[jira] [Work logged] (ARTEMIS-4582) add view and edit permissions to extend security-settings rbac for management operations

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/ARTEMIS-4582?focusedWorklogId=909978&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-909978 ]

ASF GitHub Bot logged work on ARTEMIS-4582:
-------------------------------------------

                Author: ASF GitHub Bot
            Created on: 14/Mar/24 20:58
            Start Date: 14/Mar/24 20:58
    Worklog Time Spent: 10m 
      Work Description: gtully commented on PR #4820:
URL: https://github.com/apache/activemq-artemis/pull/4820#issuecomment-1998472976

   @jbertram I think this is in a happy place if you have some cycles to peek again. thanks




Issue Time Tracking
-------------------

    Worklog Id:     (was: 909978)
    Time Spent: 4.5h  (was: 4h 20m)

> add view and edit permissions to extend security-settings rbac for management operations
> ----------------------------------------------------------------------------------------
>
>                 Key: ARTEMIS-4582
>                 URL: https://issues.apache.org/jira/browse/ARTEMIS-4582
>             Project: ActiveMQ Artemis
>          Issue Type: Improvement
>          Components: Broker, Configuration, JMX, Web Console
>    Affects Versions: 2.31.0
>            Reporter: Gary Tully
>            Assignee: Gary Tully
>            Priority: Major
>          Time Spent: 4.5h
>  Remaining Estimate: 0h
>
> we have the manage permission that allows sending to the management address, to access any control resource. We don't however distinguish what a user can do.
> We should segment control operations into categories: CRUD provides a basis
> view for get/is (Read)
> edit for set or operations that mutate or modify.
> We allow this sort of configuration via management.xml for jmx mbean access but using a different model based on object name.
> All of the mbeans delegate to the control resources.
> If we add these two additional permissions then we can have a single rbac model (that supports config reload) and more granularity on control resource access from the management address.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)