Security Labels

This document examples how to configure Security Labels and related Access Control Decision Function for message stanzas in Metronome. Following is a comprehensive configuration example.

VirtualHost “alice.org”
security_catalog_name = “Alice’s Catalog”
security_catalog_desc = “Capuleti’s CORP Labels”
security_labels = {
{
name = “Unclassified”,
label = true,
default = true,
restrict = “none”
},
Classified = {
SECRET = {
color = “white”, bgcolor = “blue”, label = “Confidential”,
restrict = { type = “chat” }
},
CONTACTS = {
color = “black”, bgcolor = “cadetblue”, label = “Just for contacts”,
restrict = “roster”
},
PUBLIC = {
color = “black”, bgcolor = “aqua”, label = “Public”,
restrict = “none”
},
FORUM = {
color = “black”, bgcolor = “cornsilk”, label = “Only for groupchats”,
restrict = { type = “groupchat” }
},
LOCAL = {
color = “black”, bgcolor = “aliceblue”, label = “Only for Alice and Bob”,
restrict = { host = { “alice.org”, “bob.org” }, include_muc_subdomains = true }
}
}
}

List of configuration directives explained:

Generally the configuration table (in Lua format) is composed as follow unnamed between brackets ({ … }) entries for labels without a selector, and named entries for selector grouped labels (Classified = { … })
name: the name of a label
label: the data of a label, currently Metronome supports only stringie descriptions (TODO X.500, ESS)
default: boolean to specify if this is the default selector (only one default selector is supported, and must be unnamed)
ess_mime: contains the Base64 digest of the MIME signature for the ESS label, currently Metronome performs no validation on the MIME signature
restrict: specifies the ACDF policies to enforce
- none – enforce no policy, just fancy label
- host – restrict communication to one or two host entities and eventual first level muc subdomains. e.g. restrict = { host = { “alice.org”, “bob.org” }, include_muc_subdomains = true }
- muc_affiliation – restricts messages in MUC basing on the occupants affiliation e.g. you can make a certain label to be restricted to all members only by adding restrict = { muc_affiliation = true, { “owner”, “admin”, “member” } }
- roster – allow sending message stanzas with this label only to roster contacts
- type – restrict messages sent with this label to the specified type. e.g. restrict = { type = “chat” }
- whitelist – restrict messages to a jid whitelist e.g. restrict = { whitelist = { “bob@capuleti.org”, “alice@capuleti.org” } }
bgcolor: specify the background color for the label (using HTML codes)
color: specify the text color for the label (using HTML codes)