Future Streams Authorization (v4.5.0+)

[morrone]

We need to discuss what our authorization model should be for the ldms streams service in ldmsd in the future (the code on branch "main", which will become v4.5.0).

To have that dicsussion, it would be very helpful to have more clear, detailed documentation about what streams actually are. Some questions that should probably be answered by the documentation are:

• What are the semantics of a "stream" and "stream messages"?
• What, if any, is the resilience model for streams messages?

A system administrator using ldmsd would likely have the following questions about streams:

• How do I control who can publish messages to which streams?
• How do I control who can subscribe to messages from which streams?

[tom95858]

@morrone, can we combine this with @nichamon issue #1547

[morrone]

I intentionally kept them separate, because it has been made clear that we are not going to address these things on b4.4 for v4.4.5 (only to make it possible to entirely enable/disable streams functionality). So discussion #1547 is about whether streams are enabled by default, in the very near term, on b4.4. Whereas this discussion is about the future of streams authorization on the main branch (v4.5.x and beyond). I think combining the two discussions is going to confuse people.

[morrone]

To word things another way, @narategithub said the following:

on current main [...] bob can connect to ldmsd and publish anything on any stream. Be nice, bob!

We need to move beyond hoping users will "be nice" and actually implement authorization. We need to have a clear way for a system administrator to answer the following question, which is stated at the beginning of this conversation:

How do I control who can publish messages to which streams?

And perhaps for the system administrator to ask that question, they have to know the answer to "what are Streams in LDMSD?".

If @tom95858 are sure this is already addressed on main, then please do share the answer that we would give that sysadmin. It certainly could be that the answer just isn't documented, and I'd be happy to learn that no code development is needed to answer all the questions that I've raised in this discussion (#1548).

[tom95858]

@morrone, @narategithub has published a pull request and he is now working on the documentation. I think it will address the key questions you have brought up, but I think it will also point out some things that may be the source of our collective confusion. I think we will have the docs by tomorrow.

[morrone]

I think we have gotten onto the same page in these comments in issue #1527.

The summary is that the main branch does not currently address the key issues that I have raised. So I would suggest the following plan:

In the longer term:

• Implement streams authorization at publish time (and subscribe time) that is configurable by the sysadmin.

In the shorter term:

• Port a variant of PR Add requests to enable/disable streams communication #1543 to main.
• Make streams disabled by default on main.
• Retire the older "ldmsd streams" on main (this one suggested by @tom95858)