fine-grained access controls

[mmguero]

Malcolm doesn't currently have any kind of fine-grained access controls. In other words, if you're a logged in user you can pretty much do whatever all the other logged-in users can do.

This is a feature that will be important as the project gets bigger. But we have a few things to consider:

• It needs to work with both basic auth and LDAP auth. How to specify permissions for both?
• Arkime has permissions as well, so does OpenSearch/OpenSearch dashboards, how to overlay them in a consistent way?

This is a pretty big feature but would be of value. I think that, at least initially it should be pretty basic: basically something like the concept of a "read-only" user (can view all data, but not upload or write data) vs. a "read-write" user (can do both). It would be really nice if we could handle this entirely at the NGINX level in nginx.conf somehow, (see limit_except in this example).

[mmguero]

Kamino closed and cloned this issue to cisagov/Malcolm