Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-9283

RBAC: The two kinds of non-addressability

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Duplicate
    • Icon: Major Major
    • None
    • 7.1.0.DR13
    • Management
    • None
    • Release Notes
    • Hide
      *JBEAP-9283 - RBAC: The two kinds of non-addressability*
      Some resources are non-addressable to server group and host scoped roles in order to provide a simplified view of the management model to improve usability. This is different from resources that are non-addressable to protect sensitive data.

      For server-group scoped roles this means that resources in the `profile`, `socket binding group`, `deployment`, `deployment override`, `server group`, `server config` and `server` portions of the management model will not be visible if they are not related to the server groups specified for the role.

      For host-scoped roles this means that resources in the `/host=*` portion of the management model will not be visible if they are not related to the server groups specified for the role.

      However in some cases this simplified view can hide information that, while it is outside the scope of what the user is managing, it can provide guidance to the user as to a course of action. An example of this is JBEAP-4160 - RBAC: Unable to deploy the same deployment that was already deployed by user from different server-group scope.

      In a future release, some of these non-addressable resources might be changed to be addressable but non-readable. This will not affect the security of the server because they were not non-addressable for security reasons. Red Hat recommends that you do not rely on the non-addressability of resources to hide information unless the non-addressability is defined in a sensitivity constraint.
      Show
      * JBEAP-9283 - RBAC: The two kinds of non-addressability* Some resources are non-addressable to server group and host scoped roles in order to provide a simplified view of the management model to improve usability. This is different from resources that are non-addressable to protect sensitive data. For server-group scoped roles this means that resources in the `profile`, `socket binding group`, `deployment`, `deployment override`, `server group`, `server config` and `server` portions of the management model will not be visible if they are not related to the server groups specified for the role. For host-scoped roles this means that resources in the `/host=*` portion of the management model will not be visible if they are not related to the server groups specified for the role. However in some cases this simplified view can hide information that, while it is outside the scope of what the user is managing, it can provide guidance to the user as to a course of action. An example of this is JBEAP-4160 - RBAC: Unable to deploy the same deployment that was already deployed by user from different server-group scope. In a future release, some of these non-addressable resources might be changed to be addressable but non-readable. This will not affect the security of the server because they were not non-addressable for security reasons. Red Hat recommends that you do not rely on the non-addressability of resources to hide information unless the non-addressability is defined in a sensitivity constraint.
    • Not Required

      Ever since we introduced RBAC in WildFly / EAP, we had this shortcut in place that we were documenting in EAP Release Notes:

      Some resources are non-addressable to server-group and host scoped roles in order to provide a simplified view of the management model to improve usability. This is distinct from resources that are non-addressable to protect sensitive data.

      I think that this shortcut is in place mainly because HAL can't cope with addressable but non-readable resources, but there might be other reasons. In any case, I figured I should finally file an upstream JIRA so that I don't have to bug Brian all the time if this has changed

              bstansbe@redhat.com Brian Stansberry
              hsvabek_jira Hynek Švábek (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: