[jira] [Resolved] (ARTEMIS-6094) Allow a security role to be composed by a set of other security roles

["Gary Tully (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/ARTEMIS-6094?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Gary Tully resolved ARTEMIS-6094.
---------------------------------
    Fix Version/s: 2.55.0
       Resolution: Fixed

> Allow a security role to be composed by a set of other security roles
> ---------------------------------------------------------------------
>
>                 Key: ARTEMIS-6094
>                 URL: https://issues.apache.org/jira/browse/ARTEMIS-6094
>             Project: Artemis
>          Issue Type: Bug
>            Reporter: Thomas Lavocat
>            Priority: Major
>              Labels: pull-request-available
>             Fix For: 2.55.0
>
>          Time Spent: 50m
>  Remaining Estimate: 0h
>
> to set up the permissions for the temporary queues the following way:
> # role1
> securityRoles."TEMP.*".role1.createAddress=true
> securityRoles."TEMP.*".role1.send=true
> securityRoles."TEMP.*".role1.consume=true
> securityRoles."TEMP.*".role1.createNonDurableQueue=true
> # role2
> securityRoles."TEMP.*".role2.createAddress=true
> securityRoles."TEMP.*".role2.send=true
> securityRoles."TEMP.*".role2.consume=true
> securityRoles."TEMP.*".role2.createNonDurableQueue=true
> # role3
> securityRoles."TEMP.*".role3.createAddress=true 
> securityRoles."TEMP.*".role3.send=true 
> securityRoles."TEMP.*".role3.consume=true 
> securityRoles."TEMP.*".role3.createNonDurableQueue=true
> leads to be repetition for the same set of permissions, using a different role each time. If there are lots of roles, this can become tedious and error-prone
> For cases like this, we'd like some kind of role alias, for example
>  
> # tempSettingsRoles
> tempSettingsRoles=role1,role2,role3
> securityRoles."TEMP.*".tempSettingsRoles.createAddress=true 
> securityRoles."TEMP.*".tempSettingsRoles.send=true 
> securityRoles."TEMP.*".tempSettingsRoles.consume=true 
> securityRoles."TEMP.*".tempSettingsRoles.createNonDurableQueue=true
> I'd propose an alternative solution. The broker already accepts JSON broker properties. It could also accept YAML broker properties. JSON and YAML are identical in meaning, but in YAML, we can use native references.
> Under the hood, this requires zero custom macro-processing or parsing logic on our end. By leveraging standard libraries like Jackson and SnakeYAML, the reference expansion happens natively at the parsing layer. The broker simply receives a fully expanded object tree in memory, giving us this capability for free without introducing any maintenance overhead.
> So the above piece of configuration would be:
> securityRoles:
>   "TEMP.*":
>     # Defining base alias
>     base_permissions: &base_perms
>       createAddress: true
>       send: true
>       consume: true
>       createNonDurableQueue: true
>       
>     # Applying to the role
>     role1: *base_perms
>     role2: *base_perms
>     role3: *base_perms



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@artemis.apache.org
For additional commands, e-mail: issues-help@artemis.apache.org