Mailing-List: contact dev-help@activemq.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@activemq.apache.org
MIME-Version: 1.0
From: Jeff Mesnil <jmesnil@gmail.com>
Date: Fri, 3 Jun 2016 14:52:07 +0200
Message-ID: <CAAEH2wehUEk-kd_ppA1hAn5PQjL0Cpkg3RZLn7Tp9=8G1u8bqQ@mail.gmail.com>
Subject: Container-managed security in Artemis Resource Adapter
To: dev@activemq.apache.org
Content-Type: text/plain; charset=UTF-8
archived-at: Fri, 03 Jun 2016 12:52:14 -0000

Hi,

I'm working on providing Container-managed security in Artemis
resource adapter for our app server.

Artemis RA has been coded to support it already. If there is a
security domain specified for its resource adapter, Artemis
ManagedConnection will use the security's Subject for its
authentication on the broker side.

However there is one use case that I'm not sure about.
When the user specifies credentials when calling the RA's
ConnectionFactory methods, Artemis discards them if there is a subject
from the SecurityDomain[1].
I would have expected the opposite: credential parameters from the
ConnectionRequestInfo should have precedence over the Subject's from
the security domain.

What do you think about changing that behaviour?

If there are credentials from the ConnectionRequestInfo, use them
else if there is a Subject, use it
else raise an exception.


[1] https://github.com/apache/activemq-artemis/blob/master/artemis-ra/src/main/java/org/apache/activemq/artemis/ra/ActiveMQRACredential.java#L122
-- 
Jeff Mesnil
jmesnil@gmail.com
http://jmesnil.net/weblog/