Access Control List
HSYCO supports server-side access control lists for Web-based user commands.
The acl.ini file is a text file that defines the rules to allow or reject commands.
Changes to acl.ini are immediately effective.
Each line defines an access rule, with the following format:
action; user_id; location; type; command
Rules are evaluated starting from the first line and progressing down the file until a match is found on the user, the IP address of the Web browser, the command type and command.
On the rule that matches, the allow or deny action is taken, executing or rejecting the command.
You can user the * character in the user_id, service and command fields, to match any value or values starting or ending with a specific string.
The following table describes each field of a rule line.
| Field | Format | Description |
|---|---|---|
| action | allow | deny | when this rule matches, the command is either executed or rejected |
| user_id | string [, string] * matches any user | one or more user names (comma separated) |
| location | local | remote | * | clients with an IP address that is part of the trusted range are local; clients outside the trusted range are remote |
| type | io | timer | camera | * matches any service | command type |
| command | string * matches any string or substring | matching command string. Rules of type io cover both I/O Server writes, in the <datapoint>=<value> format, and user commands, in the <name>=<param> format. |
Requests from the user interface objects to data sources are also checked, with commands formatted as <datasource_id>=<query | insert | update | delete>. These requests are only matched by rules with the * type, as datasource is not accepted in the type field. Make sure that rules with the * type, like the last rule of the following examples, also cover the data source commands that you want to allow; otherwise, all data source requests are rejected.
If no matching rule is found in the acl.ini file, the command is rejected. If the verbose log level is enabled, an error message is logged in the daily log file:
2012.01.04 16:25:10.223 + ACL ALERT: DENIED - USER: staff LOCATION: local TYPE: io COMMAND: user=test
Examples:
deny; *; *; io; dmx1.*
allow; *; *; *; *
Allows all commands from the Web interface, except for writes to the data points of the dmx1 I/O Server.
deny; *; *; camera; *zoom*wide
allow; *; *; camera; *
Disables all commands, only allowing camera control commands, but not the zoom-out command.
deny; guest; *; *; *
allow; *; *; *; *
User guest is not authorized to execute any command, all other users are allowed.
deny; *; remote; *; *
Prevents the execution of any command from browsers that are outside of the trusted range of IP addresses, as defined with the trustedNet configuration parameter.
deny; guest; *; *; users=insert
deny; guest; *; *; users=update
deny; guest; *; *; users=delete
allow; *; *; *; *
User guest can view the data of the users data source, but can't modify it.