You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@qpid.apache.org by "Marnie McCormack (JIRA)" <qp...@incubator.apache.org> on 2008/04/22 13:12:25 UTC
[jira] Created: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Move JMSXUserID creation to client to improve broker performance
----------------------------------------------------------------
Key: QPID-943
URL: https://issues.apache.org/jira/browse/QPID-943
Project: Qpid
Issue Type: Improvement
Components: Java Broker, Java Client
Affects Versions: M2.1
Reporter: Marnie McCormack
Assignee: Martin Ritchie
Fix For: M3
Summary:
Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
Proposed Changes:
Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
Test Strategy:
Test messages with manual user id creation(correct and incorrect), automatic user id creation.
Test broker in validation mode and lenient mode.
Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Ted Ross (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12747976#action_12747976 ]
Ted Ross commented on QPID-943:
-------------------------------
One more related idea:
The userId check-suppression that occurs for federation links should be generalized for trusted clients. In federation, the downstream broker trusts the upstream broker (its client) to authenticate the userIds in the messages it forwards.
There's a use case for real trusted clients that produce messages on behalf of users that didn't open the connection. In this case, the client can set an option to be trusted, the option is validated by an ACL, and the broker then suppresses the userId check on messages from that client.
An example of this use case is a web server that uses a Qpid client in its back-end. Messages sent into the Qpid broker contain the userId of the end-user that was authenticated by the web server.
Thoughts?
-Ted
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: 0.5
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: 0.6
>
> Attachments: c++broker_userid_check.patch, javabroker_userid_check.patch, JMSXUserID.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
Apache Qpid - AMQP Messaging Implementation
Project: http://qpid.apache.org
Use/Interact: mailto:dev-subscribe@qpid.apache.org
[jira] Updated: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Rajith Attapattu (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rajith Attapattu updated QPID-943:
----------------------------------
Attachment: userid_check.patch
Message verification (user id check) patch for C++ broker
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: userid_check.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Rob Godfrey (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12635402#action_12635402 ]
Rob Godfrey commented on QPID-943:
----------------------------------
As above I reviewed the Java Broker change per Rajith's request... I'm not in a position to review the C++...
The Java client side change looks fine, although it might be an idea to make it an option to not set the userId...
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: c++broker_userid_check.patch, javabroker_userid_check.patch, JMSXUserID.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Rajith Attapattu (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12635423#action_12635423 ]
Rajith Attapattu commented on QPID-943:
---------------------------------------
Gordon has reviewed the c++ patch.
I agree with Rob about making it an option to not set the userid.
Also another thing to note is that in the C++ broker will only validate the message if a userid is present.
Rob what are your thoughts on doing the same with the java broker to make it consistent with the c++ broker?
I also need to add a test for both java and c++ brokers.
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: c++broker_userid_check.patch, javabroker_userid_check.patch, JMSXUserID.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Ted Ross (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ted Ross updated QPID-943:
--------------------------
Affects Version/s: (was: M2.1)
0.5
Fix Version/s: (was: M4)
0.6
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: 0.5
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: 0.6
>
> Attachments: c++broker_userid_check.patch, javabroker_userid_check.patch, JMSXUserID.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
Apache Qpid - AMQP Messaging Implementation
Project: http://qpid.apache.org
Use/Interact: mailto:dev-subscribe@qpid.apache.org
[jira] Commented: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Rafael H. Schloming (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12635717#action_12635717 ]
Rafael H. Schloming commented on QPID-943:
------------------------------------------
The patch for the client shouldn't use String.getBytes() as that will use the default encoding to convert from String -> bytes, and we have to use UTF-8. Also it's going to slow down the client a fair bit to do that conversion on every single message send. We should use Strings.toUTF8(), and cache the result so we don't have to recompute it for every send we do.
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: c++broker_userid_check.patch, javabroker_userid_check.patch, JMSXUserID.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Rob Godfrey (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12634517#action_12634517 ]
Rob Godfrey commented on QPID-943:
----------------------------------
Rajith,
I would suggest that instead of making _userID as a member variable - it would make more sense just to use a local variable since it is only used in the one location.
i.e. change the sections:
+ if (MSG_AUTH && !_publisher.getAuthorizedID().getName().equals(getUserID() == null? "" : getUserID().toString()))
and
+
+ public AMQShortString getUserID()
+ {
+ if (_userID == null)
+ {
+ _userID = getContentHeaderBody().properties instanceof BasicContentHeaderProperties ?
+ ((BasicContentHeaderProperties) getContentHeaderBody().properties).getUserId() : null;
+ }
+
+ return _userID;
+ }
to
+ AMQShortString userID = getContentHeaderBody().properties instanceof BasicContentHeaderProperties ?
+ ((BasicContentHeaderProperties) getContentHeaderBody().properties).getUserId() : null;
+ if (MSG_AUTH && !_publisher.getAuthorizedID().getName().equals(userID == null? "" : userID().toString()))
and remove the mutating getter.
Other than that I think the Java broker change looks good.
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: c++broker_userid_check.patch, javabroker_userid_check.patch, JMSXUserID.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Carl Trieloff (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12635439#action_12635439 ]
Carl Trieloff commented on QPID-943:
------------------------------------
I had reviewed C++ side which started a discussing and some additions to handle federation
Will review again once that is solved
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: c++broker_userid_check.patch, javabroker_userid_check.patch, JMSXUserID.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Rajith Attapattu (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rajith Attapattu updated QPID-943:
----------------------------------
Attachment: (was: userid_check.patch)
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: javabroker_userid_check.patch, JMSXUserID.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Rajith Attapattu (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12635542#action_12635542 ]
Rajith Attapattu commented on QPID-943:
---------------------------------------
Carl, Added a patch for protecting the creation of federation links via ACL.
This prevents a connection from posing as a federation link to get away with userid check.
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: c++broker_userid_check.patch, javabroker_userid_check.patch, JMSXUserID.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Rajith Attapattu (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rajith Attapattu updated QPID-943:
----------------------------------
Attachment: JMSXUserID.patch
Sets the user_id in outgoing messages for both 0-8 and 0-10 code path.
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: javabroker_userid_check.patch, JMSXUserID.patch, userid_check.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Rajith Attapattu (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rajith Attapattu updated QPID-943:
----------------------------------
Attachment: c++broker_userid_check.patch
1. The broker will verify that the userid, if supplied, matches the authenticated identity of the connection.
2. For a federation link an argument ( qpid.fed_link) will be added to ClientProperties when sending the ConnectionStartOk command.
3. The receiving broker will mark the connection as a federation link which will be used by SemanticState.cpp to skip the message authentication step for all messages received via that connection as we trust the broker. In an unstrusted domain user_id check is useless as you would need to rely on a stronger mechanism such as message signing.
4. As an aside the qpid.fed_link property is also used to mark a connection as a federation link in management.
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: c++broker_userid_check.patch, javabroker_userid_check.patch, JMSXUserID.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Rajith Attapattu (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12635444#action_12635444 ]
Rajith Attapattu commented on QPID-943:
---------------------------------------
Carl, the federation case is solved and the patch was reviewed by Gordon before commit.
The solution is to skip the userid check for messages originating from a federation link.
Protecting the federation link with ACL is currently being tested and will attach a patch shortly to the respective JIRA (QPID-1297)
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: c++broker_userid_check.patch, javabroker_userid_check.patch, JMSXUserID.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Rajith Attapattu (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rajith Attapattu updated QPID-943:
----------------------------------
Attachment: javabroker_userid_check.patch
java broker patch to verify user_id in message properties.
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: javabroker_userid_check.patch, JMSXUserID.patch, userid_check.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Reopened: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Ted Ross (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ted Ross reopened QPID-943:
---------------------------
There's an issue with the way userId checking is done in the C++ broker. The broker, when it stores the userId for a connection (line 68 in qpid/broker/SemanticState.cpp), strips the domain portion of the ID. So if the userId is "fred@domain.com", it will be stored as "fred".
The problem is that when "fred@domain.com" creates a connection and then sends messages with userId => "fred@domain.com", the messages are rejected because the strings don't match.
Having the client strip the domain before producing a message seems incorrect since important information is lost. Also, a consumer which is using the vouched-for userId for its own purposes will need the domain text.
I propose that userIds not be tampered with by the broker. Will this cause a problem with the JMS clients? What does the Java broker do?
-Ted
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: 0.5
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: 0.6
>
> Attachments: c++broker_userid_check.patch, javabroker_userid_check.patch, JMSXUserID.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
Apache Qpid - AMQP Messaging Implementation
Project: http://qpid.apache.org
Use/Interact: mailto:dev-subscribe@qpid.apache.org
[jira] Commented: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Aidan Skinner (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12635335#action_12635335 ]
Aidan Skinner commented on QPID-943:
------------------------------------
Who's reviewing this?
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: c++broker_userid_check.patch, javabroker_userid_check.patch, JMSXUserID.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Marnie McCormack (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Marnie McCormack updated QPID-943:
----------------------------------
Fix Version/s: (was: 0.6)
0.7
Moving to 0.7 as I don't think items for which it was re-opened by Ted have been completed/will make it into 0.6
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: 0.5
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: 0.7
>
> Attachments: c++broker_userid_check.patch, javabroker_userid_check.patch, JMSXUserID.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
Apache Qpid - AMQP Messaging Implementation
Project: http://qpid.apache.org
Use/Interact: mailto:dev-subscribe@qpid.apache.org
[jira] Commented: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Rajith Attapattu (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12634527#action_12634527 ]
Rajith Attapattu commented on QPID-943:
---------------------------------------
thx Rob for the feedback.
Agreed with your comment, will change before commit.
Rajith
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: c++broker_userid_check.patch, javabroker_userid_check.patch, JMSXUserID.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Aidan Skinner (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12631428#action_12631428 ]
Aidan Skinner commented on QPID-943:
------------------------------------
Having a 'lenient' mode is crack, if the value is set it shoudl be checked.
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Martin Ritchie
> Fix For: M4
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Rajith Attapattu (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12633439#action_12633439 ]
Rajith Attapattu commented on QPID-943:
---------------------------------------
Carl,
I had a brief chat with ted on irc and we have the following solutions for the above issue.
1 Trusted broker federation
--------------------------------------
Implement single-sign-on to a federation.
So when a client logs into a broker thats part of a trusted federation, it will also receive a ticket.
This ticket will be included in the message properties. The other broker will skip the user id check if a valid ticket is available.
A client trying to fake a ticket (similar to trying to fake a keberos ticket) will depend on the strength of mechanism we use for our single-sign-on solution.
2. Running Federation with user_id check turned off, but protecting the ability to do so with ACL
----------------------------------------------------------------------------------------------------------------------------------
If you are running in an untrusted domain then you could turn off the user_id check for federation links.
Currently the user_id check is global, but we could also make this connection specific and the ability to turn it off controled via ACL's.
The request to turn off user_id check can be a qpid specific parameter in the arguments passed in connection start.
This way we can turn the user_id check on/off for selectively on a per connection basis.
Comments and suggestions are most welcomed.
Regards,
Rajith.
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: userid_check.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Rajith Attapattu (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rajith Attapattu updated QPID-943:
----------------------------------
Assignee: Rajith Attapattu (was: Martin Ritchie)
After discussing with Rob, Aidan and Gordon I have made the following changes to the Java, C++ broker and JMS Clients.
I have used the "user_id" header (available in both 0-8/0-9 and 0-10 spec) to validate messages as well as to pass the JMSXUserID property.
C++ Broker
--------------------------
If auth == yes and msg-auth == yes, then the user_id specified in the message properties will be verified against the user_id used in connection authentication.
The default value for msg-auth is false and can be configured using the --msg-auth param.
Java Broker
-------------------------
Removed the hack in org.apache.qpid.server.AMQChannel to add the JMXUserID, instead is using the following strategy.
if security.msg-auth == true then the user_id in the message header will be compared against the user_id used in connection authentication.
The msg-auth can be configured in config.xml and the default value is false.
JMS Client (0-8/0-9 and 0-10)
-------------------------------------------
Both versions of MessageProducers will insert the user_id used for connection authentication in to the correct user_id header.
On the receiving side, both versions of MessageConsumers will read the user_id header and add that as the value for JMSXUserID in the properties.
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Rob Godfrey (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Rob Godfrey resolved QPID-943.
------------------------------
Resolution: Fixed
This JIRA seems to have all work completed against it so should be marked as resolved in M4
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: c++broker_userid_check.patch, javabroker_userid_check.patch, JMSXUserID.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Carl Trieloff (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12633404#action_12633404 ]
Carl Trieloff commented on QPID-943:
------------------------------------
One question, how does this patch work when we federate messages? Messages sent across a federated link will be of different User-id to the connection.
it would be nice to be able to run with the option on for client messages, but still be able to federate messages.
Carl.
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: userid_check.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Carl Trieloff (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12633496#action_12633496 ]
Carl Trieloff commented on QPID-943:
------------------------------------
Rajith,
That sounds like a good approach to try out.
Carl.
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: userid_check.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Carl Trieloff (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12635447#action_12635447 ]
Carl Trieloff commented on QPID-943:
------------------------------------
Thanks, I had missed that Gordon had checked it.
Carl.
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: c++broker_userid_check.patch, javabroker_userid_check.patch, JMSXUserID.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (QPID-943) Move JMSXUserID creation to client to
improve broker performance
Posted by "Gordon Sim (JIRA)" <qp...@incubator.apache.org>.
[ https://issues.apache.org/jira/browse/QPID-943?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12633578#action_12633578 ]
Gordon Sim commented on QPID-943:
---------------------------------
Regarding the interaction of userid checking with federation, I think a variation on option (2) above is probably a reasonable short term solution. Here an inter-broker link would be identified by a capability or property communicated during the connection establishment and for inter-broker links, since the transfer would have been verified by the broker which initially accepted the transfer, subsequent checking would be ignored. Establishing an inter-broker link would then be an action that could be enforce via permissions in an ACL. (I.e. the only difference wrt (2) above is that the apabaility and permission is more generic than turning off userid checking).
A slightly more involved feature would be to grant permission (through the ACL) for an authenticated user to 'send on behalf of' a specific set of other users (which could be 'all users').
I am not at all keen on the command line option to disable userid validation; if authorisation is on and a userid is specified by the client, I think its better to always validate it. In the future perhaps permission to publish anonymous messages (where no userid is specified) might be grantable through the ACL, for now I suspect that client side configuration is sufficient here.
[Other specific change requests on c++ patch sent to author].
> Move JMSXUserID creation to client to improve broker performance
> ----------------------------------------------------------------
>
> Key: QPID-943
> URL: https://issues.apache.org/jira/browse/QPID-943
> Project: Qpid
> Issue Type: Improvement
> Components: Java Broker, Java Client
> Affects Versions: M2.1
> Reporter: Marnie McCormack
> Assignee: Rajith Attapattu
> Fix For: M4
>
> Attachments: javabroker_userid_check.patch, JMSXUserID.patch, userid_check.patch
>
>
> Summary:
> Currently the broker modifies the message to add the JMSXUserID. A better approach would be to have the client encode that detail and have the broker verify that it is correct. This means that the broker does not have to re-encode every message. It also allows the sending client to decide if they wish to include the JMSXUserID for validation.
> Proposed Changes:
> Removing existing modification code replacing with validation if the JMSXUserID is present. If validation is required to pass then close the connection on failures.
> Augment to client to have the ability to manuall or automatically set the JMSXUserID based on the authenticated connection.
> Test Strategy:
> Test messages with manual user id creation(correct and incorrect), automatic user id creation.
> Test broker in validation mode and lenient mode.
> Testing should include performance metrics to quantify the inpact of the additional processing.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.