Permissions
The actions a client session can take in Diffusion™ are controlled by a set of permissions. These permissions are assigned to roles.
- Path
- Permissions at path scope apply to actions on a topic path or message path.
Path-scoped permissions are defined against paths. The permissions that apply to a topic path or to a message path are the set of permissions defined at the most specific path.
- Global
- Permissions at global scope apply to actions on the Diffusion server.
Path permissions
The path-scoped permissions are listed in the following table:
Name | Description |
---|---|
Acquire a session lock. The names of the locks that can be acquired are restricted to the paths of the permission scope. | |
Use a topic selector that selects the topic path. A session must have this permission for the path prefix of any topic selector used to subscribe or fetch. | |
Grant read access to the topics. If a session does not have this permission for a topic, that topic does not match subscriptions and is excluded from fetch requests. Also, the topic's details cannot be retrieved. |
|
Evaluate a query on a time series topic that can potentially return a non-current view of all or part of a time series. Such queries include value range queries that specify an edit range, and all types of edit range query. Evaluating a query also requires | .|
Submit edit events to a time series topic. Updating a time series topic also requires | .|
Submit edit events to a time series topic where the event author is the same as the principal of the calling session. Updating a time series topic also requires | .|
Update topics at or below a topic branch. | |
Create or modify topics at or below a topic branch. | |
Send a message to the Diffusion server through a message path. | |
Send a message to a client session through a message path. |
Understanding path-scoped permissions
Path-scoped permissions are assigned to roles for specific paths. The permission assignment applies to all descendant paths, unless there is a more specific assignment.
To evaluate whether a client session has access to a permission for a topic or message path, the Diffusion server starts at that path and searches up the path hierarchy to find the nearest permission assignment. The first assignment is the only one considered, even if the client has roles involved in assignments further up the path hierarchy.
Default path-scoped assignments can also be defined. These are used if no path assignment matches.
Path scope example
- A
- A permission set is defined for the path A.
These permissions give client sessions with the ALPHA role , , and permissions on the topic A.
- A/B
- No permission set is defined for the path A/B. In this case, the permissions at the most specific scope are those
defined for the path A
These permissions give client sessions with the ALPHA role B.
, , and permissions on the topic - A/C
- A permission set is defined for the path A/C. These permissions do not include any permissions for the ALPHA role.
Client sessions with the ALPHA role have no permissions on the topic C. Permissions are defined for the ALPHA role at a less specific scope. However, these permissions are not referred to or inherited if any permissions are defined at a more specific scope. Only the most specific set of permissions is used. In this case, those permissions are only for the BETA role and not the ALPHA role.
- A/C/D
- A permission set is defined for the path A/C/D.
These permissions give client sessions with the ALPHA role and permissions on the topic D.
The role ALPHA has only these permissions even though at A/C the role has no permissions defined and at A the role has additional permissions. Only the most specific set of permissions is used.
The BETA role also has permissions defined at this scope. These permissions do not affect the permissions that the ALPHA role has at this scope.
Understanding the
and permissionsThe default configuration grants the Diffusion path using the OPERATOR role. You can alter this configuration to protect sensitive topics.
and permissions to all sessions then protects the topics on paths below theA session that does not have the
permission for a particular path cannot subscribe directly to topics at that path. However, the session can be independently subscribed to that topic by a control session that has permission in addition to the permission for that path. The subscribed session requires the permission for that topic for the subscription to the topic to occur. The control session cannot subscribe a session to a topic if that session does not have the permission for the topic. When this occurs, the topic is filtered out of the subscription.Use the Diffusion or ?Diffusion//", but the CLIENT role is sufficient to use the topic selector expression ?// which selects all of the topics in the topic tree.
permission with some care because topic selectors can use wild card expressions. For example, with the default configuration, the OPERATOR role is required to use topic selector expressions such asIn the default configuration, this does not cause a problem as sessions that do not have the OPERATOR role also do not have the Diffusion. Any matching topics are filtered from subscription and fetch results for those sessions.
permission for topic paths belowManaging all subscriptions from a separate control session
You can prevent client sessions from subscribing themselves to topics and control all subscriptions from a separate control client session that uses SubscriptionControl feature to subscribe clients to topics.
To restrict subscription capability to control sessions, configure the following permissions:
- Grant the permission
- Grant the
This can either be granted for the default path scope or more selectively to restrict the topic selectors the control session can use.
permission
- Grant to the appropriate topics.
- Deny the
Do not assign the session a role that has the
permission for the default path scope. This prevents the session from subscribing to all topics using a wildcard selector.
permission by
default. - Optionally, grant the permission to specific branches of the topic tree to which the session can subscribe freely.
Global permissions
The global permissions are listed in the following table:
Name | Description |
---|---|
List or listen to client sessions. | |
Alter a client session. This covers a range of actions including the following:
|
|
Register any handler with the Diffusion server. | |
Register an authentication handler. The permission is also required to perform this action. |
|
Read administrative information about the Diffusion server.
For example, through Java Management Extensions (JMX). |
|
|
|
View the security policy. | |
Change the security policy. |
This page last modified: 2019/10/21