Dell DX6000 Application Manual

Also see for DX6000: Manual Supplementary guide Hardware installation instructions Hardware owner's manual Administration guide

Contents

Copyright © 2010 Caringo, Inc.All rights reserved 43Version 5.0December 2010Chapter 12. Introduction to Object SecurityStarting with DX Storage version 5.0, you can optionally provide security for domains, buckets,named objects, and unnamed objects. Because the UUIDs of unnamed objects are difficult toremember or to guess, this chapter focuses on providing security for named objects.The same procedures can be used to provide security to unnamed objects; however, note thefollowing:• Unnamed objects must be referenced by UUID.• Security commands for unnamed anchor stream objects must include the alias=yes queryargument.• All unnamed objects belong to the default cluster domain.• POST authentication for creating unnamed objects is enforced in the default cluster domain only.For more information about the default cluster domain, contact your cluster administrator.For more information about managing security for named objects, see the following topics:• Section 12.1, “About Security Roles”• Section 12.2, “Security Realm Overview”• Section 12.3, “About Authorization Header Syntax”• Section 12.5, “About Authorization Header Evaluation”• Section 12.6, “Creating Realms”• Section 12.7, “Updating the Realm on a Bucket”• Section 12.8, “Administrative Override and Security”12.1. About Security RolesDX Storage uses the following roles to determine who can perform different types of actions in thecluster:• Cluster administrator: Creates tenants (that is, domains) and domain managers; and isresponsible for the overall maintenance, management, and monitoring of the cluster.Cluster administrators are maintained in the node or cluster configuration file, unlike any otherrealm (the term realm is defined in Section 12.2.1, “Common Security Terminology”).• Domain manager: Created by cluster administrator, domain managers maintain the list ofauthorized domain users, as well as the list of domain managers.Users who are not in any realm defined by the domain manager can perform only those actionsthat require no authentication.• Application developer (that is, you): You are responsible for creating content in the domain (thatis, buckets and objects for which you have privileges).The information discussed in this chapter applies to domain managers and application developers.More role-specific information can be found in one of the following: