[rabbitmq-discuss] Access control documentation

[Anthony]

Hi Ben,

> Because of this, it was decided to drop them from the new version of
> the spec, and hence, they have now disappeared from Rabbit as well.
> ...
> So you are left with vhost based ACLs, for which there is
> documentation in the server admin guide.
> ...
> Vhost ACL would do this, but in a coarse grained all or nothing
> fashion (realms used to give fine grained control).

This would sound like a significant step backwards and place a larger
security onus on front-end systems, no?

I've read through the AMQP spec you linked for me (thanks!) - so I'm
clear, is the following right?

1. If a given data stream is to be accessible in a specific vhost, the
source of this data must connect to the given vhost and put it in
there - streams cannot be shared/published/mirrored to multiple vhosts
without an explicit connection by the source to each vhost in its own
connection.

2. If a given stream is in the same vhost you authenticate into, you
have full access with no limitations to it (all or nothing).

Am not bagging RabbitMQ here, as what it sounds like, it's just that
the other implementers didn't quite get it.. But it just seems like a
big loss to lose realms from the spec.

--
Regards,

Anthony Hogan
System Administrator