You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@geode.apache.org by karensmolermiller <gi...@git.apache.org> on 2017/07/27 17:38:39 UTC
[GitHub] geode pull request #660: GEODE-2924 Revise authorization permissions
GitHub user karensmolermiller opened a pull request:
https://github.com/apache/geode/pull/660
GEODE-2924 Revise authorization permissions
For finer-grained security, identify new targets for CLUSTER
operations (DISK, GATEWAY, QUERY, JAR). And, revise 4
operations listed in the ticket.
@jinmeiliao @sbawaska @davebarnes97 @joeymcallister @PurelyApplied @jaredjstewart Please review.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/karensmolermiller/geode feature/GEODE-2924
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/geode/pull/660.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #660
----
commit 9cb3a1b76780e18ed3a23ff5e732c487243a87f6
Author: Karen Miller <km...@pivotal.io>
Date: 2017-07-27T17:28:33Z
GEODE-2924 Revise authorization permissions
For finer-grained security, identify new targets for CLUSTER
operations (DISK, GATEWAY, QUERY, JAR). And, revise 4
operations listed in the ticket.
----
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] geode pull request #660: GEODE-2924 Revise authorization permissions
Posted by jinmeiliao <gi...@git.apache.org>.
Github user jinmeiliao commented on a diff in the pull request:
https://github.com/apache/geode/pull/660#discussion_r129908926
--- Diff: geode-docs/managing/security/implementing_authorization.html.md.erb ---
@@ -56,13 +56,23 @@ which classifies whether the operation as
The operations are not hierarchical;
`MANAGE` does not imply `WRITE`, and `WRITE` does not imply `READ`.
-Some operations further specify a region name in the permission.
+Some `DATA` operations further specify a region name in the permission.
This permits restricting operations on that region to only those
authorized principals.
And within a region, some operations may specify a key.
This permits restricting operations on that key within that region to
only those authorized principals.
+Some `CLUSTER` operations further specify a finer-grained
+target for the operation.
+Specify the target with a string value of:
+
+- `DISK` to target operations that write to a disk store
+- `GATEWAY` to target operations that manage gateway senders and receivers
+- `QUERY` to target operations that manage both indexes and continuous
+ queries
+- `JAR` to target operations that deploy code to servers
+
--- End diff --
there is "LUCENE" as well for lucene queries
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] geode issue #660: GEODE-2924 Revise authorization permissions
Posted by joeymcallister <gi...@git.apache.org>.
Github user joeymcallister commented on the issue:
https://github.com/apache/geode/pull/660
+1 with JinMei's changes.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] geode pull request #660: GEODE-2924 Revise authorization permissions
Posted by jinmeiliao <gi...@git.apache.org>.
Github user jinmeiliao commented on a diff in the pull request:
https://github.com/apache/geode/pull/660#discussion_r129910320
--- Diff: geode-docs/managing/security/implementing_authorization.html.md.erb ---
@@ -56,13 +56,23 @@ which classifies whether the operation as
The operations are not hierarchical;
`MANAGE` does not imply `WRITE`, and `WRITE` does not imply `READ`.
-Some operations further specify a region name in the permission.
+Some `DATA` operations further specify a region name in the permission.
This permits restricting operations on that region to only those
authorized principals.
And within a region, some operations may specify a key.
This permits restricting operations on that key within that region to
only those authorized principals.
+Some `CLUSTER` operations further specify a finer-grained
+target for the operation.
+Specify the target with a string value of:
+
+- `DISK` to target operations that write to a disk store
+- `GATEWAY` to target operations that manage gateway senders and receivers
+- `QUERY` to target operations that manage both indexes and continuous
+ queries
+- `JAR` to target operations that deploy code to servers
+
--- End diff --
I believe there are more changes to the permission strings than just these few here. We also made some corrections like:
echo: N/A
encrypt password: N/A (actually encrypt password is no longer a gfsh command anymore, we removed it).
execute function: determined by function api.
A lot of the GatewayMXBean operation are changed as well.
Please go through the list of "new permission strings in https://cwiki.apache.org/confluence/display/GEODE/Finer+grained+security and make all the modifications needed.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] geode pull request #660: GEODE-2924 Revise authorization permissions
Posted by karensmolermiller <gi...@git.apache.org>.
Github user karensmolermiller commented on a diff in the pull request:
https://github.com/apache/geode/pull/660#discussion_r129917470
--- Diff: geode-docs/managing/security/implementing_authorization.html.md.erb ---
@@ -56,13 +56,23 @@ which classifies whether the operation as
The operations are not hierarchical;
`MANAGE` does not imply `WRITE`, and `WRITE` does not imply `READ`.
-Some operations further specify a region name in the permission.
+Some `DATA` operations further specify a region name in the permission.
This permits restricting operations on that region to only those
authorized principals.
And within a region, some operations may specify a key.
This permits restricting operations on that key within that region to
only those authorized principals.
+Some `CLUSTER` operations further specify a finer-grained
+target for the operation.
+Specify the target with a string value of:
+
+- `DISK` to target operations that write to a disk store
+- `GATEWAY` to target operations that manage gateway senders and receivers
+- `QUERY` to target operations that manage both indexes and continuous
+ queries
+- `JAR` to target operations that deploy code to servers
+
--- End diff --
Will add the LUCENE target before I merge this PR. Thanks!
I created https://issues.apache.org/jira/browse/GEODE-3324 to complete the changes specified in the wiki proposal.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] geode pull request #660: GEODE-2924 Revise authorization permissions
Posted by asfgit <gi...@git.apache.org>.
Github user asfgit closed the pull request at:
https://github.com/apache/geode/pull/660
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---
[GitHub] geode issue #660: GEODE-2924 Revise authorization permissions
Posted by PurelyApplied <gi...@git.apache.org>.
Github user PurelyApplied commented on the issue:
https://github.com/apache/geode/pull/660
+1. For future reference, tickets GEODE-2920 through GEODE-2926 were committed under the overarching ticket [GEODE-2919](https://issues.apache.org/jira/browse/GEODE-2919) in commit `451d12e8...`.
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---