Access security

[epics-base]

Access security

[sveseli]

Access security needs to be enabled in the underlying PV Database code (see epics-base/pvDatabaseCPP#58). As soon as this is done, I will add relevant interfaces to PvaServer class (see https://github.com/epics-base/pvaPy/tree/access-security)

[thomasms]

I know this is currently being worked out with regard to pvDatabase, but I have a further question/comment on this.

Is it possible for information on the requester to be accessed in the callback? For example

import pvapy as pv

def mycb(x, req):
    # only permit write access from this machine
    if req.ipv4 != "X.X.X.X":
        # block write & throw exception
        # but how to block write?
        raise AccessControlException("You do not have access")

pv1 = pv.PvInt(4)
server = pv.PvaServer('mypv', pv1, mycb)

Completely ignoring the concept of the ACF but instead define access control via the callbacks.

Not sure if the callback is the best place to put this, since you cannot prevent the put there, I wondered if there are other potential mechanisms to do such things?

To simplify things let's ignore access control all together and let's imagine we have a PV that is read-only - always - regardless of the client. Then again, I would think the callback could be used here but it is not clear how to stop the write, since the code below still permits the put - any advice on how to handle this scenario?

import pvapy as pv

def mycb(x, req):
    raise ReadOnlyException("Write not permitted.")

readonlypv= pv.PvInt(4)
server = pv.PvaServer('readonlypv', readonlypv, mycb)

[sveseli]

In order to make this work without access security, we would need a "before write" record interface in the PV Database code. @mrkraimer, what are your thoughts on this?

[mrkraimer]

Note that ChannelProviderLocal has methods canWrite and canRead.
Does this help?

[sveseli]

Aren't those methods available in the ChannelLocal class, not in ChannelProviderLocal? It seems like there would have to be something like "onRead(requester)" and "onWrite(requester)" interfaces available in the PvRecord class (similar to the process() interface).

[sveseli]

Access security is now available (since release 4.0.0, see https://github.com/epics-base/pvaPy/blob/master/documentation/accessSecurity.md).