Once clients have established a session with a Universal Messaging Realm server, and they have successfully been authenticated and the subject has the correct user entitlements, in order to perform operations on channel objects, the correct entitlements must be granted to the subject on the required channels. Each channel has an associated ACL that contains a list of subjects and a set of privileges the subject is given for operations on the channel.

Using the Enterprise Manager, one can add to, remove or modify entries within the channel ACL.

To view a channel ACL, click on a channel node within the namespace of the Enterprise Manager, and select the 'ACL' tab. This will display the channel ACL and the list of subjects and their associated permissions for the channel. The following image displays and example of a channel ACL.

As you can see above, the channel ACL has a number of subject entries and operations that each subject is able to perform on the channel. The operations that can be performed on a channel are described below in the order in which they appear in the ACL panel above:

The green check icon shows that a subject is permitted to perform the operation. For example, the subject *@* is shown as having only subscribe permissions for this channel. This means that any client who has successfully established a session and has obtained a reference to this channel within their application code can only subscribe to the channel and read events.

In order to modify the permissions for a subject, you simply need to click on the cell in the ACL table for the subject and the operation you wish to modify permissions for. For example, if I wanted remove the subscribe permission for the *@* subject I would simply click on the *@* row at the column labelled 'subscribe'. This would turn the cell from blank to a green check icon. This would also ensure that only those subjects listed in the ACL and with sufficient privileges, would be able to perform any operations on the channel.

After making any changes, you then need to click on the 'Apply' button which will notify the Realm Server of the ACL change for that channel.

Any ACL changes that are made by other Enterprise Manager users, or from any programs using the Universal Messaging Admin API to modify ACLs will be received by all other Enterprise Managers. This is because ACL changes are automatically sent to all Universal Messaging Admin API clients, the Enterprise Manager being one of those clients.

Any changes made to a channel ACL where the channel is a cluster channel will be replicated to all other instances of the cluster channel in all other cluster realms.