This is archived documentation for an older version of Nirvana (v3.1). Please refer to documentation for the latest version if required.

Nirvana Enterprise Manager - Realm Entitlements

Realm ACLs

As mentioned in the security introduction, in order to perform operations within a Realm clients connecting to the realm must be given the correct entitlements.

In order for a client to connect to a Nirvana Realm server there must be a Realm ACL which allows them to do so. A Realm ACL contains a list of subjects and their entitlements (i.e. what operations they can perform within the realm).

Using the Enterprise manager, one can add to, remove or modify entries within a realm ACL.

ACLs can also be managed via the Nirvana administration API.

To view a Realm ACL, click on a realm node within the namespace of the Enterprise Manager, and select the 'ACL' tab. This will display the realm ACL and the list of subjects and their associated permissions for the realm. The following image displays and example of a realm acl.

As you can see above, the realm ACL has a number of subject entries and operations that each subject is able to perform on the realm. The operations that can be performed on a realm are described below in the order in which they appear in the acl panel above:

  • List
 - Allows the subject to get a list of ACL entries
  • Modify
 - Allows the subject to add/remove ACL entries
  • Full Privileges
 - Has complete access to the secured object
  • Access The Realm
 - Can actually connect to this realm
  • Configure Realm
 - Can set run time parameters on the realm
  • Manage Channels
- Can add/delete channels on this realm
  • Manage Joins
 - Can add/delete channel joins
  • Manage P2P Services
- Can create/destroy P2P services
  • Manage Realm
- Can add / remove realms from this realm
  • Override Connection Count
- Can bypass the connection count on the realm
  • Use Admin API
 - Can use the nAdminAPI package
  • Cluster
 - perform cluster operations, such as create, delete or modify cluster information

 

The green circles show that a subject is permitted to perform the operation. For example, the subject *@* is shown as having no permissions for this realm. The minimum requirement for a client to use a realm is the 'Access' privilege. Without this privilige for the *@* subject, any Nirvana client attempting to connect, who's subject does not appear in the ACL list will not be able to establish a session with the Realm Server.

In order to modify the permissions for a subject, you simply need to click on the cell in the ACL table for the subject and the operation you wish to modify permissions for. For example, if i wanted grant the *@* user the 'Access' realm privilege, i would simply click on the *@* row at the column labelled 'access'. This would turn the cell from blank to a green circle.

After making any changes, you then need to click on the 'Apply' button which will notify the Realm Server of the ACL change.

Any ACL changes that are made by other Enterprise Manager users, or from any programs using the Nirvana Admin API to modify ACLs will be received by all other Enterprise Managers. This is because ACL changes are automatically sent to all Nirvana Admin API clients, the Enterprise Manager being one of those clients.

Any changes made to a realm ACL where the realm is part of a cluster will be replicated to all other cluster realms.