Hello,
I want to security the user-defined stream, and only user ‘service-a-user’ can create and write/read the stream.
I use the method witch mentioned in the docs like below:
curl -i “http://127.0.0.1:2113/streams/%24settings”
–user admin:changeit
-H “Content-Type: application/vnd.eventstore.events+json”
-d $’[{
“eventId”: “7c314750-05e1-439f-b2eb-f5b0e019be72”,
“eventType”: “update-default-acl”,
“data”: {
“$userStreamAcl” : {
“$r” : “service-a-user”,
“$w” : “service-a-user”,
“$d” : “service-a-user”,
“$mr” : “service-a-user”,
“$mw” : “service-a-user”
},
“$systemStreamAcl” : {
“$r” : “$admins”,
“$w” : “$admins”,
“$d” : “$admins”,
“$mr” : “$admins”,
“$mw” : “$admins”
}
}
}]’
but when I use gRPC client to write/read the stream, it can do the operation even I don’t input the authentication info. seems the ACLs not effected.
Also I login in the dashboard web page, and try to edit the ACLs for one stream, it is also not effected.
anyone can tell me what’s wrong here? thanks.