



9 Security and DACL
This page has not been completed yet.
HORB has several features for security.
9.1 Distributed Access Control List
You can specify hosts and users that are allowed to access to a class
or a method in ACL (Access Control List). HORB's ACL is newly invented
Distributed ACL. That is, you can conbine some ACLs, one from a file, another
from a remote HORB server for example, into one integrated ACL. The conbination
should be described in a configuration file. See the previous
section for detail. If you use the distribution feature of DACL, you
can manage the security of large number of machines like an inheritance
tree of object orientated programming. If you change an ACL file, the modification
will automatically propagate to other machines.
An ACL file is a set of an ACL name, class access control lists, password
lists. Here is very informal syntax of an ACL file.
name=acl_name
className.host=hostname networkaddress domain...
className.host_exclude=hostname networkaddress domain...
className.user=username1 username2...
className.user_exclude=username1 username2...
className.creatable=false
className2....
className3....
username1.password: lklaskjdf
username2....
username3....
Here is an example:
name=etl_acl
horb.orb.HORBAgent.host=bungo.etl.go.jp 192.31.99.23
WClock.Test.host=etl.go.jp 192.31.*.*
WCLock.Test.host_exclude=gate.etl.go.jp ftp.etl.go.jp
WCLock.Test.user=hirano connelly larry
WCLock.Test.user_exclude=hashimoto anonymous
hirano.password=LKU&232ZC
guest.password=*
default.host=*
default.host_exclude=gate.etl.go.jp
default.user=*
default.user_exclude=anonymous
If ACL system is enabled in a HORB server, client must pass the following
access control.
- Client's host name or network address must be included in the class'
host include list or default host include list if class' host include list
is not exists.
- Clien't host name or network address must not be included in the class'
host exclude list or default host exclude list if class' host exclude list
is not exists.
- Client's username must be included in the class' user include list
or default user include list if class' user include list is not exists.
- Client's password must match with user's password.
- Clien't username must not be included in the class' user exclude list
or default user exclude list if class' user exclude list is not exists.
String matching is case insensitive. Thus Bungo.Etl.Go.Jp matches with
etl.go.jp. As default, access control is performed for classes. However,
if you need, you can control accesses for objects, methods or other in
your program. You will see an example in the next subsection.
Components of an ACL file:
- ACL Name
- name is the name of the ACL file. It is used to distinguish ACL file
when another machine donwload the ACL file from this machine.
Hostname list is a space separated list of hostnames and/or network
addresses.
- Host Include List
- A list with a key suffixed by ".host" is called a host include
list. A hostname is either a domain name or a host name. Actually string
matching is performed to compare client's hostname with this name. If client's
hostname ends with this name, the matching succeeds. For example, bungo.etl.go.jp
matches with etl.go.jp in the list. Note that abcetl.go.jp also matches
with etl.go.jp. If client has the name of bungo instead of bungo.etl.go.jp,
it does not match with etl.go.jp. You can use "localhost" to
represent the local hostname.
Dot separated numbers represent network addresses. Each number must
be in the range 0 to 255. You can usecharacter to represent "any number".
For example, 192.31.22.* allows access from 192.31.22.1 to 192.31.22.255.
192.31.22.* is equivalent to 192.31.22.0 internally. Use *.*.*.* orto
represent any host. ACL does not depends on IP address. That is, you
can use arbitrary length of dot separated byte sequences.
(The future version will support network masks.)
- Host Exclude List
- A list with a key suffixed by ".host_exclude" is called a
host exclude list. Hosts appear in this list are not allowed to access
this class.
- User Include List
- A list with a key suffiexed by ".user" is called a user include
list. Clien't username must appear in this list to access the class. Use
"*" to represent any user. If client does not give a username,
the user is treated as "anonymous".
- User Exclude List
- A list with a key suffixed by ".user_exclude" is called a
user exclude list. Users that appear in this list are not allowed to access
this class.
- User Password
- Each user appears in the user include list must have password entry.
A password entry is a non-encrypted string. Encryption will be supported
in the future release. Otherwise, if you need an encrypted password, do
encryption in your program. If you don't need password, give "*"
as password. It matches to any password.
- Creatable Flag
- If there exist a line like "className.creatable=false", the
class is not allowed to create remotely. Clients are allowed only to connect
the object. If this flag does not exists, clients can create objects of
the class.
- Default Host Include List
- If requested class has no host include list in ACL, "default.host"
is checked if it exists. Default host include list is optional.
- Default Host Exclude List
- If requested class has no host exclude list in ACL, "default.host_exclude"
is checked if it exists. Default host exclude list is optional.
- Default User Include List
- If requested class has no user include list in ACL, "default.user"
is checked if it exists. Default user include list is optional.
- Default User Exclude List
- If requested class has no user exclude list in ACL, "default.user_exclude"
is checked if it exists. Default user exclude list is optional.
9.2 Use ACL in Program
See examples/accessControl
for examples.
ACL can be accessed in a program. You can limit access to specific methods
or specific objects for example. In this subsection an example of authentication
and finer access control will be shown. This class Server has two methods,
one is a safety one named greeting(), but the other is a dangerous one
named dangerous(). In dangerous() system ACL is checked to see the user
of a client can access this method or not.
package horb.examples.accessControl;
import horb.orb.*;
public class Server {
public String greeting() throws HORBException {
IOCIService ioci = HORBServer.getIOCIService();
return ioci.getUsername()+" is allowed to access object Server.";
}
public String dangerous() throws HORBException {
IOCIService ioci = HORBServer.getIOCIService();
ACL acl = HORBServer.getSystemACL();
if (acl.checkUser_Local("horb.examples.accessControl.Server.dangerous", ioci) == true)
return ioci.getUsername()+" is allowed to access Server.dangerous()";
else
return ioci.getUsername()+" is NOT allowed to access Server.dangerous()";
}
}
Obviously ACL must include lines like the following:
horb.examples.accessControl.Server.user=*
horb.examples.accessControl.Server.dangerous.user=administrator
administrator.password=LX242SC
The client side must supply username and password. Any proxy object
has another constructor that takes username ans password as arguments.
Server_Proxy server = new Server_Proxy(url, user, pw);
If a user give "hirano" rather than "administrator",
this line will throw NoPermissionException;
9.3 Distributed Security Management by DACL
See examples/accessControl/README.txt EXAMPLE3.