Mailing-List: contact user-help@karaf.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@karaf.apache.org
Date: Thu, 31 Aug 2017 13:25:03 +0100 (BST)
From: tom@quarendon.net
Reply-To: tom@quarendon.net
To: user@karaf.apache.org
Message-ID: <1399712785.3006068.1504182307759@webmail.123-reg.co.uk>
In-Reply-To: <59b2dec6-9d2f-7982-e857-ff6ad3aff8ab@nanthrax.net>
References: <1758919573.2996844.1504175748666@webmail.123-reg.co.uk>
 <59b2dec6-9d2f-7982-e857-ff6ad3aff8ab@nanthrax.net>
Subject: Re: Console role based access control and command completion
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Importance: Medium
archived-at: Thu, 31 Aug 2017 12:25:11 -0000

Hmm, OK.
There's a comment somewhere that implies that someone had at least at some =
point tried doing that or thought that was what happened.

It leads to *slightly* odd behaviour, of being told that a command exists, =
but then being told, "oh wait, not it doesn't".

Thanks anyway.

> On 31 August 2017 at 13:02 Jean-Baptiste Onofr=C3=A9 <jb@nanthrax.net> wr=
ote:
>=20
>=20
> Hi Tom,
>=20
> We don't use the ACL in the completers, only on the action step. That's w=
hy you=20
> can complete but not execute.
>=20
> Regards
> JB
>=20
> On 08/31/2017 12:35 PM, tom@quarendon.net wrote:
> > If I'm logged on to the console as user, the list of commands I can exe=
cute is controlled by access control lists.
> > So, if I'm logged on as a user who has only got the "viewer" role, then=
 I can't shut karaf down, the system:shutdown command requires the "admin" =
role.
> >=20
> > Great.
> >=20
> > However, I still appear to be able to get command completion that syste=
m:shutdown is a command, but when I try and invoke it I get "Command not fo=
und: system:shutdown", which seems confusing.
> >=20
> > Is this intentional? I saw a comment in the code somewhere (lost it now=
) that made me think that the intention was that only commands I can actual=
ly invoke are then put in the completion list, and indeed that would seem l=
ike reasonable behaviour.
> >=20
>=20
> --=20
> Jean-Baptiste Onofr=C3=A9
> jbonofre@apache.org
> http://blog.nanthrax.net
> Talend - http://www.talend.com