streamtool setacl

Usage

setacl [-d,--domain-id <did>] [-i,--instance-id <instance>] [-U,--User <user>] [-h,--help] [--trace <level>] [-v,--verbose <level>] [--zkconnect {<host>:<port>},... | --embeddedzk] <permission> <object>

The streamtool setacl command changes the access or default permissions for an object in an Streams instance.

Authority

You must have write authority for the config instance object. By default, the DomainAdministrator and InstanceAdministrator roles have this authority. For more information about access control lists, see streamtool getacl.

Description

To add, remove, or replace an access control setting, you must identify the applicable Streams object, the user to which the new access control setting applies, and one or more privileges that you want to add or remove.

To set permissions for a job group, use the streamtool grantjobpermission command.

Options

-d,--domain-id <did>
Specifies the domain identifier.

If you do not specify this option, Streams uses the domain name that is set in the STREAMS_DOMAIN_ID environment variable. By default, that domain name is StreamsDomain. If you are using the interactive streamtool interface, it uses the name of the active domain for the current streamtool session or else it prompts you for the domain name.

The active domain for the current streamtool session is set every time that you successfully run a streamtool command with a -d or --domain-id option. Alternatively, you can run the streamtool domain command in the interactive interface.

--embeddedzk

Specifies to use the embedded copy of ZooKeeper. This option is not supported within the interactive streamtool interface.

If you are not using the interactive streamtool interface and you do not specify either this option or the --zkconnect option, Streams uses the ZooKeeper connection that is associated with the active domain or the domain that is specified in the --domain-id option. Streams determines which connection maps to the domain by using cached information about the domains. In this scenario, if the domain identifier is not unique in the Streams configuration cache, the command fails.

-h,--help
Specifies to show the command syntax.
-i,--instance-id <instance>
Specifies the instance identifier.

If you do not specify this option, Streams uses the instance identifier that is set in the STREAMS_INSTANCE_ID environment variable. By default, that instance identifier is StreamsInstance. If you are using the interactive streamtool interface, it tries to use an instance ID that you specified in a previous command. If no such value is found, the command uses the STREAMS_INSTANCE_ID environment variable. Alternatively, you can run the streamtool instance command in the interactive interface.

--trace <level>
Specifies the trace setting. The following valid levels are listed in order of increasing verbosity, which is to say that the first level in the list generates the least amount of information:
  • off
  • error
  • warn
  • info
  • debug
  • trace
The default value is off.
-U,--User <user>
Specifies an Streams user ID that has authority to run the command.
-v,--verbose <level>
Specifies to provide more detailed command output. The verbosity level can be 0-3, where 0 disables detailed reporting and each increment provides more detailed output.
--zkconnect <{<host>:<port>},...>

The name of one or more host and port pairs that specify the configured ZooKeeper servers. This option is not supported within the interactive streamtool interface.

If you are not using the interactive streamtool interface and you do not specify this option, Streams tries to use:

  1. The --embeddedzk option
  2. The value from the STREAMS_ZKCONNECT environment variable
  3. A ZooKeeper connection string that is derived from cached information about the current domain.

Arguments

permission
Specifies the privileges that you want to add, remove, or replace for an Streams object. The command uses the following format for the permission argument: [default:]{u|user|g|group|r|role}:name{+,-,:}{rwsado}. The keywords and variables have the following meanings:
default:
Specifies the default permission values to be used when child objects that are added to this object are initialized. For example, the jobs object uses this setting to grant default permissions to new jobs as they are added to the system.

If you do not specify this keyword, the command sets the access permissions for the object instead of its default permissions.

u, user, g, group, r, role
Specifies whether the name is a user, a group, or a role.
name
Specifies the name of the user, group, or role.
+, -, :
Specifies whether the command adds (+) or removes (-), or replaces (:) the specified permissions.
rwsado
Specifies the permission settings to set, remove, or add. You can specify one or more of the following permission settings: read (r), write (w), search (s), add (a), delete (d), or own (o).
object
Specifies an Streams object, which must be one of the following values:
  • application-log
  • config
  • hosts
  • instance
  • jobgroup_default
  • jobgroup_name, where name is the name of a valid job group in the instance.
  • jobs
  • jobs-override
  • job_id, where id is a valid job ID.
  • system-log

Examples

To run the streamtool lsjobs command successfully, you must have search authority for the jobs instance object. The following command grants that authority to the user analyst2 in the domain mydomain:

streamtool setacl -d mydomain -U bsmith -i CurrencyTrades u:analyst2+s jobs

The following command removes the search authority from the user analyst2 for the jobs instance object:

streamtool setacl -d mydomain -U bsmith -i CurrencyTrades u:analyst2-s jobs