. Names and group names may contain only a-z, A-Z, 0-9, '-','_'. Rules must be preceded by any group definitions they may use; any name not previously defined as a group will be assumed to be that of an individual. ACL rules must have the following tokens in order on a single line: The string literal "acl"; The permission; The name of a single group or individual or the keyword "all"; The name of an action or the keyword "all"; Optionally, a single object name or the keyword "all"; If the object is present, then optionally one or more property name-value pair(s) (in the form property=value). user-list = user1 user2 user3 ... group-name-list = group1 group2 group3 ... group <group-name> = [user-list] [group-name-list] permission = [allow|allow-log|deny|deny-log] action = "" object = [virtualhost|queue|exchange|broker|link|route] property = [name|durable|owner|routingkey|passive|autodelete|exclusive|type|alternate|queuename] acl permission {<group-name>|<user-name>|"all"} {action|"all"} [object|"all"] [property=<property-value>] Example file: # Some groups group admin [EMAIL PROTECTED] [EMAIL PROTECTED] group user-consume [EMAIL PROTECTED] [EMAIL PROTECTED] group group2 [EMAIL PROTECTED] user-consume [EMAIL PROTECTED] group publisher group2 \ [EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED] # Some rules acl allow [EMAIL PROTECTED] create exchange name=carl.* acl deny [EMAIL PROTECTED] create queue acl allow [EMAIL PROTECTED] bind exchange name=amq.topic routingkey=stocks.ibm.# owner=self acl allow user-consume create queue name=tmp.* acl allow publisher publish all durable=false acl allow publisher create queue name=RequestQueue acl allow consumer consume queue durable=true acl allow [EMAIL PROTECTED] create all acl allow admin all acl deny [EMAIL PROTECTED] all acl allow all consume queue owner=self acl allow all bind exchange owner=self # Last (default) rule acl deny all all Writing Good/Fast ACL The file gets read top down and rule get passed based on the first match. In the following example the first rule is a dead rule. I.e. the second rule is wider than the first rule. DON'T do this, it will force extra analysis, worst case if the parser does not kill the dead rule you might get a false deny. allow [EMAIL PROTECTED] create queue name=tmp <-- dead rule!! allow [EMAIL PROTECTED] create queue deny all all By default files end with deny all all the mode of the ACL engine can be swapped to be allow based by putting the following at the end of the file allow all all Note that 'allow' based file will be a LOT faster for message transfer. This is because the AMQP specification does not allow for creating subscribes on publish, so the ACL is executed on every message transfer. Also, ACL's rules using less properties on publish will in general be faster. Getting ACL to Log In order to get log messages from ACL actions use allow-log and deny-log for example allow-log [EMAIL PROTECTED] all all deny-log [EMAIL PROTECTED] all all User Id / domains running with C++ broker The user-id used for ACL is taken from the connection user-id. Thus in order to use ACL the broker authentication has to be setup. i.e. (if --auth no is used in combination with ACL the broker will deny everything) The user id in the ACL file is of the form <user-id>@<domain> The Domain is configured via the SASL configuration for the broker, and the domain/realm for qpidd is set using --realm and default to 'QPID'. To load the ACL module use, load the acl module cmd line or via the config file ./src/qpidd --load-module src/.libs/libqpidacl.so The ACL plugin supports two options: ACL Options: --no-enforce-acl Do not enforce ACL --acl-file FILE (policy.acl) The policy file to load from, loaded from data dir Mapping of ACL traps to action and type The C++ broker maps the ACL traps in the follow way for AMQP 0-10: The Java broker currently only performs ACLs on the AMQP connection not on management functions: Object Action Properties Trap C++ Trap Java Exchange Create name type alternate passive durable ExchangeHandlerImpl::declare ExchangeDeclareHandler Exchange Delete name ExchangeHandlerImpl::delete ExchangeDeleteHandler Exchange Access name ExchangeHandlerImpl::query Exchange Bind name routingkey queuename owner ExchangeHandlerImpl::bind QueueBindHandler Exchange Unbind name routingkey ExchangeHandlerImpl::unbind ExchangeUnbindHandler Exchange Access name queuename routingkey ExchangeHandlerImpl::bound Exchange Publish name routingKey SemanticState::route BasicPublishMethodHandler Queue Access name QueueHandlerImpl::query Queue Create name alternate passive durable exclusive autodelete QueueHandlerImpl::declare QueueDeclareHandler Queue Purge name QueueHandlerImpl::purge QueuePurgeHandler Queue Purge name Management::Queue::purge Queue Delete name QueueHandlerImpl::delete QueueDeleteHandler Queue Consume name (possibly add in future?) MessageHandlerImpl::subscribe BasicConsumeMethodHandler BasicGetMethodHandler <Object> Update   ManagementProperty::set <Object> Access   ManagementProperty::read Link Create   Management::connect Route Create   Management:: -createFederationRoute- Route Delete   Management:: -deleteFederationRoute- Virtualhost Access name TBD ConnectionOpenMethodHandler Management actions that are not explicitly given a name property it will default the name property to management method name, if the action is 'W' Action will be 'Update', if 'R' Action will be 'Access'. for example, if the mgnt method 'joinCluster' was not mapped in schema it will be mapped in ACL file as follows Object Action Property Broker Update name=joinCluster

Powered by Atlassian Confluence (Version: 2.2.9 Build:#527 Sep 07, 2006) - Bug/feature request

Unsubscribe or edit your notifications preferences