qpid-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From rob...@apache.org
Subject svn commit: r823464 - in /qpid/trunk/qpid/java: broker/src/main/java/org/apache/qpid/server/security/access/PrincipalPermissions.java systests/src/main/java/org/apache/qpid/server/security/acl/SimpleACLTest.java
Date Fri, 09 Oct 2009 08:54:26 GMT
Author: robbie
Date: Fri Oct  9 08:54:26 2009
New Revision: 823464

URL: http://svn.apache.org/viewvc?rev=823464&view=rev
Log:
QPID-1872: check for existence of outer consume permissions map before proceeding to further
checks, and if not present then deny immediately as it signifies a complete lack of consume
rights in the ACL settigns for the user in question. Update SimpleACLTest to add a check for
consumption with create but without consume right, and to allow each test to customise the
ACL settings before QTC.setUp() starts the broker

Modified:
    qpid/trunk/qpid/java/broker/src/main/java/org/apache/qpid/server/security/access/PrincipalPermissions.java
    qpid/trunk/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/SimpleACLTest.java

Modified: qpid/trunk/qpid/java/broker/src/main/java/org/apache/qpid/server/security/access/PrincipalPermissions.java
URL: http://svn.apache.org/viewvc/qpid/trunk/qpid/java/broker/src/main/java/org/apache/qpid/server/security/access/PrincipalPermissions.java?rev=823464&r1=823463&r2=823464&view=diff
==============================================================================
--- qpid/trunk/qpid/java/broker/src/main/java/org/apache/qpid/server/security/access/PrincipalPermissions.java
(original)
+++ qpid/trunk/qpid/java/broker/src/main/java/org/apache/qpid/server/security/access/PrincipalPermissions.java
Fri Oct  9 08:54:26 2009
@@ -494,6 +494,12 @@
                 {
                     AMQQueue queue = ((AMQQueue) parameters[0]);
                     Map queuePermissions = (Map) _permissions.get(permission);
+                    
+                    if (queuePermissions == null)
+                    {
+                    	//if the outer map is null, the user has no CONSUME rights at all
+                    	return AuthzResult.DENIED;
+                    }
 
                     List queues = (List) queuePermissions.get(CONSUME_QUEUES_KEY);
 

Modified: qpid/trunk/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/SimpleACLTest.java
URL: http://svn.apache.org/viewvc/qpid/trunk/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/SimpleACLTest.java?rev=823464&r1=823463&r2=823464&view=diff
==============================================================================
--- qpid/trunk/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/SimpleACLTest.java
(original)
+++ qpid/trunk/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/SimpleACLTest.java
Fri Oct  9 08:54:26 2009
@@ -21,6 +21,7 @@
 
 package org.apache.qpid.server.security.acl;
 
+import org.apache.commons.configuration.ConfigurationException;
 import org.apache.qpid.AMQException;
 import org.apache.qpid.AMQConnectionFailureException;
 import org.apache.qpid.client.AMQAuthenticationException;
@@ -43,11 +44,20 @@
 import javax.jms.TextMessage;
 import javax.naming.NamingException;
 import java.io.File;
+import java.io.IOException;
 
 public class SimpleACLTest extends QpidTestCase implements ConnectionListener
 {
     public void setUp() throws Exception
     {
+    	//Performing setUp here would result in a broker with the default ACL test config
+    	
+    	//Each test now calls the private setUpACLTest to allow them to make 
+    	//individual customisations to the base ACL settings
+    }
+    
+    private void setUpACLTest() throws Exception
+    {
         final String QPID_HOME = System.getProperty("QPID_HOME");
 
         if (QPID_HOME == null)
@@ -67,8 +77,10 @@
         return "amqp://" + username + ":" + password + "@clientid/test?brokerlist='" + getBroker()
+ "?retries='0''";
     }
 
-    public void testAccessAuthorized() throws AMQException, URLSyntaxException
+    public void testAccessAuthorized() throws AMQException, URLSyntaxException, Exception
     {
+    	setUpACLTest();
+    	
         try
         {
             Connection conn = getConnection("client", "guest");
@@ -90,6 +102,8 @@
 
     public void testAccessNoRights() throws Exception
     {
+    	setUpACLTest();
+    	
         try
         {
             Connection conn = getConnection("guest", "guest");
@@ -114,8 +128,40 @@
         }
     }
 
-    public void testClientConsumeFromTempQueueValid() throws AMQException, URLSyntaxException
+    public void testGuestConsumeWithCreateRightsAndWithoutConsumeRights() throws NamingException,
ConfigurationException, IOException, Exception
+    {
+        //Customise the ACL config to give the guest user some create (could be any, non-consume)
rights to 
+        //force creation of a PrincipalPermissions instance to perform the consume rights
check against.
+        setConfigurationProperty("virtualhosts.virtualhost.test.security.access_control_list.create.queues.queue.users.user",
"guest");
+        
+        setUpACLTest();
+        
+        try
+        {
+            Connection conn = getConnection("guest", "guest");
+
+            Session sesh = conn.createSession(false, Session.AUTO_ACKNOWLEDGE);
+
+            conn.start();
+
+            sesh.createConsumer(sesh.createQueue("example.RequestQueue"));
+
+            conn.close();
+        }
+        catch (JMSException e)
+        {
+            Throwable cause = e.getLinkedException();
+
+            assertNotNull("There was no liked exception", cause);
+            assertEquals("Wrong linked exception type", AMQAuthenticationException.class,
cause.getClass());
+            assertEquals("Incorrect error code received", 403, ((AMQAuthenticationException)
cause).getErrorCode().getCode());
+        }
+    }
+
+    public void testClientConsumeFromTempQueueValid() throws AMQException, URLSyntaxException,
Exception
     {
+    	setUpACLTest();
+    	
         try
         {
             Connection conn = getConnection("client", "guest");
@@ -134,8 +180,10 @@
         }
     }
 
-    public void testClientConsumeFromNamedQueueInvalid() throws NamingException
+    public void testClientConsumeFromNamedQueueInvalid() throws NamingException, Exception
     {
+    	setUpACLTest();
+    	
         try
         {
             Connection conn = getConnection("client", "guest");
@@ -161,8 +209,10 @@
         }
     }
 
-    public void testClientCreateTemporaryQueue() throws JMSException, URLSyntaxException
+    public void testClientCreateTemporaryQueue() throws JMSException, URLSyntaxException,
Exception
     {
+    	setUpACLTest();
+    	
         try
         {
             Connection conn = getConnection("client", "guest");
@@ -183,8 +233,10 @@
         }
     }
 
-    public void testClientCreateNamedQueue() throws NamingException, JMSException, AMQException
+    public void testClientCreateNamedQueue() throws NamingException, JMSException, AMQException,
Exception
     {
+    	setUpACLTest();
+    	
         try
         {
             Connection conn = getConnection("client", "guest");
@@ -206,8 +258,10 @@
         }
     }
 
-    public void testClientPublishUsingTransactionSuccess() throws AMQException, URLSyntaxException
+    public void testClientPublishUsingTransactionSuccess() throws AMQException, URLSyntaxException,
Exception
     {
+    	setUpACLTest();
+    	
         try
         {
             Connection conn = getConnection("client", "guest");
@@ -233,8 +287,10 @@
         }
     }
 
-    public void testClientPublishValidQueueSuccess() throws AMQException, URLSyntaxException
+    public void testClientPublishValidQueueSuccess() throws AMQException, URLSyntaxException,
Exception
     {
+    	setUpACLTest();
+    	
         try
         {
             Connection conn = getConnection("client", "guest");
@@ -263,8 +319,10 @@
         }
     }
 
-    public void testClientPublishInvalidQueueSuccess() throws AMQException, URLSyntaxException,
JMSException, NamingException
+    public void testClientPublishInvalidQueueSuccess() throws AMQException, URLSyntaxException,
JMSException, NamingException, Exception
     {
+    	setUpACLTest();
+    	
         try
         {
             Connection conn = getConnection("client", "guest");
@@ -308,8 +366,10 @@
         }
     }
 
-    public void testServerConsumeFromNamedQueueValid() throws AMQException, URLSyntaxException
+    public void testServerConsumeFromNamedQueueValid() throws AMQException, URLSyntaxException,
Exception
     {
+    	setUpACLTest();
+    	
         try
         {
             Connection conn = getConnection("server", "guest");
@@ -328,8 +388,10 @@
         }
     }
 
-    public void testServerConsumeFromNamedQueueInvalid() throws AMQException, URLSyntaxException,
NamingException
+    public void testServerConsumeFromNamedQueueInvalid() throws AMQException, URLSyntaxException,
NamingException, Exception
     {
+    	setUpACLTest();
+    	
         try
         {
             Connection conn = getConnection("client", "guest");
@@ -353,8 +415,10 @@
         }
     }
 
-    public void testServerConsumeFromTemporaryQueue() throws AMQException, URLSyntaxException,
NamingException
+    public void testServerConsumeFromTemporaryQueue() throws AMQException, URLSyntaxException,
NamingException, Exception
     {
+    	setUpACLTest();
+    	
         try
         {
             Connection conn = getConnection("server", "guest");
@@ -388,8 +452,10 @@
         return (Connection) connection;
     }
 
-    public void testServerCreateNamedQueueValid() throws JMSException, URLSyntaxException
+    public void testServerCreateNamedQueueValid() throws JMSException, URLSyntaxException,
Exception
     {
+    	setUpACLTest();
+    	
         try
         {
             Connection conn = getConnection("server", "guest");
@@ -409,8 +475,10 @@
         }
     }
 
-    public void testServerCreateNamedQueueInvalid() throws JMSException, URLSyntaxException,
AMQException, NamingException
+    public void testServerCreateNamedQueueInvalid() throws JMSException, URLSyntaxException,
AMQException, NamingException, Exception
     {
+    	setUpACLTest();
+    	
         try
         {
             Connection conn = getConnection("server", "guest");
@@ -431,8 +499,10 @@
         }
     }
 
-    public void testServerCreateTemporaryQueueInvalid() throws NamingException
+    public void testServerCreateTemporaryQueueInvalid() throws NamingException, Exception
     {
+    	setUpACLTest();
+    	
         try
         {
             Connection conn = getConnection("server", "guest");
@@ -456,8 +526,10 @@
         }
     }
 
-    public void testServerCreateAutoDeleteQueueInvalid() throws NamingException, JMSException,
AMQException
+    public void testServerCreateAutoDeleteQueueInvalid() throws NamingException, JMSException,
AMQException, Exception
     {
+    	setUpACLTest();
+    	
         Connection connection = null;
         try
         {
@@ -487,8 +559,10 @@
      * @throws URLSyntaxException
      * @throws JMSException
      */
-    public void testServerPublishUsingTransactionSuccess() throws AMQException, URLSyntaxException,
JMSException, NamingException
+    public void testServerPublishUsingTransactionSuccess() throws AMQException, URLSyntaxException,
JMSException, NamingException, Exception
     {
+    	setUpACLTest();
+    	
         //Set up the Server
         Connection serverConnection = getConnection("server", "guest");
 
@@ -567,8 +641,10 @@
         }
     }
 
-    public void testServerPublishInvalidQueueSuccess() throws AMQException, URLSyntaxException,
JMSException, NamingException
+    public void testServerPublishInvalidQueueSuccess() throws AMQException, URLSyntaxException,
JMSException, NamingException, Exception
     {
+    	setUpACLTest();
+    	
         try
         {
             Connection conn = getConnection("server", "guest");



---------------------------------------------------------------------
Apache Qpid - AMQP Messaging Implementation
Project:      http://qpid.apache.org
Use/Interact: mailto:commits-subscribe@qpid.apache.org


Mime
View raw message