You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@qpid.apache.org by "Chuck Rolke (JIRA)" <ji...@apache.org> on 2012/08/21 16:48:37 UTC
[jira] [Resolved] (QPID-4230) C++ Broker could use username
substitution keyword strings in Acl rules
[ https://issues.apache.org/jira/browse/QPID-4230?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Chuck Rolke resolved QPID-4230.
-------------------------------
Resolution: Fixed
Fix Version/s: 0.19
Fixed with checkins r1375195 and r1375583
> C++ Broker could use username substitution keyword strings in Acl rules
> -----------------------------------------------------------------------
>
> Key: QPID-4230
> URL: https://issues.apache.org/jira/browse/QPID-4230
> Project: Qpid
> Issue Type: Improvement
> Components: C++ Broker
> Affects Versions: 0.19
> Reporter: Chuck Rolke
> Assignee: Chuck Rolke
> Fix For: 0.19
>
>
> Acl processing in the broker could perform username substitution into Acl rules. This would provide an easy and flexible way to constrain users.
> 1. Let the literal string ${user} be the keyword placed into Acl files.
> 2. When expanded ${user} will become the full authenticated userId such as 'bob@QPID'. Note that simply using 'bob' leads to issues distinguishing between 'bob@QPID' and 'bob@EXAMPLE.COM'.
> 3. Username keyword substitution is performed only on object names and in routing keys.
> Acl rule file examples:
> acl allow all create exchange name=temp-${user}
> acl allow all access exchange name=temp-${user}
> acl allow all bind exchange name=temp-${user}
> acl allow all unbind exchange name=temp-${user}
> acl allow all delete exchange name=temp-${user}
> acl allow all publish exchange name=temp-${user} routingkey=temp.${user}
> acl allow all create queue name=temp-${user}
> acl allow all access queue name=temp-${user}
> acl allow all purge queue name=temp-${user}
> acl allow all consume queue name=temp-${user}
> acl allow all delete queue name=temp-${user}
> Using a rule set like this would allow all users to create a private temp- exchange and a private temp- queue bound to their user names.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org