Configuring Access Control

Define access control policies that specify user roles, the actions available to each role, and the resources on which the actions can be performed. If Event Stream Processor is configured to authenticate through the native OS or preconfigured logins, enable access control. Set up role mapping.

1. Use any text editor to open the policy file, ESP_HOME/security/policy.xml.
2. To start a new policy, add <Policy> tags to the <Policies> element.
   You can include more than one <Policy> within the <Policies> tags.
3. Specify the policy type as Project, Node, or Cluster. For example:

   <Policy type="Project">

4. To create a new role for the policy, add <Role> tags within <Subjects> tags.
   You can include more than one role in the <Subjects> tags. However, all the roles defined in one <Policy> element are associated with the same set of resources and actions. For a role with different resources and actions, create a separate policy using the <Policy> tag.
5. Add a group or role to the new role being created within the <Role> tags.
6. To associate resources with the role, specify each resource with <Resource> tags, and enclose these in the <Resources> element.
7. To associate actions with the resources, specify each action (read, write, start, or stop) with <Action> tags and enclose these in the <Actions> element.
8. Save and exit the file.
9. (Optional) If you are configuring access control for use with native OS authentication, edit ESP_HOME/security/csi_native_nt.xml or ESP_HOME/security/csi_native_unix.xml to enable access control.
   1. Put comment tags (<!-- and -->) around the line that configures the NoSecAuthorizer provider.
   2. Uncomment the line that configures the RoleCheckAuthorizer provider.
   3. If the roles in your policy file do not correspond to existing groups in your OS, also uncomment the lines that configure the XMLFileRoleMapper provider and specify the role map file, csi_role_mapping.xml.
   This sample csi_native_unix.xml file enables access control and role mapping (RoleCheckAuthorizer and XMLFileRoleMapper, which points to csi_role_mapping.xml, are outside the comment tags, while NoSecAuthorizer is inside).

   <?xml version="1.0" encoding="UTF-8"?>
   <config:configuration xmlns:config=http://www.sybase.com/csi/2.5/config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
     <config:authenticationProvider controlFlag="sufficient" name="com.sybase.security.os.UnixProxyLoginModule"/>
     <config:provider name="com.sybase.security.core.NoSecAttributer" type="attributer"/>
     <config:provider name="com.sybase.security.core.RoleCheckAuthorizer" type="authorizer"/>
     <config:provider name="com.sybase.security.core.XMLFileRoleMapper" type="roleMapper">
       <config:options name="RoleMapFile" value="${esp.home}/security/csi_role_mapping.xml"/>
     </config:provider>
     <!--
     <config:provider name="com.sybase.security.core.NoSecAuthorizer" type="authorizer"/>
     -->
   </config:configuration>
   

10. (Optional) If you are configuring access control for use with preconfigured logins, edit ESP_HOME/security/csi_local.xml to enable access control.
    1. Put comment tags (<!-- and -->) around the line that configures the NoSecAuthorizer provider.
    2. Add this line inside the <configuration> element

    <provider name="com.sybase.security.core.RoleCheckAuthorizer" type="authorizer"/>
    

11. (Optional) For preconfigured logins, configure roles in csi_local.xml that match the ones in policy.xml.
    Add roles in the <options> element, and put the <options> element in the same <authenticationProvider> element as the login’s user name and password. You can include multiple role names in the value field—separate them with commas. This sample <authenticationProvider> defines a login called sybase whose roles are espAdmin, espUser, and investment:

      <authenticationProvider controlFlag="sufficient" name="com.sybase.security.core.PreConfiguredUserLoginModule">
        <options name="username" value="sybase"/>
        <options name="password" value="{SHA-256:gIQWZYOPQVM=}jqHtsTPcw8kGkZt1PQeveUAhQncAQhHXJBrjZAqTfk4="/>
        <options name="roles" value="espAdmin,espUser,investment"/>
      </authenticationProvider>
    

    If the file contains more than one login, configure roles for each one.
12. (Optional) If you are using role mapping with LDAP or native OS authentication, modify ESP_HOME/security/csi_role_mapping.xml to map roles specified in your policy file to groups in LDAP, Windows, or UNIX.
    Use a Mapping element for each mapping. LogicalName is the role in your policy file; MappedName is the group whose members need that role. This is a sample mapping:

    <Mapping>
      <LogicalName>investment</LogicalName>
      <MappedName>espInvestmentRole</MappedName>
    </Mapping>
    

<Policies>
  <Policy type= "Project">
        <Subjects>
           <Role>investment</Role>
        </Subjects>
        <Resources>
          <Resource>Default/PassThrough/vwapTrades</Resource>
          <Resource>Default/Pass1</Resource>
        </Resources>
        <Actions>
	      <Action>read</Action>
	      <Action>write</Action>
	      <Action>stop</Action>
	      <Action>start</Action>
        </Actions>
  </Policy> 
</Policies>