[jira] Commented: (QPID-448) Provided GUI to display and edit user details.

["Martin Ritchie (JIRA)" <qp...@incubator.apache.org>]

    [ https://issues.apache.org/jira/browse/QPID-448?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12488307 ] 

Martin Ritchie commented on QPID-448:
-------------------------------------

As the MC doesn't use SSL we cannot send the password in clear text accross the network. As such the Base64MD5PasswordFilePD assumes the password string it is presented with is a hash of the password. As it never deals with passwords directly this seems to make sence... sort of. 

You may find this snippet useful, it was in the PD but realised it doesn't make sence to be there due to the clear text nature of the jmx connection.

        private byte[] getHash(String text) throws NoSuchAlgorithmException, UnsupportedEncodingException
        {
            byte[] data = text.getBytes(DEFAULT_ENCODING);

            MessageDigest md = MessageDigest.getInstance("MD5");

            for (byte b : data)
            {
                md.update(b);
            }

            return md.digest();
        }


> Provided GUI to display and edit user details.
> ----------------------------------------------
>
>                 Key: QPID-448
>                 URL: https://issues.apache.org/jira/browse/QPID-448
>             Project: Qpid
>          Issue Type: Sub-task
>          Components: Java Management Console
>            Reporter: Martin Ritchie
>         Assigned To: Bhupendra Bhardwaj
>             Fix For: M2
>
>
> The AMQUserManagementMBean will provide the following methods:
> viewUsers() -> TabularData -> Username(String), read(boolean), write(boolean), admin(boolean))
> AccessResult setPassword(username(String), password(String))
> AccessResult setRights(String username , boolean read, boolean write, boolean admin)
> AccessResult createUser(String username, String password, boolean read, boolean write, boolean admin)
> AccessResult deleteUser(String username)
> This should be used to provide an interface on the management console.
> Of course sending a plain text password is not very secure so the jmx connection should encrypte the password or use other means.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.