JMX Resources (MBeans) for DSE Utilities
After enabling Java Management Extensions (JMX) authentication, DataStax Enterprise (DSE) utilities and other third-party tools require MBean
access to execute commands.
The tools use JMX MBeans
to remotely gather information and execute requests.
Access is controlled using modelled hierarchy. Granting and revoking a privilege on a top level object automatically allows the same permission on all ancestors.
MBeans
have the following modelled hierarchy for access control:
![cql mbean hierarchy](_images/cql_mbean_hierarchy.png)
|
Synopsis
Use the following syntax to grant access:
-
ALL
MBEANS
GRANT <permission>[, <permission> ...] ON ALL MBEANS TO <role_name>;
where permissions are
ALL PERMISSIONS
,DESCRIBE
,EXECUTE
,MODIFY
, andSELECT
. -
MBEANS <pattern>
GRANT <permission>[, <permission> ...] ON MBEANS '<class_name>:name=<value>,type=<value>' TO <role_name>;
where DSE supports wildcard characters in the value name to match one or more
MBeans
and permissions areALL PERMISSIONS
,DESCRIBE
,EXECUTE
,MODIFY
, andSELECT
. -
MBEAN <name>
GRANT <permission>[, <permission> ...] ON MBEAN '<class_name>:name=<value>,type=<value>' TO <role_name>;
where permissions are
ALL PERMISSIONS
,DESCRIBE
,EXECUTE
,MODIFY
, andSELECT
. -
Revoke permissions syntax:
REVOKE <permission_name> ON <resource> FROM <role_name>;
Permission matrix
Privilege | Resource | Permissions |
---|---|---|
ALL MBEANS |
All operations that are applicable on all MBEANS. |
|
MBEAN <name> |
All operations that are applicable on the MBEAN. |
|
MBEANS <pattern> |
All operations that are applicable on MBEANS that match the wildcard pattern. |
|
ALL MBEANS |
Use |
|
MBEAN <name> |
Use |
|
MBEANS <pattern> |
Use |
|
ALL MBEANS |
Use |
|
MBEAN <name> |
Use |
|
MBEANS <pattern> |
Use |
|
ALL MBEANS |
Call |
|
MBEAN <name> |
Call |
|
MBEANS <pattern> |
Call |
|
ALL MBEANS |
Use |
|
MBEAN <name> |
Use |
|
MBEANS <pattern> |
Use |