activemq-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From clebertsuco...@apache.org
Subject [1/2] activemq-artemis git commit: ARTEMIS-229 validate user and role with address
Date Fri, 25 Sep 2015 15:22:41 GMT
Repository: activemq-artemis
Updated Branches:
  refs/heads/master 4cdcc618f -> e85bb3ca4


ARTEMIS-229 validate user and role with address


Project: http://git-wip-us.apache.org/repos/asf/activemq-artemis/repo
Commit: http://git-wip-us.apache.org/repos/asf/activemq-artemis/commit/6890f126
Tree: http://git-wip-us.apache.org/repos/asf/activemq-artemis/tree/6890f126
Diff: http://git-wip-us.apache.org/repos/asf/activemq-artemis/diff/6890f126

Branch: refs/heads/master
Commit: 6890f126cbd3df6ef0b096d4f1256ef540b9b36f
Parents: 4cdcc61
Author: Julian Scheid <julians37@gmail.com>
Authored: Fri Sep 25 14:08:28 2015 +0200
Committer: Julian Scheid <julians37@gmail.com>
Committed: Fri Sep 25 15:58:15 2015 +0200

----------------------------------------------------------------------
 .../core/security/impl/SecurityStoreImpl.java   |  12 +-
 .../core/security/ActiveMQSecurityManager2.java |  49 +++++
 .../integration/security/SecurityTest.java      | 211 +++++++++++++++++++
 3 files changed, 271 insertions(+), 1 deletion(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/activemq-artemis/blob/6890f126/artemis-server/src/main/java/org/apache/activemq/artemis/core/security/impl/SecurityStoreImpl.java
----------------------------------------------------------------------
diff --git a/artemis-server/src/main/java/org/apache/activemq/artemis/core/security/impl/SecurityStoreImpl.java
b/artemis-server/src/main/java/org/apache/activemq/artemis/core/security/impl/SecurityStoreImpl.java
index 209b424..a12ff4f 100644
--- a/artemis-server/src/main/java/org/apache/activemq/artemis/core/security/impl/SecurityStoreImpl.java
+++ b/artemis-server/src/main/java/org/apache/activemq/artemis/core/security/impl/SecurityStoreImpl.java
@@ -34,6 +34,7 @@ import org.apache.activemq.artemis.core.server.management.NotificationService;
 import org.apache.activemq.artemis.core.settings.HierarchicalRepository;
 import org.apache.activemq.artemis.core.settings.HierarchicalRepositoryChangeListener;
 import org.apache.activemq.artemis.spi.core.security.ActiveMQSecurityManager;
+import org.apache.activemq.artemis.spi.core.security.ActiveMQSecurityManager2;
 import org.apache.activemq.artemis.utils.ConcurrentHashSet;
 import org.apache.activemq.artemis.utils.TypedProperties;
 
@@ -159,7 +160,16 @@ public class SecurityStoreImpl implements SecurityStore, HierarchicalRepositoryC
             return;
          }
 
-         if (!securityManager.validateUserAndRole(user, session.getPassword(), roles, checkType))
{
+         final boolean validated;
+         if (securityManager instanceof ActiveMQSecurityManager2) {
+            final ActiveMQSecurityManager2 securityManager2 = (ActiveMQSecurityManager2)
securityManager;
+            validated = securityManager2.validateUserAndRole(user, session.getPassword(),
roles, checkType, saddress);
+         }
+         else {
+            validated = securityManager.validateUserAndRole(user, session.getPassword(),
roles, checkType);
+         }
+
+         if (!validated) {
             if (notificationService != null) {
                TypedProperties props = new TypedProperties();
 

http://git-wip-us.apache.org/repos/asf/activemq-artemis/blob/6890f126/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQSecurityManager2.java
----------------------------------------------------------------------
diff --git a/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQSecurityManager2.java
b/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQSecurityManager2.java
new file mode 100644
index 0000000..2962153
--- /dev/null
+++ b/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQSecurityManager2.java
@@ -0,0 +1,49 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.activemq.artemis.spi.core.security;
+
+import java.util.Set;
+
+import org.apache.activemq.artemis.core.security.CheckType;
+import org.apache.activemq.artemis.core.security.Role;
+
+/**
+ * Used to validate whether a user is authorized to connect to the
+ * server and perform certain functions on certain destinations.
+ *
+ * This is an evolution of {@link ActiveMQSecurityManager} that adds
+ * the ability to perform authorization taking the destination address
+ * into account.
+ */
+public interface ActiveMQSecurityManager2 extends ActiveMQSecurityManager {
+
+   /**
+    * Determine whether the given user is valid and whether they have
+    * the correct role for the given destination address.
+    *
+    * This method is called instead of
+    * {@link ActiveMQSecurityManager.validateUserAndRole}.
+    *
+    * @param user      the user
+    * @param password  the user's password
+    * @param roles     the user's roles
+    * @param checkType which permission to validate
+    * @param address   the address for which to perform authorization
+    * @return true if the user is valid and they have the correct roles for the given destination
address
+    */
+   boolean validateUserAndRole(String user, String password, Set<Role> roles, CheckType
checkType, String address);
+}

http://git-wip-us.apache.org/repos/asf/activemq-artemis/blob/6890f126/tests/integration-tests/src/test/java/org/apache/activemq/artemis/tests/integration/security/SecurityTest.java
----------------------------------------------------------------------
diff --git a/tests/integration-tests/src/test/java/org/apache/activemq/artemis/tests/integration/security/SecurityTest.java
b/tests/integration-tests/src/test/java/org/apache/activemq/artemis/tests/integration/security/SecurityTest.java
index 15b5423..1eb0ed8 100644
--- a/tests/integration-tests/src/test/java/org/apache/activemq/artemis/tests/integration/security/SecurityTest.java
+++ b/tests/integration-tests/src/test/java/org/apache/activemq/artemis/tests/integration/security/SecurityTest.java
@@ -33,10 +33,14 @@ import org.apache.activemq.artemis.api.core.client.ServerLocator;
 import org.apache.activemq.artemis.tests.util.CreateMessage;
 import org.apache.activemq.artemis.tests.util.ActiveMQTestBase;
 import org.apache.activemq.artemis.core.config.Configuration;
+import org.apache.activemq.artemis.core.security.CheckType;
 import org.apache.activemq.artemis.core.security.Role;
 import org.apache.activemq.artemis.core.server.ActiveMQServer;
 import org.apache.activemq.artemis.core.server.Queue;
+import org.apache.activemq.artemis.core.server.impl.ActiveMQServerImpl;
 import org.apache.activemq.artemis.core.settings.HierarchicalRepository;
+import org.apache.activemq.artemis.spi.core.security.ActiveMQSecurityManager;
+import org.apache.activemq.artemis.spi.core.security.ActiveMQSecurityManager2;
 import org.apache.activemq.artemis.spi.core.security.ActiveMQSecurityManagerImpl;
 import org.junit.Assert;
 import org.junit.Before;
@@ -1049,6 +1053,213 @@ public class SecurityTest extends ActiveMQTestBase {
 
    }
 
+   @Test
+   public void testCustomSecurityManager() throws Exception {
+      final Configuration configuration = createDefaultInVMConfig().setSecurityEnabled(true);
+      final ActiveMQSecurityManager customSecurityManager = new ActiveMQSecurityManager()
{
+            public boolean validateUser(final String username, final String password) {
+               return (username.equals("foo") || username.equals("bar") || username.equals("all"))
&&
+                  password.equals("frobnicate");
+            }
+            public boolean validateUserAndRole(
+               final String username,
+               final String password,
+               final Set<Role> requiredRoles,
+               final CheckType checkType) {
+
+               if ((username.equals("foo") || username.equals("bar") || username.equals("all"))
&&
+                   password.equals("frobnicate")) {
+
+                  if (username.equals("all")) {
+                     return true;
+                  }
+                  else if (username.equals("foo")) {
+                     return checkType == CheckType.CONSUME || checkType == CheckType.CREATE_NON_DURABLE_QUEUE;
+                  }
+                  else if (username.equals("bar")) {
+                     return checkType == CheckType.SEND || checkType == CheckType.CREATE_NON_DURABLE_QUEUE;
+                  }
+                  else {
+                     return false;
+                  }
+               }
+               else {
+                  return false;
+               }
+            }
+         };
+      final ActiveMQServer server = addServer(new ActiveMQServerImpl(configuration, customSecurityManager));
+      server.start();
+
+      final ServerLocator locator = createInVMNonHALocator();
+      locator.setBlockOnNonDurableSend(true).setBlockOnDurableSend(true);
+      final ClientSessionFactory factory = createSessionFactory(locator);
+      ClientSession adminSession = factory.createSession("all", "frobnicate", false, true,
true, false, -1);
+
+      final String queueName = "test.queue";
+      adminSession.createQueue(queueName, queueName, false);
+
+      // Wrong user name
+      try {
+         factory.createSession("baz", "frobnicate", false, true, true, false, -1);
+         Assert.fail("should throw exception");
+      }
+      catch (ActiveMQSecurityException se) {
+         //ok
+      }
+      catch (ActiveMQException e) {
+         fail("Invalid Exception type:" + e.getType());
+      }
+
+      // Wrong password
+      try {
+         factory.createSession("foo", "xxx", false, true, true, false, -1);
+         Assert.fail("should throw exception");
+      }
+      catch (ActiveMQSecurityException se) {
+         //ok
+      }
+      catch (ActiveMQException e) {
+         fail("Invalid Exception type:" + e.getType());
+      }
+
+      // Correct user and password, allowed to send but not receive
+      {
+         final ClientSession session = factory.createSession("foo", "frobnicate", false,
true, true, false, -1);
+         checkUserReceiveNoSend(queueName, session, adminSession);
+      }
+
+      // Correct user and password, allowed to receive but not send
+      {
+         final ClientSession session = factory.createSession("bar", "frobnicate", false,
true, true, false, -1);
+         checkUserSendNoReceive(queueName, session);
+      }
+
+   }
+
+   @Test
+   public void testCustomSecurityManager2() throws Exception {
+      final Configuration configuration = createDefaultInVMConfig().setSecurityEnabled(true);
+      final ActiveMQSecurityManager customSecurityManager = new ActiveMQSecurityManager2()
{
+            public boolean validateUser(final String username, final String password) {
+               return (username.equals("foo") || username.equals("bar") || username.equals("all"))
&&
+                  password.equals("frobnicate");
+            }
+            public boolean validateUserAndRole(
+               final String username,
+               final String password,
+               final Set<Role> requiredRoles,
+               final CheckType checkType) {
+
+               fail("Unexpected call to overridden method");
+               return false;
+            }
+
+            public boolean validateUserAndRole(
+               final String username,
+               final String password,
+               final Set<Role> requiredRoles,
+               final CheckType checkType,
+               final String address) {
+
+               if ((username.equals("foo") || username.equals("bar") || username.equals("all"))
&&
+                   password.equals("frobnicate")) {
+
+                  if (username.equals("all")) {
+                     return true;
+                  }
+                  else if (username.equals("foo")) {
+                     return address.equals("test.queue") && checkType == CheckType.CONSUME;
+                  }
+                  else if (username.equals("bar")) {
+                     return address.equals("test.queue") && checkType == CheckType.SEND;
+                  }
+                  else {
+                     return false;
+                  }
+               }
+               else {
+                  return false;
+               }
+            }
+         };
+      final ActiveMQServer server = addServer(new ActiveMQServerImpl(configuration, customSecurityManager));
+      server.start();
+
+      final ServerLocator locator = createInVMNonHALocator();
+      locator.setBlockOnNonDurableSend(true).setBlockOnDurableSend(true);
+      final ClientSessionFactory factory = createSessionFactory(locator);
+      ClientSession adminSession = factory.createSession("all", "frobnicate", false, true,
true, false, -1);
+
+      final String queueName = "test.queue";
+      adminSession.createQueue(queueName, queueName, false);
+
+      final String otherQueueName = "other.queue";
+      adminSession.createQueue(otherQueueName, otherQueueName, false);
+
+      // Wrong user name
+      try {
+         factory.createSession("baz", "frobnicate", false, true, true, false, -1);
+         Assert.fail("should throw exception");
+      }
+      catch (ActiveMQSecurityException se) {
+         //ok
+      }
+      catch (ActiveMQException e) {
+         fail("Invalid Exception type:" + e.getType());
+      }
+
+      // Wrong password
+      try {
+         factory.createSession("foo", "xxx", false, true, true, false, -1);
+         Assert.fail("should throw exception");
+      }
+      catch (ActiveMQSecurityException se) {
+         //ok
+      }
+      catch (ActiveMQException e) {
+         fail("Invalid Exception type:" + e.getType());
+      }
+
+      // Correct user and password, wrong queue for sending
+      try {
+         final ClientSession session = factory.createSession("foo", "frobnicate", false,
true, true, false, -1);
+         checkUserReceiveNoSend(otherQueueName, session, adminSession);
+         Assert.fail("should throw exception");
+      }
+      catch (ActiveMQSecurityException se) {
+         //ok
+      }
+      catch (ActiveMQException e) {
+         fail("Invalid Exception type:" + e.getType());
+      }
+
+      // Correct user and password, wrong queue for receiving
+      try {
+         final ClientSession session = factory.createSession("foo", "frobnicate", false,
true, true, false, -1);
+         checkUserReceiveNoSend(otherQueueName, session, adminSession);
+         Assert.fail("should throw exception");
+      }
+      catch (ActiveMQSecurityException se) {
+         //ok
+      }
+      catch (ActiveMQException e) {
+         fail("Invalid Exception type:" + e.getType());
+      }
+
+      // Correct user and password, allowed to send but not receive
+      {
+         final ClientSession session = factory.createSession("foo", "frobnicate", false,
true, true, false, -1);
+         checkUserReceiveNoSend(queueName, session, adminSession);
+      }
+
+      // Correct user and password, allowed to receive but not send
+      {
+         final ClientSession session = factory.createSession("bar", "frobnicate", false,
true, true, false, -1);
+         checkUserSendNoReceive(queueName, session);
+      }
+   }
+
    // Check the user connection has both send and receive permissions on the queue
    private void checkUserSendAndReceive(final String genericQueueName,
                                         final ClientSession connection) throws Exception
{


Mime
View raw message