1
1
# Access Control Guide
2
2
3
- All Interaction Model operations (read attribute, write attribute, invoke
4
- command, read event) are governed by access control, and will be denied (status
5
- 0x7E Access Denied) if sufficient privilege for the operation is not obtained.
3
+ All Interaction Model operations in Matter must be verified by the the Access
4
+ Control mechanism.
5
+
6
+ Whenever a client device and a server device want to interact with one another
7
+ by reading (or subscribing) attributes or events, writing attributes, or
8
+ invoking commands, the Access Control mechanism must verify that the client has
9
+ sufficient privileges to perform the operation on the server device.
10
+
11
+ If no sufficient privilege is obtained, the operation cannot take place and it
12
+ is denied (status ` 0x7E Access Denied ` ).
13
+
14
+ This guide describes how the Access Control mechanism works and how it is
15
+ implemented, and provides examples of Access Control Lists (ACLs) for different
16
+ use cases.
17
+
18
+ <hr >
6
19
7
20
## Overview
8
21
@@ -24,82 +37,89 @@ node. It is these ACLs that govern which Interaction Model operations are
24
37
allowed or denied on that server node, for subjects on the fabric, via CASE and
25
38
group messaging.
26
39
27
- ## ACLs
40
+ < hr >
28
41
29
- ACLs are fabric-scoped data structures with the following fields:
42
+ ## Access Control Lists
30
43
31
- - Privilege
32
- - AuthMode
33
- - Subjects
34
- - Targets
44
+ Access Control Lists (ACLs) are fabric-scoped data structures with the following
45
+ fields:
35
46
36
- ### Privilege
47
+ - ` Privilege `
48
+ - ` AuthMode `
49
+ - ` Subjects `
50
+ - ` Targets `
37
51
38
- Privileges are:
52
+ ### Privilege field
53
+
54
+ The ` Privilege ` can be of the following types:
39
55
40
56
- View
41
57
- Operate
42
58
- Manage
43
59
- Administer
44
60
45
- An additional ` ProxyView ` privilege is not yet supported in the Matter SDK.
61
+ > ** Note:** An additional ` ProxyView ` privilege is not yet supported in the
62
+ > Matter SDK.
46
63
47
64
By default, the ` View ` privilege is required to read attributes or events, and
48
65
the ` Operate ` privilege is required to write attributes or invoke commands.
49
66
50
- However, clusters may require stricter privileges for certain operations on
51
- certain endpoints. For example, the Access Control Cluster requires the
52
- ` Administer ` privilege for all its operations.
67
+ Clusters may also require stricter privileges for certain operations on certain
68
+ endpoints. For example, the Access Control Cluster requires the ` Administer `
69
+ privilege for all its operations.
53
70
54
71
If applicable, the ACL grants the privilege, and all less strict privileges
55
72
subsumed by it. Therefore an ACL for ` Manage ` privilege will work for operations
56
73
which require ` Operate ` or ` View ` privilege (but not ` Administer ` privilege).
57
74
58
- ### AuthMode
75
+ ### AuthMode field
59
76
60
- Authentication modes are :
77
+ The ` AuthMode ` , that is authentication modes, can be as follow :
61
78
62
79
- CASE
63
80
- Group
64
81
65
82
The ACL applies only to subjects using that authentication mode.
66
83
67
- ### Subjects
84
+ ### Subjects field
68
85
69
- Subjects is a list containing zero, one, or more subject identifiers, which are:
86
+ The ` Subjects ` field is a list containing zero, one, or more subject
87
+ identifiers, which are:
70
88
71
- - Node ID for CASE auth mode
72
- - Group ID for Group auth mode
89
+ - Node ID for CASE ` AuthMode `
90
+ - Group ID for Group ` AuthMode `
73
91
74
92
A CASE subject may be a CAT, which has its own tag and version mechanism.
75
93
76
94
The ACL applies only to the listed subjects; if no subjects are listed, the ACL
77
95
applies to any subjects using the authentication mode.
78
96
79
- ### Targets
97
+ ### Targets field
80
98
81
- Targets is a list containing zero, one, or more structured entries with fields:
99
+ The ` Targets ` field is a list containing zero, one, or more structured entries
100
+ with fields:
82
101
83
102
- Cluster
84
103
- Endpoint
85
104
- DeviceType
86
105
87
106
All fields are nullable, but at least one must be present, and the endpoint and
88
107
device type fields are mutually exclusive (only one of those two may be
89
- present).
90
-
91
- If cluster is present, the ACL is targeted to just that cluster.
92
-
93
- If endpoint is present, the ACL is targeted to just that endpoint.
108
+ present):
94
109
95
- If device type is present, the ACL is targeted to just endpoints which contain
96
- that device type (as reported by the Descriptor Cluster).
110
+ - If cluster is present, the ACL is targeted to just that cluster.
111
+ - If endpoint is present, the ACL is targeted to just that endpoint.
112
+ - If device type is present, the ACL is targeted to just endpoints which
113
+ contain that device type (as reported by the Descriptor Cluster).
97
114
98
- Specifying device type in targets is not yet supported in the Matter SDK.
115
+ > ** Note:** Specifying device type in targets is not yet supported in the Matter
116
+ > SDK.
99
117
100
118
The ACL applies only to the listed targets; if no targets are listed, the ACL
101
119
applies to any targets on the server node.
102
120
121
+ <hr >
122
+
103
123
## Limitations and Restrictions
104
124
105
125
The Matter Specification states that a Matter implementation must support at
@@ -120,8 +140,12 @@ can be configured globally in `CHIPConfig.h` or per-app in
120
140
- CHIP_CONFIG_EXAMPLE_ACCESS_CONTROL_MAX_SUBJECTS_PER_ENTRY
121
141
- CHIP_CONFIG_EXAMPLE_ACCESS_CONTROL_MAX_TARGETS_PER_ENTRY
122
142
143
+ <hr >
144
+
123
145
## Case Studies
124
146
147
+ This section provides use case examples for different ACL scenarios.
148
+
125
149
### Single Administrator
126
150
127
151
A single controller commissions a server node, providing its own CASE node ID
@@ -174,17 +198,22 @@ Members of groups 123 and 456 are granted `Operate` privilege for the on/off
174
198
cluster on any endpoint, any cluster on endpoint 1, and the level control
175
199
cluster on endpoint 2.
176
200
177
- ## Managing ACLs Using Chip-Tool
201
+ <hr >
202
+
203
+ ## Managing ACLs using CHIP-Tool
178
204
179
205
### Usage
180
206
207
+ The following sections describe the requirements for managing ACLs using the
208
+ CHIP-Tool.
209
+
181
210
#### Entire List
182
211
183
212
The Access Control Cluster's ` ACL ` attribute is a list.
184
213
185
- Currently, list operations for single entries (append, update, delete) are not
186
- yet supported in the Matter SDK, so the entire list must be written to the
187
- attribute to change any ACL.
214
+ > ** Note: ** Currently, list operations for single entries (append, update,
215
+ > delete) are not yet supported in the Matter SDK, so the entire list must be
216
+ > written to the attribute to change any ACL.
188
217
189
218
The write operation may employ multiple messages, making it unreliable. In any
190
219
case, ACLs are updated as they are processed, and take effect immediately.
@@ -215,38 +244,45 @@ When reading ACLs, the proper fabric index is shown.
215
244
216
245
The tool requires numerical values for enums and identifiers.
217
246
218
- The privileges are :
247
+ - Privilege values :
219
248
220
- - View: 1
221
- - Operate: 3
222
- - Manage: 4
223
- - Administer: 5
249
+ - View: 1
250
+ - Operate: 3
251
+ - Manage: 4
252
+ - Administer: 5
224
253
225
- The authentication modes are :
254
+ - AuthMode values :
226
255
227
- - CASE: 2
228
- - Group: 3
256
+ - CASE: 2
257
+ - Group: 3
229
258
230
- Some typical clusters:
259
+ - Values for some typical clusters:
231
260
232
- - On/Off: 6
233
- - Level Control: 8
234
- - Descriptor: 29
235
- - Binding: 30
236
- - Access Control: 31
237
- - Basic: 40
261
+ - On/Off: 6
262
+ - Level Control: 8
263
+ - Descriptor: 29
264
+ - Binding: 30
265
+ - Access Control: 31
266
+ - Basic: 40
238
267
239
268
### Examples
240
269
241
- #### Automatically Installed ACL
270
+ This section provides examples of commands and ACL output for different
271
+ operations with the CHIP-Tool.
242
272
243
- After commissioning with chip-tool, assuming ` CaseAdminNode ` is 112233, the
244
- automatically installed ACL is:
273
+ #### Verification of the Automatically Installed ACL
274
+
275
+ During commissioning with the CHIP-Tool, an ACL that assigns Administer rights
276
+ to the commissioner is automatically installed on the commissionee. This can be
277
+ verified using the following command:
245
278
246
279
```
247
280
out/debug/standalone/chip-tool accesscontrol read acl 1 0
248
281
```
249
282
283
+ Assuming the ` CaseAdminNode ` value is ` 112233 ` , the ACL command output for this
284
+ case is the following:
285
+
250
286
```
251
287
Endpoint: 0 Cluster: 0x0000_001F Attribute 0x0000_0000 DataVersion: 2578401031
252
288
ACL: 1 entries
@@ -262,10 +298,15 @@ Endpoint: 0 Cluster: 0x0000_001F Attribute 0x0000_0000 DataVersion: 2578401031
262
298
263
299
#### Installing a CASE ACL
264
300
301
+ The following command example requests the installation of a CASE ACL through a
302
+ write interaction:
303
+
265
304
```
266
305
out/debug/standalone/chip-tool accesscontrol write acl '[{"fabricIndex": 0, "privilege": 5, "authMode": 2, "subjects": [112233], "targets": null}, {"fabricIndex": 0, "privilege": 1, "authMode": 2, "subjects": [4444, 5555, 6666], "targets": null}]' 1 0
267
306
```
268
307
308
+ The resulting ACL command output for this case can look like the following one:
309
+
269
310
```
270
311
Endpoint: 0 Cluster: 0x0000_001F Attribute 0x0000_0000 DataVersion: 2578401034
271
312
ACL: 2 entries
@@ -291,10 +332,15 @@ Endpoint: 0 Cluster: 0x0000_001F Attribute 0x0000_0000 DataVersion: 2578401034
291
332
292
333
#### Installing a Group ACL
293
334
335
+ The following command example requests the installation of a Group ACL through a
336
+ write interaction:
337
+
294
338
```
295
339
out/debug/standalone/chip-tool accesscontrol write acl '[{"fabricIndex": 0, "privilege": 5, "authMode": 2, "subjects": [112233], "targets": null}, {"fabricIndex": 0, "privilege": 1, "authMode": 2, "subjects": [4444, 5555, 6666], "targets": null}, {"fabricIndex": 0, "privilege": 3, "authMode": 3, "subjects": [123, 456], "targets": [{"cluster": 6, "endpoint": null, "deviceType": null}, {"cluster": null, "endpoint": 1, "deviceType": null}, {"cluster": 8, "endpoint": 2, "deviceType": null}]}]' 1 0
296
340
```
297
341
342
+ The resulting ACL command output for this case can look like the following one:
343
+
298
344
```
299
345
Endpoint: 0 Cluster: 0x0000_001F Attribute 0x0000_0000DataVersion: 2578401041
300
346
ACL: 3 entries
@@ -342,22 +388,28 @@ Endpoint: 0 Cluster: 0x0000_001F Attribute 0x0000_0000DataVersion: 2578401041
342
388
}
343
389
```
344
390
345
- ## Managing ACLs Using Chip-Repl
391
+ <hr >
392
+
393
+ ## Managing ACLs Using Chip-repl
346
394
347
395
### Usage
348
396
397
+ This section provides examples of commands and ACL output for different
398
+ operations with the CHIP-repl.
399
+
349
400
#### Entire List
350
401
351
- See the important notes in the chip-tool section, as they also apply to
352
- chip-repl.
402
+ See the important notes in the
403
+ [ Managing ACLs using CHIP-Tool] ( #managing-acls-using-chip-tool ) section, as they
404
+ also apply to the CHIP-repl.
353
405
354
406
### Null Fields
355
407
356
408
Null fields may be omitted.
357
409
358
- OK: ` Target(cluster=6, endpoint=Null, deviceType=Null) `
359
-
360
- Also OK: ` Target(cluster=6) `
410
+ This means that the following entry is acceptable:
411
+ ` Target(cluster=6, endpoint=Null, deviceType=Null) ` . Just as the following one:
412
+ ` Target(cluster=6) ` .
361
413
362
414
The above assumes Target and Null are defined at global scope, which is not
363
415
normally the case.
@@ -366,15 +418,15 @@ normally the case.
366
418
367
419
The ` ACL ` attribute is fabric-scoped, so each ACL has a fabric index.
368
420
369
- The REPL ignores it when performing the actual write. Because null fields can be
370
- omitted, simply do not provide it when writing ACLs.
421
+ The CHIP-repl ignores it when performing the actual write. Because null fields
422
+ can be omitted, simply do not provide it when writing ACLs.
371
423
372
424
When reading ACLs, the proper fabric index is shown.
373
425
374
426
#### Enums and Identifiers
375
427
376
- The REPL accepts numerical values for enums and identifiers, but it also accepts
377
- strongly typed values:
428
+ The CHIP-repl accepts numerical values for enums and identifiers, but it also
429
+ accepts strongly typed values:
378
430
379
431
The privileges are:
380
432
@@ -399,6 +451,9 @@ Some typical clusters:
399
451
400
452
### Examples
401
453
454
+ This section provides examples of commands and ACL output for different
455
+ operations with the CHIP-repl.
456
+
402
457
#### Automatically Installed ACL
403
458
404
459
After commissioning with chip-repl, assuming ` CaseAdminNode ` is 1, the
0 commit comments