[jira] [Commented] (ARTEMIS-5958) ArtemisRbacInvocationHandler removeIfNoPermssion is costly

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/ARTEMIS-5958?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18074956#comment-18074956 ] 

ASF subversion and git services commented on ARTEMIS-5958:
----------------------------------------------------------

Commit 20bb13c7657041a3b9367c49a2c44faa52fa49a8 in artemis's branch refs/heads/main from Gary Tully
[ https://gitbox.apache.org/repos/asf?p=artemis.git;h=20bb13c765 ]

ARTEMIS-5958 refactor security store to expose hasPermission bool, to get a fast path for rbac chechs that restrict access. the regular check is still in play for invocations

Assisted-by: Claude


> ArtemisRbacInvocationHandler removeIfNoPermssion is costly
> ----------------------------------------------------------
>
>                 Key: ARTEMIS-5958
>                 URL: https://issues.apache.org/jira/browse/ARTEMIS-5958
>             Project: Artemis
>          Issue Type: Improvement
>          Components: JMX
>    Affects Versions: 2.53.0
>            Reporter: Gary Tully
>            Assignee: Gary Tully
>            Priority: Major
>              Labels: pull-request-available
>          Time Spent: 40m
>  Remaining Estimate: 0h
>
> The ArtemisRbacInvocationHandler limits querys based on the view permissions of the returned mbean object names.
>  
> [https://github.com/apache/artemis/blob/main/artemis-server/src/main/java/org/apache/activemq/artemis/core/server/management/ArtemisRbacInvocationHandler.java#L99]
>  
> This filter uses the security store check method. This check is typically expected to succeed so is coded to error with a an audit log and exception when it fails. This is not ideal for the remove check, both noisy and costly.
>  
> in the filter case, we want to remove entries to avoid future calls that will fail with this check when actually invoked.
>  
> I think the security store needs a new api, bool hasPermission(...) that will return a true or false, the actual check that throws can be implemented over that to keep a single code path.
> There are two existing use cases that will benefit. The jolokia integration that provides the permission bit on the mbean info descriptions and the jmx mbean server guard interceptor that does rbac.
>   



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@artemis.apache.org
For additional commands, e-mail: issues-help@artemis.apache.org