ACL has been edited by Martin Ritchie (Aug 09, 2008).

(View changes)


ACL file format for brokers.

 Notes on file formats

  • A line starting with the character '#' will be considered a comment, and are ignored.
  • Since the '#' char (and others that are commonly used for comments) are commonly found in routing keys and other AMQP literals, it is simpler (for now) to hold off on allowing trailing comments (ie comments in which everything following a '#' is considered a comment). This could be reviewed later once the rest of the format is finalized.
  • Empty lines ("") and lines that contain only whitespace (any combination of ' ', '\f', '\n', '\r', '\t', '\v') are ignored.
  • All tokens are case sensitive. "name1" != "Name1" and "create" != "CREATE".
  • Group lists may be extended to the following line by terminating the line with the '\' character. However, this may only occur after the group name or any of the names following the group name. Empty extension lines (ie just a '\' character) are not permitted.
    # Examples of extending group lists using a trailing '\' character
    group group1 name1 name2 \
                 name3 name4 \
    group group2 \
                 group1 \
    # The following are illegal:
    # '\' must be after group name
    group \
          group3 name7 name8
    # No empty extension lines
    group group4 name9 \
  • Additional whitespace (ie more than one whitespace char) between and after tokens is ignored. However group and acl definitions must start with "group" or "acl" respectively and with no preceding whitespace.
  • All acl rules are limited to a single line.
  • Rules are interpreted from the top of the file down until the name match is obtained; at which point processing stops.
  • The keyword "all" is reserved, and matches all individuals, groups and actions. It may be used in place of a group or individual name and/or an action - eg "acl allow all all", "acl deny all all" or "acl deny user1 all".
  • The last line of the file (whether present or not) will be assumed to be "acl deny all all". If present in the file, any lines below this one are ignored.
  • Names and group names may contain only a-z, A-Z, 0-9, '-','_'.
  • Rules must be preceded by any group definitions they may use; any name not previously defined as a group will be assumed to be that of an individual.
  • ACL rules must have the following tokens in order on a single line:
    • The string literal "acl";
    • The permission;
    • The name of a single group or individual or the keyword "all";
    • The name of an action or the keyword "all";
    • Optionally, a single object name or the keyword "all";
    • If the object is present, then optionally one or more property name-value pair(s) (in the form property=value).
user-list = user1 user2 user3 ...
group-name-list = group1 group2 group3 ...

group <group-name> = [user-list] [group-name-list]

permission = [allow|allow-log|deny|deny-log]
action = [consume|publish|create|access|bind|unbind|delete|purge|update]
object = [virtualhost|queue|exchange|broker|link|route]
property = [name|durable|owner|routingkey|passive|autodelete|exclusive|type|alternate|queuename]

acl permission {<group-name>|<user-name>|"all"} {action|"all"} [object|"all"] [property=<property-value>]

Example file:

# Some groups
group admin ted martin
group user-consume martin ted
group group2 kim user-consume rob
group publisher group2 \
                tom andrew debbie

# Some rules
acl allow carlt create exchange name=carl.*
acl deny rob create queue
acl allow guest bind exchange name=amq.topic  owner=self
acl allow user-consume create queue name=tmp.*

acl allow publisher publish all durable=false
acl allow publisher create queue name=RequestQueue
acl allow consumer consume queue durable=true
acl allow fred create all
acl allow admin all
acl deny kim all
acl allow all consume queue owner=self
acl allow all bind exchange owner=self

# Last (default) rule
acl deny all all

Mapping of ACL traps to action and type

The C++ broker maps the ACL traps in the follow way for AMQP 0-10:
The Java broker currently only performs ACLs on the AMQP connection not on management functions:

The Java broker currently only performs ACLs on the AMQP connection not on management functions:

Object Action Properties Trap C++ Trap Java
Exchange Create name type alternate passive durable ExchangeHandlerImpl::declare ExchangeDeclareHandler
Exchange Delete name ExchangeHandlerImpl::delete ExchangeDeleteHandler
Exchange Access name ExchangeHandlerImpl::query
Exchange Bind name routingkey queuename owner ExchangeHandlerImpl::bind QueueBindHandler
Exchange Unbind name routingkey ExchangeHandlerImpl::unbind ExchangeUnbindHandler
Exchange Access name queuename routingkey ExchangeHandlerImpl::bound
Exchange Publish name routingKey SemanticState::route BasicPublishMethodHandler
Queue Access name QueueHandlerImpl::query
Queue Create name alternate passive durable exclusive autodelete QueueHandlerImpl::declare QueueDeclareHandler
Queue Purge name QueueHandlerImpl::purge QueuePurgeHandler
Queue Purge name Management::Queue::purge
Queue Delete name QueueHandlerImpl::delete QueueDeleteHandler
Queue Consume name (possibly add in future?) MessageHandlerImpl::subscribe BasicConsumeMethodHandler
<Object> Update   ManagementProperty::set
<Object> Access   ManagementProperty::read
Link Create   Management::connect
Route Create   Management:: -createFederationRoute-
Route Delete   Management:: -deleteFederationRoute-
Virtualhost Access name TBD ConnectionOpenMethodHandler

Management actions that are not explicitly given a name property it will default the name property to management method name, if the action is 'W' Action will be 'Update', if 'R' Action will be 'Access'.

for example, if the mgnt method 'joinCluster' was not mapped in schema it will be mapped in ACL file as follows

Object Action Property
Broker Update name=joinCluster

Powered by Atlassian Confluence (Version: 2.2.9 Build:#527 Sep 07, 2006) - Bug/feature request

Unsubscribe or edit your notifications preferences