Zone Model

Table of Contents

• Zone Attributes
• Zone JSON Example
• Zone Connection Attributes
• Zone Connection JSON Example
• Zone ACL Rule Attributes
• Zone ACL Rule Examples
• PTR ACL Rule
• PTR ACL Rule Examples
• Shared Zones

ZONE ATTRIBUTES

ZONE EXAMPLE

{
  "status": "Active",
  "updated": "2016-12-16T15:27:28Z",
  "name": "ok.",
  "adminGroupId": "92b298e8-97db-4f1b-881b-fd08ca0dd311",
  "created": "2016-12-16T15:27:26Z",
  "account": "92b298e8-97db-4f1b-881b-fd08ca0dd311",
  "email": "test@test.com",
  "connection": {
    "primaryServer": "127.0.0.1:5301",
    "keyName": "vinyl.",
    "name": "ok.",
    "key": "OBF:1:W1FXgpOjjrQAABAARrZmyLjFSOuFYTAw81mhvNEmNAc4RnYzPjJQMEjVQWWLRohu7gRAVw=="
  },
  "transferConnection": {
    "primaryServer": "127.0.0.1:5301",
    "keyName": "vinyl.",
    "name": "ok.",
    "key": "OBF:1:W1FXgpOjjrQAABAARrZmyLjFSOuFYTAw81mhvNEmNAc4RnYzPjJQMEjVQWWLRohu7gRAVw=="
  },
  "shared": false,
  "acl": {
    "rules": [
      {
        "accessLevel": "Write",
        "userId": "<uuid>",
        "description": "some_test_rule",
        "recordTypes": []
      },
      {
        "recordMask": ".*",
        "accessLevel": "Write",
        "userId": "<uuid>",
        "description": "some_test_rule",
        "recordTypes": []
      },
      {
        "recordMask": "test.*",
        "accessLevel": "Read",
        "groupId": "<uuid>",
        "description": "some_test_rule",
        "recordTypes": []
      }
    ]
  },
  "id": "9cbdd3ac-9752-4d56-9ca0-6a1a14fc5562",
  "latestSync": "2016-12-16T15:27:26Z",
  "backendId":"func-test-backend",
  "accessLevel": "Delete"
}

ZONE ACL RULE ATTRIBUTES

ACL Rules are used to govern user and group access to record operations on a zone. ACL Rules can be associated with a specific user, or all users in a specified group. If neither a user or a group is attached to an ACL rule, then the rule applies to all users in the system.

Use the Zone Update endpoint to update the acl attribute of the zone

Important! If a user is mentioned on an ACL Rule directly, or is a member of a group that is mentioned on an ACL Rule, that user will be able to see the zone.

Rules made without selecting a group or user will apply to all users in VinylDNS.

The priority of ACL Rules in descending precedence:

1. Individual rules placed on a user
   
2. Rules placed on groups that a user is in
   
3. Rules placed on all users in VinylDNS

Note: Being in the admin group of a zone will grant users full access regardless of ACL Rules

For conflicting rules, the rule that is more specific will take precedence. For example, if the account jdoe201 was given Read access to all records in a zone through the rule:

{
  "userId": "<uuid>",
  "accessLevel": "Read",
}

and then Write access to only A records through the rule:

{
  "userId": "<uuid>",
  "accessLevel": "Write",
  "recordTypes": ["A"]
}

and then Delete access to only A records that matched the expression *dev* through the rule:

{
  "userId": "<uuid>",
  "accessLevel": "Delete",
  "recordTypes": ["A"],
  "recordMask": "*dev*"
}

then the rule with the recordMask will take precedence and give Delete access to matched A RecordSets, the rule with recordTypes will take precedence and give Write access to all other A records, and the more broad rule will give Read access to all other record types in the zone

ZONE ACL RULE EXAMPLES

Grant read/write/delete access to www.* records of type A, AAAA, CNAME to one user Under this rule, the user specified will be able to view, create, edit, and delete records in the zone that match the expression www.* and are of type A, AAAA, or CNAME.

{
  "recordMask": "www.*",
  "accessLevel": "Delete",
  "userId": "<uuid>",
  "recordTypes": ["A", "AAAA", "CNAME"]
}

Grant read only access to all VinylDNS users to A, AAAA, CNAME records

{
  "accessLevel": "Read",
  "recordTypes": ["A", "AAAA", "CNAME"]
}

Grant read/write/delete access to records of type A, AAAA, CNAME to one group*

{
  "accessLevel": "Delete",
  "groupId": "<uuid>",
  "recordTypes": ["A", "AAAA", "CNAME"]
}

PTR ACL RULES WITH CIDR MASKS

ACL rules can be applied to specific record types and can include record masks to further narrow down which records they apply to. These record masks apply to record names, but because PTR record names are part their reverse zone ip, the use of regular expressions for record masks are not supported.

Instead PTR record masks must be CIDR rules, which will denote a range of IP addresses that the rule will apply to. While more information and useful CIDR rule utility tools can be found online, CIDR rules describe how many bits of an ip address’ binary representation must be the same for a match.

PTR ACL RULES WITH CIDR MASKS EXAMPLE

The ACL Rule

{
    "recordTypes": ["PTR"],
    "accessLevel": "Read"
}

Will give Read permissions to PTR Record Sets to all users in VinylDNS

The IPv4 ACL Rule

{
    "recordTypes": ["PTR"],
    "accessLevel": "Read",
    "recordMask": "100.100.100.100/16"
}

Will give Read permissions to PTR Record Sets 100.100.000.000 to 100.100.255.255, as 16 bits is half of an IPv4 address

The IPv6 ACL Rule

{
    "recordTypes": ["PTR"],
    "accessLevel": "Read",
    "recordMask": "1000:1000:1000:1000:1000:1000:1000:1000/64"
}

Will give Read permissions to PTR Record Sets 1000:1000:1000:1000:0000:0000:0000:0000 to 1000:1000:1000:1000:FFFF:FFFF:FFFF:FFFF, as 64 bits is half of an IPv6 address.

ZONE CONNECTION ATTRIBUTES

In order for VinylDNS to make updates in DNS, it needs key information for every zone. There are 3 ways to specify that key information; ask your VinylDNS admin which is appropriate for your zone based on the configuration of the service:

1. Leave connection, transfer connection, and backend ID blank: In this case, the default VinylDNS keys will be used
2. Specify a backend ID on the zone: if multiple backends are configured for your instance of VinylDNS, you can specify a backend ID on the zone and the keys associated with that backend will be used.
3. Specify zone connection and transfer connection on the zone itself: see below for details

Note that if both a backend ID and specific connection keys are included on a zone, the specific connection keys will be used.

Zone Connection specifies the connection information to the backend DNS server.

ZONE CONNECTION EXAMPLE

{
  "primaryServer": "127.0.0.1:5301",
  "keyName": "vinyl.",
  "name": "ok.",
  "key": "OBF:1:W1FXgpOjjrQAABAARrZmyLjFSOuFYTAw81mhvNEmNAc4RnYzPjJQMEjVQWWLRohu7gRAVw=="
}

SHARED ZONES

Shared zones allow for a more open management of records in VinylDNS. Zone administrators can assign ownership of records to groups. Any user in VinylDNS can claim existing unowned records in shared zones, as well as create records in those zones. Once a record is owned, only users in the record owner group, the zone administrators and those with relevant ACL rules can modify or delete the record. The batch change API endpoint and DNS change area of the portal are where users can create new records in shared zones, modify records they own, or claim unowned records. If a zone’s shared state changes to false the record ownership access is no longer applicable.