activemq-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Torsten Mielke (JIRA)" <>
Subject [jira] [Updated] (AMQ-5304) groupClass not applied to TempDestinationAuthorizationEntry
Date Fri, 01 Aug 2014 12:31:38 GMT


Torsten Mielke updated AMQ-5304:

    Attachment: AMQ-5304.patch

Attaching a possible fix for this bug in AMQ-5304.patch.
Will still try to also come up with a unit test that can be incorporated into the source tree.

> groupClass not applied to TempDestinationAuthorizationEntry
> -----------------------------------------------------------
>                 Key: AMQ-5304
>                 URL:
>             Project: ActiveMQ
>          Issue Type: Bug
>          Components: Broker
>    Affects Versions: 5.10.0
>            Reporter: Torsten Mielke
>            Assignee: Torsten Mielke
>              Labels: authorization, security
>         Attachments: AMQ-5304.patch
> When configuring the authorization plugin with a <tempDestinationAuthorizationEntry>
that also set a groupClass, this groupClass is not properly applied to the TempDestinationAuthorizationEntry
> E.g. consider this example config
> {code:xml}
>       <authorizationPlugin>
>         <map>
>           <authorizationMap groupClass="org.apache.karaf.jaas.boot.principal.RolePrincipal">
>             <authorizationEntries>
>               <authorizationEntry queue=">" read="admin" write="client,admin" admin="client,admin"
>               <authorizationEntry topic=">" read="client,admin" write="admin" admin="admin"/>
>               <authorizationEntry topic="ActiveMQ.Advisory.>" read="admin,client"
write="admin,client" admin="admin"/>
>            </authorizationEntries>
>            <tempDestinationAuthorizationEntry>
>              <tempDestinationAuthorizationEntry read="client,admin" write="client,admin"
admin="client,admin" groupClass="org.apache.karaf.jaas.boot.principal.RolePrincipal"/>
>            </tempDestinationAuthorizationEntry>
>          </authorizationMap>
>         </map>
>       </authorizationPlugin>
> {code}
> The groupClass attribute is set on the TempDestinationAuthorizationEntry instance but
we don't apply the groupClass to the AuthorizationEntry by calling afterPropertiesSet();
> As a result, authorization fails when trying to create a temp destination. 
> This can happen when deploying the broker inside a Karaf container and have Karaf do
the authentication (such as in JBoss A-MQ). 
> The groupClass is properly set on the authorizationEntries within the <authorizationEntries>
list and only fails to be applied properly on the tempDestinationAuthorizationEntry. 

This message was sent by Atlassian JIRA

View raw message