Return-Path: 
 <dev-return-45877-apmail-activemq-dev-archive=activemq.apache.org@activemq.apache.org>
X-Original-To: apmail-activemq-dev-archive@www.apache.org
Delivered-To: apmail-activemq-dev-archive@www.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id 74FAB1123A
	for <apmail-activemq-dev-archive@www.apache.org>;
 Wed,  6 Aug 2014 13:35:12 +0000 (UTC)
Received: (qmail 57166 invoked by uid 500); 6 Aug 2014 13:35:12 -0000
Delivered-To: apmail-activemq-dev-archive@activemq.apache.org
Received: (qmail 57099 invoked by uid 500); 6 Aug 2014 13:35:12 -0000
Mailing-List: contact dev-help@activemq.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:dev-help@activemq.apache.org>
List-Unsubscribe: <mailto:dev-unsubscribe@activemq.apache.org>
List-Post: <mailto:dev@activemq.apache.org>
List-Id: <dev.activemq.apache.org>
Reply-To: dev@activemq.apache.org
Delivered-To: mailing list dev@activemq.apache.org
Received: (qmail 57087 invoked by uid 99); 6 Aug 2014 13:35:12 -0000
Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28)
    by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 06 Aug 2014 13:35:12 +0000
Date: Wed, 6 Aug 2014 13:35:12 +0000 (UTC)
From: "Dejan Bosanac (JIRA)" <jira@apache.org>
To: dev@activemq.apache.org
Message-ID: <JIRA.12731312.1406895889462.25102.1407332112116@arcas>
In-Reply-To: <JIRA.12731312.1406895889462@arcas>
References: <JIRA.12731312.1406895889462@arcas>
Subject: [jira] [Commented] (AMQ-5304) groupClass not applied to
 TempDestinationAuthorizationEntry
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394


    [ https://issues.apache.org/jira/browse/AMQ-5304?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14087662#comment-14087662 ] 

Dejan Bosanac commented on AMQ-5304:
------------------------------------

Added the test (ignored for now) with the following commit

https://git-wip-us.apache.org/repos/asf?p=activemq.git;a=commit;h=acf84b43

The patch also looks good to me.



> groupClass not applied to TempDestinationAuthorizationEntry
> -----------------------------------------------------------
>
>                 Key: AMQ-5304
>                 URL: https://issues.apache.org/jira/browse/AMQ-5304
>             Project: ActiveMQ
>          Issue Type: Bug
>          Components: Broker
>    Affects Versions: 5.10.0
>            Reporter: Torsten Mielke
>            Assignee: Torsten Mielke
>              Labels: authorization, security
>         Attachments: AMQ-5304.patch
>
>
> When configuring the authorization plugin with a <tempDestinationAuthorizationEntry> that also set a groupClass, this groupClass is not properly applied to the TempDestinationAuthorizationEntry instance. 
> E.g. consider this example config
> {code:xml}
>       <authorizationPlugin>
>         <map>
>           <authorizationMap groupClass="org.apache.karaf.jaas.boot.principal.RolePrincipal">
>             <authorizationEntries>
>               <authorizationEntry queue=">" read="admin" write="client,admin" admin="client,admin" />
>               <authorizationEntry topic=">" read="client,admin" write="admin" admin="admin"/>
>               <authorizationEntry topic="ActiveMQ.Advisory.>" read="admin,client" write="admin,client" admin="admin"/>
>            </authorizationEntries>
>            <tempDestinationAuthorizationEntry>
>              <tempDestinationAuthorizationEntry read="client,admin" write="client,admin" admin="client,admin" groupClass="org.apache.karaf.jaas.boot.principal.RolePrincipal"/>
>            </tempDestinationAuthorizationEntry>
>          </authorizationMap>
>         </map>
>       </authorizationPlugin>
> {code}
> The groupClass attribute is set on the TempDestinationAuthorizationEntry instance but we don't apply the groupClass to the AuthorizationEntry by calling afterPropertiesSet();
> As a result, authorization fails when trying to create a temp destination. 
> This can happen when deploying the broker inside a Karaf container and have Karaf do the authentication (such as in JBoss A-MQ). 
> The groupClass is properly set on the authorizationEntries within the <authorizationEntries> list and only fails to be applied properly on the tempDestinationAuthorizationEntry. 



--
This message was sent by Atlassian JIRA
(v6.2#6252)