topic Re: ACL-Based Security in Vault Forum

ACL-Based Security

Anonymous — Tue, 09 Jun 2015 06:18:22 GMT

Hi,

There is a little topic which I can't build the logic inside of my head. Can anybody tell me the difference between these security settings?

Cheers,

Volkan ARI

Re: ACL-Based Security

paul.gunn — Tue, 09 Jun 2015 12:21:19 GMT

Hi,

In your case those two settings are functionally identical.

There is more of a difference when groups are involved. Say the user is a member of group A which allows 'write' access'. If they are also a member of group B with an explicit 'write' denied - then the deny wins [the user does not have access]. If group B simply has 'write' unchecked then the user is allowed access (through group A membership).

So in general I would use unchecked - and only use explicit denies when needed. However if you are not using groups then this is kind of a moot point.

Hope this helps,

Paul

Re: ACL-Based Security

smithmat — Tue, 09 Jun 2015 13:52:25 GMT

Also, this post will be helpful in understanding:

http://justonesandzeros.typepad.com/blog/2009/10/security.html

Re: ACL-Based Security

Anonymous — Tue, 09 Jun 2015 14:20:44 GMT

@paul.gunn

Thank you very much for your detailed explanation. I got the idea.

@smithmat

Thanks a lot for the link. I'll check it out.