[jira] [Commented] (QPID-7008) [Java Broker] Add message user-id verification to 0-10 and 1-0 protocols

["Rob Godfrey (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/QPID-7008?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15155722#comment-15155722 ] 

Rob Godfrey commented on QPID-7008:
-----------------------------------

{quote}
* we should have a system test for this feature (for 0-9/0-10, for now)
{quote}

Probably - but we'd either need to craft a custom client or do the test in Python.  I think the JMS client will only populate the message with null or the identity used for authentication

{quote}
* the docs are now out of date (Java-Broker-Management-Managing-Broker.xml)
{quote}

OK - I can fix that

{quote}
* AbstractAMQPConnection#_messageAuthorizationRequired is not thread safe. I would make it final and assign in the constructor
{quote}

We can't assign in the constructor because I think we should be able to alter this setting at a per vhost level - which is why I assigned it on registration of the connection with the vhost.  Making the attribute volatile should be sufficient however .


> [Java Broker] Add message user-id verification to 0-10 and 1-0 protocols
> ------------------------------------------------------------------------
>
>                 Key: QPID-7008
>                 URL: https://issues.apache.org/jira/browse/QPID-7008
>             Project: Qpid
>          Issue Type: Bug
>          Components: Java Broker
>            Reporter: Rob Godfrey
>            Assignee: Rob Godfrey
>
> Currently the Java Broker with verify that the user-id associated with a message is (if present) equal to the user-id by which the connection authenticated if the qpid.broker_msg_auth setting is true - but only for AMQP 0-8/9/9-1 protocols.
> This should be extended to cover all AMQP protocols.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@qpid.apache.org
For additional commands, e-mail: dev-help@qpid.apache.org