You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@storm.apache.org by bo...@apache.org on 2017/08/02 13:47:12 UTC
storm git commit: Merge branch 'master07250849' of
https://github.com/liu-zhaokun/storm into STORM-2657
Repository: storm
Updated Branches:
refs/heads/1.x-branch e3cc74d67 -> e67c55a34
Merge branch 'master07250849' of https://github.com/liu-zhaokun/storm into STORM-2657
STORM-2657: Update SECURITY.MD
Project: http://git-wip-us.apache.org/repos/asf/storm/repo
Commit: http://git-wip-us.apache.org/repos/asf/storm/commit/e67c55a3
Tree: http://git-wip-us.apache.org/repos/asf/storm/tree/e67c55a3
Diff: http://git-wip-us.apache.org/repos/asf/storm/diff/e67c55a3
Branch: refs/heads/1.x-branch
Commit: e67c55a34d3a30e24417dc14f5dfea6468158b98
Parents: e3cc74d
Author: Robert Evans <ev...@yahoo-inc.com>
Authored: Wed Aug 2 08:44:27 2017 -0500
Committer: Robert Evans <ev...@yahoo-inc.com>
Committed: Wed Aug 2 08:46:59 2017 -0500
----------------------------------------------------------------------
docs/SECURITY.md | 40 +++++++++++++++++++++++++++++++++++++++-
1 file changed, 39 insertions(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/storm/blob/e67c55a3/docs/SECURITY.md
----------------------------------------------------------------------
diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index e73e873..6a96704 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -478,6 +478,44 @@ nimbus.groups:
### DRPC
-Hopefully more on this soon
+
+ Storm provides the Access Control List for the DRPC Authorizer.Users can see [org.apache.storm.security.auth.authorizer.DRPCSimpleACLAuthorizer](javadocs/org/apache/storm/security/auth/authorizer/DRPCSimpleACLAuthorizer.html) for more details.
+
+ There are several DRPC ACL related configurations.
+
+ | YAML Setting | Description |
+ |------------|----------------------|
+ | drpc.authorizer.acl | A class that will perform authorization for DRPC operations. Set this to org.apache.storm.security.auth.authorizer.DRPCSimpleACLAuthorizer when using security.|
+ | drpc.authorizer.acl.filename | This is the name of a file that the ACLs will be loaded from. It is separate from storm.yaml to allow the file to be updated without bringing down a DRPC server. Defaults to drpc-auth-acl.yaml |
+ | drpc.authorizer.acl.strict| It is useful to set this to false for staging where users may want to experiment, but true for production where you want users to be secure. Defaults to false. |
+ The file pointed to by drpc.authorizer.acl.filename will have only one config in it drpc.authorizer.acl this should be of the form
+ drpc.authorizer.acl:
+ "functionName1":
+ "client.users":
+ - "alice"
+ - "bob"
+ "invocation.user": "bob"
+
+ In this the users bob and alice as client.users are allowed to run DRPC requests against functionName1, but only bob as the invocation.user is allowed to run the topology that actually processes those requests.
+
+
+## Cluster Zookeeper Authentication
+
+ Users can implement cluster Zookeeper authentication by setting several configurations are shown below.
+
+ | YAML Setting | Description |
+ |------------|----------------------|
+ | storm.zookeeper.auth.scheme | The cluster Zookeeper authentication scheme to use, e.g. "digest". Defaults to no authentication. |
+ | storm.zookeeper.auth.payload | A string representing the payload for cluster Zookeeper authentication.It should only be set in the storm-cluster-auth.yaml.Users can see storm-cluster-auth.yaml.example for more details. |
+
+
+ Also,there are several configurations for topology Zookeeper authentication:
+
+ | YAML Setting | Description |
+ |------------|----------------------|
+ | storm.zookeeper.topology.auth.scheme | The topology Zookeeper authentication scheme to use, e.g. "digest". It is the internal config and user shouldn't set it. |
+ | storm.zookeeper.topology.auth.payload | A string representing the payload for topology Zookeeper authentication. |
+
+ Note: If storm.zookeeper.topology.auth.payload isn't set,storm will generate a ZooKeeper secret payload for MD5-digest with generateZookeeperDigestSecretPayload() method.
\ No newline at end of file