To view a channel ACL, click on a channel node within
the namespace of the Enterprise Manager, and select
the 'ACL' tab. This will display the channel ACL and
the list of subjects and their associated permissions
for the channel. The following image displays and example
of a channel acl.
As you can see above, the channel ACL has a number
of subject entries and operations that each subject
is able to perform on the channel. The operations that
can be performed on a channel are described below in
the order in which they appear in the acl panel above:
• List – Allows the subject to get a
list of ACL entries
• Modify – Allows the subject to add/remove
ACL entries
• Full Privileges – Has complete access
to the secured object
• Last EID – Can get the last event Id
on this channel
• Purge – Can delete events on this channel
• Subscribe– Can subscribe for events
on this channel
• Publish– Can publish events to this
channel
• Named - Can the user connect using a named
(durable) subscriber
The green circles show that a subject is permitted
to perform the operation. For example, the subject *@*
is shown as having only subscribe permissions for this
channel. This means that any client who has successfully
established a session and has obtained a reference to
this channel within their application code can only
subscribe to the channel and read events.
In order to modify the permissions for a subject, you
simply need to click on the cell in the ACL table for
the subject and the operation you wish to modify permissions
for. For example, if i wanted remove the subscribe permission
for the *@* subject i would simply click on the *@*
row at the column labelled 'subscribe'. This would turn
the cell from blank to a green circle. This would also
ensure that only those subjects listed in the ACL and
with sufficient privileges, would be able to perform
any operations on the channel.
After making any changes, you then need to click on
the 'Apply' button which will notify the Realm Server
of the ACL change for that channel.
Any ACL changes that are made by other Enterprise Manager
users, or from any programs using the Nirvana Admin
API to modify ACLs will be received by all other Enterprise
Managers. This is because ACL changes are automatically
sent to all Nirvana Admin API clients, the Enterprise
Manager being one of those clients.
Any changes made to a channel ACL where the channel
is a cluster channel will be replicated to all other
instances of the cluster channel in all other cluster
realms. |
