[JBoss JIRA] Created: (TEIID-1246) Determine access strategy for SYS/pg_catalog
by Steven Hawkins (JIRA)
Determine access strategy for SYS/pg_catalog
--------------------------------------------
Key: TEIID-1246
URL: https://jira.jboss.org/browse/TEIID-1246
Project: Teiid
Issue Type: Quality Risk
Components: Query Engine
Affects Versions: 7.1
Reporter: Steven Hawkins
Assignee: Steven Hawkins
Fix For: 7.1.1
The SYS and pg_catalog schema mainly exist for metadata reporting. It would probably be good to make the always be accessable.
The only issue is what the access policy should be for the system procedures:
GETCHARACTERVDBRESOURCE
GETBINARYVDBRESOURCE
GETVDBRESOURCEPATHS
GETXMLSCHEMAS
refreshMatVeiw
refreshMatVeiwRow
The first three are probably no longer useful as general procedures. I'm not familiar with any customer usage. Unless someone adds custom files to a VDB, the only thing that could be retrieved are the visible model xmis and schemas.
The fourth procedure is really just a helper method to get at schemas associated with a particular document model. These resources would already be accessible via getXXXVDBResource. Again I'm not aware of customer usage for this procedure.
Since they are read-only and restricted to only visible entries we could just as easily always allow access to the GET procedures, or we could just as easily remove them all since they aren't particularly useful.
That leaves us with the refresh procedures. Theses do perform update actions and should be restricted. One possibility is to restrict their usage based upon the permissions of the target view. The other option is to move them into a sub schema e.g. SYS.admin.refreshMatView that would be subject to access restrictions, and can be more easily targeted by explicit roles. If we went the role route, then the tooling could have a button to "create admin role" that would create a role named admin with all permissions including permissions against SYS.admin.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 2 months
[JBoss JIRA] Created: (TEIID-1187) Refine vdb version logic
by Steve Hawkins (JIRA)
Refine vdb version logic
------------------------
Key: TEIID-1187
URL: https://jira.jboss.org/browse/TEIID-1187
Project: Teiid
Issue Type: Quality Risk
Components: Server
Affects Versions: 7.1
Reporter: Steve Hawkins
Assignee: Steve Hawkins
Fix For: 7.1
We no longer have a built in configuration repository and we rely on container scans to do deploys, so we have lost the ability to internally control the notion of a deployed vdb version.
We should strive for the following:
1. Overwrite of a deployed vdb should not invalidate or otherwise corrupt current connections.
2. Switching to a different vdb as the new default for a particular name should not require two deployments of the same vdb.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 2 months
[JBoss JIRA] Created: (TEIID-1055) Secure profile service access
by Ramesh Reddy (JIRA)
Secure profile service access
-----------------------------
Key: TEIID-1055
URL: https://jira.jboss.org/jira/browse/TEIID-1055
Project: Teiid
Issue Type: Task
Components: AdminApi
Affects Versions: 7.0
Reporter: Ramesh Reddy
Fix For: 7.0
As of 7.0 M3 release, the "Profile Service" access is not secure. Currently the JOPR plug-in and Teiid Admin API, force users to authenticate with "jmx-console" security domain, both these do not prevent the direct access to the "Profile Service" EJB directly.
Profile Service can be deployed as secure EJB, such that it would require a login context to be authenticated before user has access to this bean. This needs to be configured and tested. Also document, how to configure the profile service as secure service.
Also, AdminFactory class, which provides Admin connections, need to work with secure "Profile Service".
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 2 months