Nirvana Concepts - Access Control Lists (ACLs)
Nirvana's Access Control List (ACL) controls client connection requests and subsequent Nirvana operations. By default access control checks are performed within a realm.
The Nirvana Administration API exposes the complete security model of the Nirvana Realm Server, remotely allowing customer specific security models to be created. This means that it is easy to integrate Nirvana into an existing authentication and entitlment service.
It is also possible to manage Nirvana ACLs using the enterprise manager GUI.
The Nirvana realm has an ACL associated with it. The acl contains a list of subjects and the operations that each subject can perform on the realm.
Users are given entitlements based on their subject. A subject is made up of a username and a host.
The username part of the subject is the name of the user taken from either the operating system of the machine they are connecting from or the certificate name if they are using an ssl protocol.
The host part of the subject is either the ip address or the hostname of the machine they are connecting from.
The subject takes the form of :
username@host
For example:
johnsmith@192.168.1.2
Each channel, queue and service also has an associated acl that defines subjects and the operations the subjects can perform.
A subject corresponds to the user information for a realm connection
Each type of acl entry has a number of flags that can be set to true or false in order to specify whether the subject can or can't perform the operation.
General ACL permissions
The following flags apply to every ACL.
- Modify - Allows the subject to add/remove ACL entries
- List - Allows the subject to get a list of ACL entries
- Full Privileges - Has complete access to the secured object
Nirvana Realm Server ACL permissions
The Realm Access Control Entry has the following controllable flags
- Use Admin API - Can use the nAdminAPI package
- Manage Realm - Can add / remove realms from this realm
- Manage Joins - Can add/delete channel joins
- Manage P2P Services - Can create/destroy P2P services
- Manage Channels - Can add/delete channels on this realm
- Access The Realm - Can actually connect to this realm
- Override Connection Count - Can bypass the connection count on the realm
- Configure Realm - Can set run time parameters on the realm
- Cluster - perform cluster operations, such as create, delete or modify cluster information
Channel ACL permissions
The Channel Access Control Entry has the following controllable flags
- Write - Can publish events to this channel
- Read - Can subscribe for events on this channel
- Purge - Can delete events on this channel
- Get Last EID - Can get the last event Id on this channel
- Named - Can the user connect using a named (durable) subscriber
Queue ACL permissions
The Queue Access Control Entry has the following controllable flags
- Write - Can push events to this queue
- Read - Can peek the events on this queue
- Purge - Can delete events on this queue
- Pop - Can pop events from the queue
P2P Service permissions
The Service Access Control Entry has the following controllable flags
- Connect - Can access this service
Wildcard Support
As well as being able to specify an access control entry for a specific subject the subject itself can contain wildcards. In this way you can specify access control based on hostname or on username.
The subject *@* is provided in all ACL objects by default, and corresponds to the default permission that all subjects inherit who connect but do not individually appear within the ACL. If a subject is listed in the ACL, then the entitlements given to that subject overrides that of any wildcarded entry, including the *@* default subject.
Eample Wildcard ACLs :
| ACL Entry | Description |
| *@* | Represents all users from all nodes |
| *@client1.com | Represents all users from the node client1.com |
| username@nodename | Represents the user "username" on the node "nodename" |
| username@* | Represents the user "username" on all nodes |
