Access Control

From jManage

Overview

ACLs are a collection of access and authorization rules called ACL entries (ACEs) that set the boundaries on user movements through the application.

Access can be restricted to a given user and/or to a group of users. By default, jManage provides two groups namely 'Administrator', 'User' and a super user 'admin' who doesn't belong to either of these two groups. One can add their own group by editing "jmanage-user-roles.xml".

ACEs are defined in "acl-config.properties".

Absence of an ACE implies no access restriction. You can comment out ACEs by prefixing it with '#' (hash).

Available ACEs

acl.edit.jmanage.users	Edit jManage user information.
acl.add.jmanage.users	Add jManage users.
acl.view.jmanage.user.activity	View audit log.
acl.add.jmanage.applications	Add/configure applications to manage through jManage.
acl.edit.jmanage.applications	Edit a configured application.
acl.add.jmanage.mbean.config	Add/configure an mbean as a favorite.
acl.edit.jmanage.mbean.config	Edit the details of a configured (favorite) mbean.
acl.view.jmanage.applications	View an application configured (to be managed by jManage).
acl.view.jmanage.mbeans	View the mbeans of a configured application.
acl.view.jmanage.mbean.attributes	View the attributes of an mbean.
acl.update.jmanage.mbean.attributes	Update the attribute values of an mbean.
acl.execute.jmanage.mbean.operations	Execute operations of an mbean.
acl.view.jmanage.mbean.notifications	View the notifications exposed by an mbean.

Fine-grained Access Control

More refined access can be provided with the help of dynamic ACEs, which are nothing but an extension of above mentioned static ACEs. The format of a dynamic ACE is:

 <permission>@<app>/<mbean>/<attribute or operation>=<comma separated roles or users>

You can use wild card for any of app, mbean or attribute. Note that the ACE currently doesn't support wildcards within the application, mbean or attribute name. If you have a particular application say "app1", the ACE may look like:

 acl.update.jmanage.mbean.attributes@app1/*/*=Role1

In this case, Role1 has permission to update all attributes of all mbeans of app1.

More examples of Dynamic ACEs:

1. If one wants to provide update access for the attribute attr1 of mbean abcMBean of application app1, to user xyz only then the dynamic ACE can be built as follows;

acl.update.jmanage.mbean.attributes@app1/myDomain:name=abcMBean/attr1=xyz

By specifying this ACE no user other than "xyz" can update attribute "attr1" of the specified mbean.

2. If one wants to provide the same to a group, grpX, of users then the ACE is,

acl.update.jmanage.mbean.attributes@app1/abcMBean/attr1=grpX

3. If one wants to restrict view access for mbean xyzMBean of application appABC, to user pqr only, then the ACE would be,

acl.view.jmanage.mbeans@appABC/myDomain:xyzMBean=pqr