[zeromq-dev] Authentication and filtering
Bruno D. Rodrigues
bruno.rodrigues at litux.org
Sat Dec 28 20:20:04 CET 2013
peer A = dealer, connect, multiple peers (the “clients”)
peer B = router, bind, single peer (the “server”)
peer A calls setIdentity with user+”:”+hash
peer A sends a message (empty is ok)
peer B receives a message, which being a router, gets prefixed with the identity
peer B validates the hash and accepts or rejects the connection
if accept, store a hash map so replies can go back to the originator
now the problem
if the connection is to be rejected, how to disconnect it?
On Dec 28, 2013, at 16:48, Dmitriy Vsekhvalnov <dvsekhvalnov at gmail.com> wrote:
> Bruno, can you extend your thought. How can i track identity or peer?
>
>
> On Sat, Dec 28, 2013 at 7:38 PM, Bruno D. Rodrigues <bruno.rodrigues at litux.org> wrote:
> Use the identity for routing and a first message from your own for authentication. Now if the auth fails, I have no idea how to “disconnect” that peer :( but you can keep your own hash and never reply back to such peer.
>
> On Dec 28, 2013, at 15:17, Dmitriy Vsekhvalnov <dvsekhvalnov at gmail.com> wrote:
>
>> Hi Pieter, well that's what i'm concerned about. Events (tasks) contains sensitive information and they shouldn't be routed to workers which are not authorized to view it.
>>
>> If worker (maliciously or by mistake) specify empty filter "" - it will get all messages, right?
>>
>> But i'm looking for authentication + filtering based on authenticated identity. I don't know, like maintaining hash map of authenticated workers.
>>
>>
>> On Sat, Dec 28, 2013 at 11:49 AM, Pieter Hintjens <ph at imatix.com> wrote:
>> On Sat, Dec 28, 2013 at 7:57 AM, Dmitriy Vsekhvalnov
>> <dvsekhvalnov at gmail.com> wrote:
>> > I probably didn't specify my concerns about filtering clear enough. If
>> > filter set to empty - sub will receive all events? That's not acceptable,
>> > workers should never receive events that are not dedicated to it.
>> >
>> > Also I don't think pub/sub will work, because pub broadcasts messages to all
>> > subs. And again this is not what we need, event should be processed not more
>> > than once.
>>
>> You should perhaps start by reading the Guide and learning the basics.
>> Pub-sub uses a prefix match. If you make no subscriptions, you get
>> nothing. If you subscribe to "A" you get all messages starting with
>> "A". If you subscribe to "", you get all messages.
>>
>> -Pieter
>> _______________________________________________
>> zeromq-dev mailing list
>> zeromq-dev at lists.zeromq.org
>> http://lists.zeromq.org/mailman/listinfo/zeromq-dev
>>
>> _______________________________________________
>> zeromq-dev mailing list
>> zeromq-dev at lists.zeromq.org
>> http://lists.zeromq.org/mailman/listinfo/zeromq-dev
>
>
> _______________________________________________
> zeromq-dev mailing list
> zeromq-dev at lists.zeromq.org
> http://lists.zeromq.org/mailman/listinfo/zeromq-dev
>
>
> _______________________________________________
> zeromq-dev mailing list
> zeromq-dev at lists.zeromq.org
> http://lists.zeromq.org/mailman/listinfo/zeromq-dev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.zeromq.org/pipermail/zeromq-dev/attachments/20131228/213b365e/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 235 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <https://lists.zeromq.org/pipermail/zeromq-dev/attachments/20131228/213b365e/attachment.sig>
More information about the zeromq-dev
mailing list