9 Security and DACL


This page has not been completed yet.

HORB has several features for security.

9.1 Distributed Access Control List

You can specify hosts and users that are allowed to access to a class or a method in ACL (Access Control List). HORB's ACL is newly invented Distributed ACL. That is, you can conbine some ACLs, one from a file, another from a remote HORB server for example, into one integrated ACL. The conbination should be described in a configuration file. See the previous section for detail. If you use the distribution feature of DACL, you can manage the security of large number of machines like an inheritance tree of object orientated programming. If you change an ACL file, the modification will automatically propagate to other machines.

An ACL file is a set of an ACL name, class access control lists, password lists. Here is very informal syntax of an ACL file.

        name=acl_name
        className.host=hostname networkaddress domain...
        className.host_exclude=hostname networkaddress domain...
        className.user=username1 username2...
        className.user_exclude=username1 username2...
        className.creatable=false
        className2....
        className3....
        username1.password: lklaskjdf
        username2....
        username3....

Here is an example:

        name=etl_acl
        horb.orb.HORBAgent.host=bungo.etl.go.jp 192.31.99.23
        WClock.Test.host=etl.go.jp 192.31.*.*
        WCLock.Test.host_exclude=gate.etl.go.jp ftp.etl.go.jp
        WCLock.Test.user=hirano connelly larry
        WCLock.Test.user_exclude=hashimoto anonymous
        hirano.password=LKU&232ZC
        guest.password=*
        default.host=*
        default.host_exclude=gate.etl.go.jp
        default.user=*
        default.user_exclude=anonymous

If ACL system is enabled in a HORB server, client must pass the following access control.

  1. Client's host name or network address must be included in the class' host include list or default host include list if class' host include list is not exists.
  2. Clien't host name or network address must not be included in the class' host exclude list or default host exclude list if class' host exclude list is not exists.
  3. Client's username must be included in the class' user include list or default user include list if class' user include list is not exists.
  4. Client's password must match with user's password.
  5. Clien't username must not be included in the class' user exclude list or default user exclude list if class' user exclude list is not exists.

String matching is case insensitive. Thus Bungo.Etl.Go.Jp matches with etl.go.jp. As default, access control is performed for classes. However, if you need, you can control accesses for objects, methods or other in your program. You will see an example in the next subsection.

Components of an ACL file:

ACL Name
name is the name of the ACL file. It is used to distinguish ACL file when another machine donwload the ACL file from this machine.

Hostname list is a space separated list of hostnames and/or network addresses.

Host Include List
A list with a key suffixed by ".host" is called a host include list. A hostname is either a domain name or a host name. Actually string matching is performed to compare client's hostname with this name. If client's hostname ends with this name, the matching succeeds. For example, bungo.etl.go.jp matches with etl.go.jp in the list. Note that abcetl.go.jp also matches with etl.go.jp. If client has the name of bungo instead of bungo.etl.go.jp, it does not match with etl.go.jp. You can use "localhost" to represent the local hostname.
Dot separated numbers represent network addresses. Each number must be in the range 0 to 255. You can usecharacter to represent "any number". For example, 192.31.22.* allows access from 192.31.22.1 to 192.31.22.255. 192.31.22.* is equivalent to 192.31.22.0 internally. Use *.*.*.* orto represent any host. ACL does not depends on IP address. That is, you can use arbitrary length of dot separated byte sequences.

(The future version will support network masks.)

Host Exclude List
A list with a key suffixed by ".host_exclude" is called a host exclude list. Hosts appear in this list are not allowed to access this class.
User Include List
A list with a key suffiexed by ".user" is called a user include list. Clien't username must appear in this list to access the class. Use "*" to represent any user. If client does not give a username, the user is treated as "anonymous".
User Exclude List
A list with a key suffixed by ".user_exclude" is called a user exclude list. Users that appear in this list are not allowed to access this class.
User Password
Each user appears in the user include list must have password entry. A password entry is a non-encrypted string. Encryption will be supported in the future release. Otherwise, if you need an encrypted password, do encryption in your program. If you don't need password, give "*" as password. It matches to any password.
Creatable Flag
If there exist a line like "className.creatable=false", the class is not allowed to create remotely. Clients are allowed only to connect the object. If this flag does not exists, clients can create objects of the class.
Default Host Include List
If requested class has no host include list in ACL, "default.host" is checked if it exists. Default host include list is optional.
Default Host Exclude List
If requested class has no host exclude list in ACL, "default.host_exclude" is checked if it exists. Default host exclude list is optional.
Default User Include List
If requested class has no user include list in ACL, "default.user" is checked if it exists. Default user include list is optional.
Default User Exclude List
If requested class has no user exclude list in ACL, "default.user_exclude" is checked if it exists. Default user exclude list is optional.

9.2 Use ACL in Program

See examples/accessControl for examples.

ACL can be accessed in a program. You can limit access to specific methods or specific objects for example. In this subsection an example of authentication and finer access control will be shown. This class Server has two methods, one is a safety one named greeting(), but the other is a dangerous one named dangerous(). In dangerous() system ACL is checked to see the user of a client can access this method or not.

        package horb.examples.accessControl;

        import horb.orb.*;

        public class Server {
          public String greeting() throws HORBException {
            IOCIService ioci = HORBServer.getIOCIService();
            return ioci.getUsername()+" is allowed to access object Server.";
          }

          public String dangerous() throws HORBException {
            IOCIService ioci = HORBServer.getIOCIService();
            ACL acl = HORBServer.getSystemACL();
            if (acl.checkUser_Local("horb.examples.accessControl.Server.dangerous", ioci) == true)
              return ioci.getUsername()+" is allowed to access Server.dangerous()";
            else
              return ioci.getUsername()+" is NOT allowed to access Server.dangerous()";
          }
        }

Obviously ACL must include lines like the following:

        horb.examples.accessControl.Server.user=*
        horb.examples.accessControl.Server.dangerous.user=administrator
        administrator.password=LX242SC

The client side must supply username and password. Any proxy object has another constructor that takes username ans password as arguments.

      Server_Proxy server = new Server_Proxy(url, user, pw);

If a user give "hirano" rather than "administrator", this line will throw NoPermissionException;

9.3 Distributed Security Management by DACL

See examples/accessControl/README.txt EXAMPLE3.