Skip to main content
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [leshan-dev] [External] : Re: Enforcement of Permissions from Access Control Objects
  • From: Peter Sramka <peter.sramka@xxxxxxxxxx>
  • Date: Thu, 16 Jun 2022 03:04:05 +0000
  • Accept-language: en-US
  • Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oracle.com; dmarc=pass action=none header.from=oracle.com; dkim=pass header.d=oracle.com; arc=none
  • Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5SarVsLDU40iec+pMXiGJyhFrSC4xPoBXqngEDQJH/8=; b=ZI3q7T1/KPAeCgUNl4kPOkzVNb0dFX+kB74avnXnpq5nY+muLXIOZ12AJ5Iojp816sTt5qtRFEBXkzwSACEsuwYumXXtiljutOVBc8L7GHV8qgViKCLPffhTpo9txGvLw3wnV4X6sA5guzCjUjbbh7iRO2sPKzhJqVCbWuQeeT8yGbZzrqHLlwiohgZ56Fc8RiwEYMePlnNRV0eTKJJvjgP0Nc7sNiMICq/Ixx03m6p6zQ7J2Ki0djfbaYgxpdo3XG/Cmnuvj2cg1sSPDIS+umI/m8i0qZr98KiWiIffmjH/fDqPAvG8MhBxcQpL6kFLy07n6eBvl2Uz53Vph3/Ybg==
  • Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TqFjJsVqnMe7QavczswEuNJIoe/XKCZEjdZSMY16hIz+k+fCsoGqJP7lM/+7LGfdP5laBUCoFzLgGve7t1ASZmQrnWBF0ZYeJ+i+KmLCeltcDTj1iM91V8EVPrc63aehtPNqaXTe125jqrHLLw6HnQ9F7PehWfsw2apmag/6J0rvgYhO4/v3yCmLEow01zXFLhyVoNk3F1oek/cny76hIOd+FIJstiaZw9ngtc7joJNzmijBwVOAoi/9gUI5J3ArsbJLAzu9Rnc4qP3vRQL8Wr6GtABvX+6ZAl1uEJM0+1/he5A3EhUNaGkNR3vqJZvbUab0vpy1VmiUtf4o4Y9h1A==
  • Delivered-to: leshan-dev@xxxxxxxxxxx
  • List-archive: <https://www.eclipse.org/mailman/private/leshan-dev/>
  • List-help: <mailto:leshan-dev-request@eclipse.org?subject=help>
  • List-subscribe: <https://www.eclipse.org/mailman/listinfo/leshan-dev>, <mailto:leshan-dev-request@eclipse.org?subject=subscribe>
  • List-unsubscribe: <https://www.eclipse.org/mailman/options/leshan-dev>, <mailto:leshan-dev-request@eclipse.org?subject=unsubscribe>
  • Thread-index: AQHYf0bwO76xFuyjMkucIQ6zFCXk161OkiaAgALKEhs=
  • Thread-topic: [External] : Re: [leshan-dev] Enforcement of Permissions from Access Control Objects

I understand what you are saying about the security being at the object level and not the resource level. Thank you for pointing this out.

 

  • When to you plan to apply this configuration ? at factory or by a bootstrap server or ?

Bootstrap server

 

Thanks,

Peter

 

From: leshan-dev <leshan-dev-bounces@xxxxxxxxxxx> on behalf of Simon Bernard <contact@xxxxxxxxxxxxxxx>
Date: Tuesday, June 14, 2022 at 4:26 AM
To: leshan-dev@xxxxxxxxxxx <leshan-dev@xxxxxxxxxxx>
Subject: [External] : Re: [leshan-dev] Enforcement of Permissions from Access Control Objects

I am assuming that all three of these URLs are based on the newest 2.x code. Is this correct?

That's correct.

We would want to code up an object implementation only one time with all possible functionality, use that implementation for all client/server pairs, but restrict what each client/server pair can do with permissions.

I don't know if ACL match your use case, reading the specification I understand that ACL granularity is object or/and object_instance but not resource or resource instance, So you can say this server can access to this object_instance but not this one.  For same object_instance, you can not say this server can access to resource A and B but not to "resource" C. (not sure I'm clear)

See : http://www.openmobilealliance.org/release/LightweightM2M/V1_1_1-20190617-A/HTML-Version/OMA-TS-LightweightM2M_Core-V1_1_1-20190617-A.html#8-0-8-Access-Control


use that implementation for all client/server pairs, but restrict what each client/server pair can do with permissions.

So there is a kind of configuration. When to you plan to apply this configuration ? at factory or by a bootstrap server or ?

Le 13/06/2022 à 18:59, Peter Sramka a écrit :

Thank you for your quick response. Please keep in mind that I am very new to LwM2M and Leshan. If anything I write in this email indicates that I have an incorrect understanding of these subjects, please correct me.

 

  1. Which part of Leshan do you plan to reuse ? which version ?

We would use the client, server and bootstrap server libraries, so pretty much all of it. I have been working with version 2.x of the source code. I have also been using the demos from these URLs:

https://ci.eclipse.org/leshan/job/leshan/lastSuccessfulBuild/artifact/leshan-server-demo.jar

https://ci.eclipse.org/leshan/job/leshan/lastSuccessfulBuild/artifact/leshan-client-demo.jar

https://ci.eclipse.org/leshan/job/leshan/lastSuccessfulBuild/artifact/leshan-bsserver-demo.jar

I am assuming that all three of these URLs are based on the newest 2.x code. Is this correct?

 

  1. When your client support only 1 server not sure to see how you can use ACL ?

We would only be using one server per client. However, we will have many client/server pairs. We would want to code up an object implementation only one time with all possible functionality, use that implementation for all client/server pairs, but restrict what each client/server pair can do with permissions.

 

  1. which part of Leshan do you need

The client, server and bootstrap server, so basically everything.

 

  1. which version of LWM2M

We would want to use the latest supported version possible. Right now, I think 1.1.x is most likely.

 

  1. describe a bit more the use case, etc.

We are building a general-purpose product that will be used by multiple customers. (With each customer having multiple client/server pairs). Data would be collected and analyzed from a wide variety of different sources, so maximum flexibility and generality is preferred.

 

Thanks,

Peter

 

From: leshan-dev <leshan-dev-bounces@xxxxxxxxxxx> on behalf of Simon Bernard <contact@xxxxxxxxxxxxxxx>
Date: Monday, June 13, 2022 at 4:37 AM
To: leshan-dev@xxxxxxxxxxx <leshan-dev@xxxxxxxxxxx>
Subject: [External] : Re: [leshan-dev] Enforcement of Permissions from Access Control Objects

Hi,

I work for Oracle. We are evaluating Leshan for possible inclusion into a software product that we are developing.

Good to hear.
Which part of Leshan do you plan to reuse ? which version ?

I cannot find anywhere in the code where this variable is used to enforce permissions for servers attempting to perform operations on objects.

This class is used by Bootstrap Server.
This aims to store the ACL configuration which will be used to create request about populating ACL Object (2) to the client during a bootstrap session.
(So this is not aimed to be used by the client directly)



Does the code enforce permissions for servers attempting to perform operations on objects?

This concerns the client part and this is not implemented for now in Leshan Client. (See https://github.com/eclipse/leshan/wiki/LWM2M-Supported-features#access-control)
By the way, note that Leshan Client does not support multi server too and ACL is mostly useful in this case. When your client support only 1 server not sure to see how you can use ACL ? (except maybe for testing purpose?)
But you should be able to use Leshan Bootstrap Server to configure another LWM2M client which supports ACL.



If no, are there any plans to add such a feature to the code?

Not planned for now.
I think this should be possible for you to add this kind of behavior without code modification in Leshan Library. (see this old thread maybe not so up to date : https://github.com/eclipse/leshan/issues/403#issuecomment-337162354)
But depending of your needed, maybe we can also consider to add it to Leshan library.
So please describe more precisely your needs ? (which part of Leshan do you need, which version of LWM2M, describe a bit more the use case, etc. )

Simon

 

Le 11/06/2022 à 03:04, Peter Sramka a écrit :

I work for Oracle. We are evaluating Leshan for possible inclusion into a software product that we are developing.

 

I was looking at the nested class ACLConfig which starts at line 356 of this file:

https://github.com/eclipse/leshan/blob/master/leshan-server-core/src/main/java/org/eclipse/leshan/server/bootstrap/BootstrapConfig.java

This class has an instance variable acls. I cannot find anywhere in the code where this variable is used to enforce permissions for servers attempting to perform operations on objects.

 

Does the code enforce permissions for servers attempting to perform operations on objects?

If yes, please direct me to the place in the source code where this is happening.

If no, are there any plans to add such a feature to the code?

 

Thank you,

Peter Sramka

Principal Engineer

Oracle

 




_______________________________________________
leshan-dev mailing list
leshan-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/leshan-dev



_______________________________________________
leshan-dev mailing list
leshan-dev@xxxxxxxxxxx
To unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/leshan-dev

Back to the top