svn commit: r1244946 - in /qpid/trunk/qpid/java/broker: etc/broker_example.acl src/main/java/org/apache/qpid/server/management/MBeanInvocationHandlerImpl.java

[ro...@apache.org]

Author: robbie
Date: Thu Feb 16 11:49:14 2012
New Revision: 1244946

URL: http://svn.apache.org/viewvc?rev=1244946&view=rev
Log:
QPID-3844: allow queryMBeans to succeed without ACL checking, tools like JConsole / Qpid MC need this to function at all

Applied patch from Oleksandr Rudyy <or...@gmail.com>

Modified:
    qpid/trunk/qpid/java/broker/etc/broker_example.acl
    qpid/trunk/qpid/java/broker/src/main/java/org/apache/qpid/server/management/MBeanInvocationHandlerImpl.java

Modified: qpid/trunk/qpid/java/broker/etc/broker_example.acl
URL: http://svn.apache.org/viewvc/qpid/trunk/qpid/java/broker/etc/broker_example.acl?rev=1244946&r1=1244945&r2=1244946&view=diff
==============================================================================
--- qpid/trunk/qpid/java/broker/etc/broker_example.acl (original)
+++ qpid/trunk/qpid/java/broker/etc/broker_example.acl Thu Feb 16 11:49:14 2012
@@ -24,15 +24,32 @@
 #Define a 'messaging-users' group with users  'client' and  'server' in it
 GROUP messaging-users client server
 
+
 ### MANAGEMENT ####
 
-#Allow 'guest' to perform read operations on the Serverinformation mbean and view logger levels
-ACL ALLOW-LOG guest ACCESS METHOD component="ServerInformation"
-ACL ALLOW-LOG guest ACCESS METHOD component="LoggingManagement" name="viewEffectiveRuntimeLoggerLevels"
+# Allow everyone to perform read operations on the ServerInformation mbean
+# This is used for items such as querying the management API and broker release versions.
+ACL ALLOW-LOG ALL ACCESS METHOD component="ServerInformation"
 
-#Allow 'admin' all management operations
+# Allow 'admin' all management operations
 ACL ALLOW-LOG admin ALL METHOD
 
+# Deny access to Shutdown, UserManagement, ConfigurationManagement and LoggingManagement for all other users
+# You could grant specific users access to these beans by adding ALLOW-LOG rules above for them
+ACL DENY-LOG ALL ACCESS METHOD component="Shutdown"
+ACL DENY-LOG ALL ACCESS METHOD component="UserManagement"
+ACL DENY-LOG ALL ACCESS METHOD component="ConfigurationManagement"
+ACL DENY-LOG ALL ACCESS METHOD component="LoggingManagement"
+
+# Allow 'guest' to view logger levels, and use getter methods on LoggingManagement
+# These are examples of redundant rules! The DENY-LOG rule above will be invoked
+# first and will deny the access to all methods of LoggingManagement for guest
+ACL ALLOW-LOG guest ACCESS METHOD component="LoggingManagement" name="viewEffectiveRuntimeLoggerLevels"
+ACL ALLOW-LOG guest ACCESS METHOD component="LoggingManagement" name="get*"
+
+# Allow everyone to perform all read operations on the mbeans not listened in the DENY-LOG rules above
+ACL ALLOW-LOG ALL ACCESS METHOD
+
 ### MESSAGING ###
 
 #Example permissions for request-response based messaging.

Modified: qpid/trunk/qpid/java/broker/src/main/java/org/apache/qpid/server/management/MBeanInvocationHandlerImpl.java
URL: http://svn.apache.org/viewvc/qpid/trunk/qpid/java/broker/src/main/java/org/apache/qpid/server/management/MBeanInvocationHandlerImpl.java?rev=1244946&r1=1244945&r2=1244946&view=diff
==============================================================================
--- qpid/trunk/qpid/java/broker/src/main/java/org/apache/qpid/server/management/MBeanInvocationHandlerImpl.java (original)
+++ qpid/trunk/qpid/java/broker/src/main/java/org/apache/qpid/server/management/MBeanInvocationHandlerImpl.java Thu Feb 16 11:49:14 2012
@@ -87,8 +87,8 @@ public class MBeanInvocationHandlerImpl 
             return true;
         }
 
-        // Allow querying available object names
-        if (methodName.equals("queryNames"))
+        // Allow querying available object names and mbeans
+        if (methodName.equals("queryNames") || methodName.equals("queryMBeans"))
         {
             return true;
         }
@@ -108,7 +108,7 @@ public class MBeanInvocationHandlerImpl 
 
     public Object invoke(Object proxy, Method method, Object[] args) throws Throwable
     {
-        final String methodName = getMethodName(method, args);
+        String methodName = method.getName();
 
         if (methodName.equals("getMBeanServer"))
         {
@@ -173,6 +173,7 @@ public class MBeanInvocationHandlerImpl 
                 security = _appRegistry.getVirtualHostRegistry().getVirtualHost(vhost).getSecurityManager();
             }
 
+            methodName = getMethodName(method, args);
 			if (isAccessMethod(methodName) || impact == MBeanOperationInfo.INFO)
 			{
 				// Check for read-only method invocation permission



---------------------------------------------------------------------
Apache Qpid - AMQP Messaging Implementation
Project:      http://qpid.apache.org
Use/Interact: mailto:commits-subscribe@qpid.apache.org