Mailing-List: contact dev-help@activemq.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@activemq.apache.org
Received-SPF: neutral (nike.apache.org: local policy)
From: Allen Reese <areese@yahoo-inc.com>
To: "dev@activemq.apache.org" <dev@activemq.apache.org>
Date: Fri, 24 Sep 2010 15:33:25 -0700
Subject: Question about org.apache.activemq.security.AuthorizationBroker
Thread-Topic: Question about org.apache.activemq.security.AuthorizationBroker
Thread-Index: ActcOIBkZidvIg52Qoqyk+1Op2NaVQ==
Message-ID: 
 <A3B05739BDB5D8498E1750CDF4A5D5DD623BEF65@SP2-EX07VS01.ds.corp.yahoo.com>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

I'm playing with org.apache.activemq.security.AuthorizationBroker, and I'm =
not quite sure I understand what it is doing.

This is from the 5.3.2 code, but it's almost exactly the same in the trunk.
Lines 62-65, entire function below.

http://svn.apache.org/viewvc/activemq/trunk/activemq-core/src/main/java/org=
/apache/activemq/security/AuthorizationBroker.java

The part I don't understand is why it calls super.addDestination() if it do=
esn't exist without first checking the acl's.

Will this code get called again to verify the acl once it's in the Destinat=
ionMap?

Thanks

--Allen

Function I'm talking about:

   public Destination addDestination(ConnectionContext context, ActiveMQDes=
tination destination) throws Exception {
        final SecurityContext securityContext =3D (SecurityContext)context.=
getSecurityContext();
        if (securityContext =3D=3D null) {
            throw new SecurityException("User is not authenticated.");
        }
       =20
        Destination existing =3D this.getDestinationMap().get(destination);
        if (existing !=3D null) {
        	return super.addDestination(context, destination);
        }
       =20
        if (!securityContext.isBrokerContext()) {
            Set<?> allowedACLs =3D null;
            if (!destination.isTemporary()) {
                allowedACLs =3D authorizationMap.getAdminACLs(destination);
            } else {
                allowedACLs =3D authorizationMap.getTempDestinationAdminACL=
s();
            }

            if (allowedACLs !=3D null && !securityContext.isInOneOf(allowed=
ACLs)) {
                throw new SecurityException("User " + securityContext.getUs=
erName() + " is not authorized to create: " + destination);
            }

        }

        return super.addDestination(context, destination);
    }=