Closed FragLegs closed 4 months ago
call 2023-03-21: defer discussion until @tulshi and @FragLegs are on call
It was decided during the 2023-05-02 call that complex subject matching should work as follows:
For ComplexSubject A to match ComplexSubject B, at least one of the following conditions must be true for every field (i.e. user
, group
, device
, etc) within the ComplexSubject:
I'll go ahead and enter this into the spec for clarification.
@FragLegs , it sounds like this issue was addressed in the PR, so I'm closing it. Please re-open if this is not closed.
In section 3.2.1 the SSE spec says
I read this to mean that when examining a new security event to determine whether it matches a subject that a receiver has added to the stream, the rule is that all of the attributes of the Complex Subject must match. That is, if the receiver added this subject:
Then in order for an event to be delivered on that stream, it must have both device
1234
and application5678
.I have three questions:
1234
, application5678
, and userfoo
be delivered on this stream?1234
and no application information be delivered on this stream?We need to come to a consensus about these cases, and then I would suggest we should add enough details to the spec to make the answers clear to readers.