Diffusion C API  6.3.3
 All Data Structures Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
security-control.h File Reference

Security control feature. More...

Data Structures

struct  security_store_role_s
 
struct  security_store_s
 
struct  get_security_store_params_s
 Structure passed when requesting the security store. More...
 
struct  update_security_store_params_s
 Structure passed when updating the security store. More...
 

Typedefs

typedef int(* on_get_security_store_cb )(SESSION_T *session, const SECURITY_STORE_T store, void *context)
 Callback for get_security_store(). More...
 
typedef struct
get_security_store_params_s 
GET_SECURITY_STORE_PARAMS_T
 Structure passed when requesting the security store.
 
typedef int(* on_update_security_store_cb )(SESSION_T *session, const LIST_T *error_reports, void *context)
 Callback for update_security_store(). More...
 
typedef struct
update_security_store_params_s 
UPDATE_SECURITY_STORE_PARAMS_T
 Structure passed when updating the security store.
 

Enumerations

enum  GLOBAL_PERMISSIONS_T {
  GLOBAL_PERMISSION_AUTHENTICATE, GLOBAL_PERMISSION_VIEW_SESSION, GLOBAL_PERMISSION_MODIFY_SESSION, GLOBAL_PERMISSION_REGISTER_HANDLER,
  GLOBAL_PERMISSION_VIEW_SERVER, GLOBAL_PERMISSION_CONTROL_SERVER, GLOBAL_PERMISSION_VIEW_SECURITY, GLOBAL_PERMISSION_MODIFY_SECURITY,
  GLOBAL_PERMISSION_UNKNOWN, GLOBAL_PERMISSION_READ_TOPIC_VIEWS, GLOBAL_PERMISSION_MODIFY_TOPIC_VIEWS
}
 Permissions that protect globally scoped, access-controlled operations. More...
 
enum  TOPIC_PERMISSIONS_T {
  TOPIC_PERMISSION_READ_TOPIC, TOPIC_PERMISSION_UPDATE_TOPIC, TOPIC_PERMISSION_MODIFY_TOPIC, TOPIC_PERMISSION_SEND_TO_MESSAGE_HANDLER,
  TOPIC_PERMISSION_SEND_TO_SESSION, TOPIC_PERMISSION_SELECT_TOPIC , TOPIC_PERMISSION_ACQUIRE_LOCK, TOPIC_PERMISSION_UNKNOWN
}
 Permissions protecting access-controlled operations that are evaluated for a specific topic path or message path. More...
 

Functions

SECURITY_STORE_Tsecurity_store_create (void)
 Create a new, empty security store structure. More...
 
void security_store_free (SECURITY_STORE_T *store)
 Free all memory associated with a security store structure. More...
 
SECURITY_STORE_Tsecurity_store_dup (const SECURITY_STORE_T *store)
 The returned structure is unsynchronized, so appropriate mutexes should be use if the structure is to be used concurrently. More...
 
void get_security_store (SESSION_T *session, const GET_SECURITY_STORE_PARAMS_T params)
 Get the server's security store. More...
 
char ** get_security_default_anonymous_roles (const SECURITY_STORE_T store)
 Get the default roles for anonymous connections. More...
 
char ** get_security_default_named_roles (const SECURITY_STORE_T store)
 Get the default roles for connections made with a principal. More...
 
char ** get_security_role_names (const SECURITY_STORE_T store)
 Get the names of all roles defined in the security store. More...
 
char ** get_security_included_roles (const SECURITY_STORE_T store, const char *role_name)
 Get the names of other roles that this role includes. More...
 
GLOBAL_PERMISSIONS_T ** get_security_global_permissions (const SECURITY_STORE_T store, const char *role_name)
 Get an array of global permissions assigned to a role. More...
 
TOPIC_PERMISSIONS_T ** get_security_default_topic_permissions (const SECURITY_STORE_T store, const char *role_name)
 Get an array of default topic permissions assigned to a role. More...
 
TOPIC_PERMISSIONS_T ** get_security_topic_permissions (const SECURITY_STORE_T store, const char *role_name, const char *topic_name)
 Get an array of topic permissions assigned to a role, for a specified topic. More...
 
void update_security_store (SESSION_T *session, const UPDATE_SECURITY_STORE_PARAMS_T params)
 Send updates to the security store. More...
 
SCRIPT_Tupdate_security_store_global_role_permissions (SCRIPT_T *script, const char *role_name, const SET_T *permissions)
 Updates a script to assign global permissions to a security role. More...
 
SCRIPT_Tupdate_security_store_default_topic_permissions (SCRIPT_T *script, const char *role_name, const SET_T *permissions)
 Updates a script to assign default topic permissions to a security role. More...
 
SCRIPT_Tupdate_security_store_topic_permissions (SCRIPT_T *script, const char *role_name, const char *topic_path, const SET_T *permissions)
 Updates a script to assign permissions for named role and topic. More...
 
SCRIPT_Tupdate_security_store_remove_topic_permissions (SCRIPT_T *script, const char *role_name, const char *topic_path)
 Updates a script to remove permissions for a named role and topic. More...
 
SCRIPT_Tupdate_security_store_include_roles (SCRIPT_T *script, const char *role_name, const LIST_T *included_roles)
 Updates a script to include other roles within a role. More...
 
SCRIPT_Tupdate_security_store_named_session_roles (SCRIPT_T *script, const LIST_T *roles)
 Updates a script to set the roles assigned to named sessions. More...
 
SCRIPT_Tupdate_security_store_anonymous_session_roles (SCRIPT_T *script, const LIST_T *roles)
 Updates a script to set the roles assigned to anonymous sessions. More...
 

Detailed Description

Security control feature.

Typedef Documentation

typedef int(* on_get_security_store_cb)(SESSION_T *session, const SECURITY_STORE_T store, void *context)

Callback for get_security_store().

Parameters
sessionThe current active session.
responseThe response containing the security store contents. This structure will be freed on exit so a copy should be taken if it needs to be used outside of the scope of the callback.
contextUser-supplied context from the get_security_store() call.
Returns
HANDLER_SUCCESS or HANDLER_FAILURE.
typedef int(* on_update_security_store_cb)(SESSION_T *session, const LIST_T *error_reports, void *context)

Callback for update_security_store().

Parameters
sessionThe current active session.
error_reportsAny errors that have occurred while processing the updated.
contextUser-supplied context from the update_security_store() call.
Returns
HANDLER_SUCCESS or HANDLER_FAILURE.

Enumeration Type Documentation

Permissions that protect globally scoped, access-controlled operations.

Enumerator
GLOBAL_PERMISSION_AUTHENTICATE 

Add an authentication handler.

GLOBAL_PERMISSION_VIEW_SESSION 

List or listen to client sessions.

GLOBAL_PERMISSION_MODIFY_SESSION 

Alter a client session.

This covers a range of actions including:

  • subscribe session to a topic
  • throttle session
  • enable conflation for a sessioh
  • close session
GLOBAL_PERMISSION_REGISTER_HANDLER 

Required to register any server side handler.

GLOBAL_PERMISSION_VIEW_SERVER 

View the server's runtime state - for example, read JMX MBeans.

GLOBAL_PERMISSION_CONTROL_SERVER 

Change the server's runtime state - for example, shut it down.

GLOBAL_PERMISSION_VIEW_SECURITY 

Read the security configuration.

GLOBAL_PERMISSION_MODIFY_SECURITY 

Change the security configuration.

GLOBAL_PERMISSION_UNKNOWN 

A permission that is unsupported by the session.

GLOBAL_PERMISSION_READ_TOPIC_VIEWS 

Read topic views.

GLOBAL_PERMISSION_MODIFY_TOPIC_VIEWS 

Modify topic views.

Permissions protecting access-controlled operations that are evaluated for a specific topic path or message path.

Enumerator
TOPIC_PERMISSION_READ_TOPIC 

Required to receive information from a topic.

If a session does not have read_topic permission for a topic, the topic will be excluded from the results of subscription or fetch operations for the session, and the topic's details cannot be retrieved by the session.

TOPIC_PERMISSION_UPDATE_TOPIC 

Update a topic.

TOPIC_PERMISSION_MODIFY_TOPIC 

Add a topic or remove a topic.

TOPIC_PERMISSION_SEND_TO_MESSAGE_HANDLER 

Send a message to a handler registered with the server.

TOPIC_PERMISSION_SEND_TO_SESSION 

Send a message to a client session.

TOPIC_PERMISSION_SELECT_TOPIC 

Use a topic selector that selects the topic path.

A session must have this permission for the path prefix of any topic selector used to subscribe or fetch. When the subscription or fetch request completes, the resulting topics are further filtered based on the TOPIC_PERMISSION_READ_TOPIC permission. A session that has TOPIC_PERMISSION_READ_TOPIC but not TOPIC_PERMISSION_SELECT_TOPIC for a particular topic path cannot subscribe directly to topics belonging to the path. However, the session can be independently subscribed by a control session that has GLOBAL_PERMISSION_MODIFY_SESSION permission in addition to the appropriate TOPIC_PERMISSION_SELECT_TOPIC permission.

TOPIC_PERMISSION_ACQUIRE_LOCK 

Acquire a session lock.

TOPIC_PERMISSION_UNKNOWN 

A permission that is unsupported by the session.