Martin Ritchie wrote:
2008/7/30 Carl Trieloff <[EMAIL PROTECTED]>:
please review/ comment etc, Ted and I have worked through it.
http://cwiki.apache.org/confluence/display/qpid/ACL
Carl.
Carl/Ted,
Looks good, just a few points on what is there. I was going to edit
the wiki then thought we should discuss first.
The wiki currently isn't consistent with the positioning of permission
and user|group but I think you were after 'permission
<group-name|user-name>' rather than the other way around as the
examples show.
I think we need to add some implementation detail/guidance so that the
functionality on all our brokers is equivalent.
I shall try and find some time to add such detail but the example that
is in my head is that a passive declare queue|exchange should not be
denied by the acls.
We want to make it easy and understandable for non-tech-business
people to understand how to configure these controls.
i.e. I want to allow user Ux to publish to queue Qx and user Uy to
consume from Qy
Perhaps an example file would be sufficient but I don't think we
should need end users to know about the AMQP specifics of exchanges
and bindings. That is not to say some users may wish that
expressiveness I think in 99% of the user cases users will want
controls similar to other messaging products that talk in terms of
Queues and Topics.
Having an example file with entries that describe the AMQP feature and
how to safely default them would probably suffice.
i.e. for a request response application such as is used by the current
Java SimpleACLTest.
acl allow bind owner=self
acl allow consume owner=self
acl allow publisher publish temporary=true
acl allow publisher create queue=RequestQueue
acl allow consumer consume temporary=true
acl allow consumer create temporary=true
acl deny
Having written that out I don't think we need the * values. Can we not
just assume * for all values that are not present. This would also
avoid the confusion with:
acl deny all
is that 'all' the group-name|user-name with no permissions, a special
permissions with no user|group?
I think you were going for the latter but that would mean the user has
been defaulted to all users. In which case can we not use the same
defaulting with the other permissions?
So updating the acl line from the wiki to read:
{code}
acl permission [<group-name|user-name>] [action]
[object=<object-name>] [property = <property-value>]
{code}
as always comments welcome
Martin
yes, good comments- let's update the wiki
One questions, don't we still the * for a rule like
acl allow consumer bind queue=stock.buy.*
Carl.
