You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@qpid.apache.org by rg...@apache.org on 2016/07/08 13:23:26 UTC
svn commit: r1751900 [3/5] - in /qpid/java/trunk:
bdbstore/src/main/java/org/apache/qpid/server/virtualhost/berkeleydb/
bdbstore/src/main/java/org/apache/qpid/server/virtualhostnode/berkeleydb/
bdbstore/src/test/java/org/apache/qpid/server/virtualhostn...
Modified: qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/util/BrokerTestHelper.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/util/BrokerTestHelper.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/util/BrokerTestHelper.java (original)
+++ qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/util/BrokerTestHelper.java Fri Jul 8 13:23:25 2016
@@ -43,6 +43,7 @@ import org.apache.qpid.server.model.UUID
import org.apache.qpid.server.model.VirtualHost;
import org.apache.qpid.server.model.VirtualHostNode;
import org.apache.qpid.server.protocol.AMQSessionModel;
+import org.apache.qpid.server.security.AccessControl;
import org.apache.qpid.server.security.SecurityManager;
import org.apache.qpid.server.store.DurableConfigurationStore;
import org.apache.qpid.server.store.preferences.PreferenceStore;
@@ -91,7 +92,6 @@ public class BrokerTestHelper
when(broker.getConnection_sessionCountLimit()).thenReturn(1);
when(broker.getConnection_closeWhenNoRoute()).thenReturn(false);
when(broker.getId()).thenReturn(UUID.randomUUID());
- when(broker.getSecurityManager()).thenReturn(new SecurityManager(broker, false));
when(broker.getObjectFactory()).thenReturn(objectFactory);
when(broker.getModel()).thenReturn(objectFactory.getModel());
when(broker.getModelVersion()).thenReturn(BrokerModel.MODEL_VERSION);
@@ -212,10 +212,8 @@ public class BrokerTestHelper
Broker broker = mock(Broker.class);
when(broker.getModel()).thenReturn(BrokerModel.getInstance());
when(broker.getCategoryClass()).thenReturn(Broker.class);
- SecurityManager securityManager = new SecurityManager(broker, false);
final VirtualHost<?> virtualHost = mock(VirtualHost.class);
when(virtualHost.getName()).thenReturn(hostName);
- when(virtualHost.getSecurityManager()).thenReturn(securityManager);
when(virtualHost.getEventLogger()).thenReturn(eventLogger);
when(virtualHost.getDurableConfigurationStore()).thenReturn(mock(DurableConfigurationStore.class));
final ConfiguredObjectFactory objectFactory = new ConfiguredObjectFactoryImpl(BrokerModel.getInstance());
Modified: qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/virtualhost/AbstractVirtualHostTest.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/virtualhost/AbstractVirtualHostTest.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/virtualhost/AbstractVirtualHostTest.java (original)
+++ qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/virtualhost/AbstractVirtualHostTest.java Fri Jul 8 13:23:25 2016
@@ -53,6 +53,7 @@ import org.apache.qpid.server.model.Stat
import org.apache.qpid.server.model.SystemConfig;
import org.apache.qpid.server.model.VirtualHost;
import org.apache.qpid.server.model.VirtualHostNode;
+import org.apache.qpid.server.security.AccessControl;
import org.apache.qpid.server.security.SecurityManager;
import org.apache.qpid.server.store.DurableConfigurationStore;
import org.apache.qpid.server.store.MessageStore;
@@ -78,7 +79,6 @@ public class AbstractVirtualHostTest ext
Broker<?> broker = mock(Broker.class);
when(broker.getParent(SystemConfig.class)).thenReturn(systemConfig);
when(broker.getModel()).thenReturn(BrokerModel.getInstance());
- when(broker.getSecurityManager()).thenReturn(new SecurityManager(broker, false));
_taskExecutor = new TaskExecutorImpl();
_taskExecutor.start();
Modified: qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/virtualhost/VirtualHostQueueCreationTest.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/virtualhost/VirtualHostQueueCreationTest.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/virtualhost/VirtualHostQueueCreationTest.java (original)
+++ qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/virtualhost/VirtualHostQueueCreationTest.java Fri Jul 8 13:23:25 2016
@@ -63,7 +63,6 @@ public class VirtualHostQueueCreationTes
super.setUp();
EventLogger eventLogger = mock(EventLogger.class);
- SecurityManager securityManager = mock(SecurityManager.class);
ConfiguredObjectFactory objectFactory = new ConfiguredObjectFactoryImpl(BrokerModel.getInstance());
_taskExecutor = new CurrentThreadTaskExecutor();
@@ -77,7 +76,6 @@ public class VirtualHostQueueCreationTes
when(broker.getObjectFactory()).thenReturn(objectFactory);
when(broker.getCategoryClass()).thenReturn(Broker.class);
when(broker.getParent(SystemConfig.class)).thenReturn(context);
- when(broker.getSecurityManager()).thenReturn(securityManager);
when(broker.getModel()).thenReturn(objectFactory.getModel());
when(broker.getTaskExecutor()).thenReturn(_taskExecutor);
when(broker.getChildExecutor()).thenReturn(_taskExecutor);
Modified: qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/virtualhostnode/AbstractStandardVirtualHostNodeTest.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/virtualhostnode/AbstractStandardVirtualHostNodeTest.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/virtualhostnode/AbstractStandardVirtualHostNodeTest.java (original)
+++ qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/virtualhostnode/AbstractStandardVirtualHostNodeTest.java Fri Jul 8 13:23:25 2016
@@ -52,7 +52,10 @@ import org.apache.qpid.server.model.Stat
import org.apache.qpid.server.model.SystemConfig;
import org.apache.qpid.server.model.VirtualHost;
import org.apache.qpid.server.model.VirtualHostNode;
+import org.apache.qpid.server.security.AccessControl;
+import org.apache.qpid.server.security.Result;
import org.apache.qpid.server.security.SecurityManager;
+import org.apache.qpid.server.security.access.Operation;
import org.apache.qpid.server.store.ConfiguredObjectRecord;
import org.apache.qpid.server.store.DurableConfigurationStore;
import org.apache.qpid.server.store.NullMessageStore;
@@ -68,7 +71,6 @@ public class AbstractStandardVirtualHost
private static final String TEST_VIRTUAL_HOST_NAME = "testVirtualHost";
private final UUID _nodeId = UUID.randomUUID();
- private final SecurityManager _mockSecurityManager = mock(SecurityManager.class);
private Broker<?> _broker;
private TaskExecutor _taskExecutor;
@@ -274,19 +276,19 @@ public class AbstractStandardVirtualHost
public void testUpdateVHNDeniedByACL() throws Exception
{
- when(_broker.getSecurityManager()).thenReturn(_mockSecurityManager);
-
+ AccessControl mockAccessControl = mock(AccessControl.class);
DurableConfigurationStore configStore = configStoreThatProducesNoRecords();
Map<String, Object> nodeAttributes = new HashMap<>();
nodeAttributes.put(VirtualHostNode.NAME, TEST_VIRTUAL_HOST_NODE_NAME);
nodeAttributes.put(VirtualHostNode.ID, _nodeId);
- VirtualHostNode<?> node = new TestVirtualHostNode(_broker, nodeAttributes, configStore);
+ TestVirtualHostNode node = new TestVirtualHostNode(_broker, nodeAttributes, configStore);
+ node.setAccessControl(mockAccessControl);
node.open();
node.start();
- doThrow(new AccessControlException("mocked ACL exception")).when(_mockSecurityManager).authoriseUpdate(node);
+ when(mockAccessControl.authorise(null, Operation.UPDATE, node, Collections.<String,Object>emptyMap())).thenReturn(Result.DENIED);
assertNull(node.getDescription());
try
@@ -304,8 +306,7 @@ public class AbstractStandardVirtualHost
public void testDeleteVHNDeniedByACL() throws Exception
{
- SecurityManager mockSecurityManager = mock(SecurityManager.class);
- when(_broker.getSecurityManager()).thenReturn(mockSecurityManager);
+ AccessControl mockAccessControl = mock(AccessControl.class);
DurableConfigurationStore configStore = configStoreThatProducesNoRecords();
@@ -313,11 +314,12 @@ public class AbstractStandardVirtualHost
nodeAttributes.put(VirtualHostNode.NAME, TEST_VIRTUAL_HOST_NODE_NAME);
nodeAttributes.put(VirtualHostNode.ID, _nodeId);
- VirtualHostNode<?> node = new TestVirtualHostNode(_broker, nodeAttributes, configStore);
+ TestVirtualHostNode node = new TestVirtualHostNode(_broker, nodeAttributes, configStore);
+ node.setAccessControl(mockAccessControl);
+
node.open();
node.start();
-
- doThrow(new AccessControlException("mocked ACL exception")).when(mockSecurityManager).authoriseDelete(node);
+ when(mockAccessControl.authorise(null, Operation.DELETE, node, Collections.<String,Object>emptyMap())).thenReturn(Result.DENIED);
try
{
@@ -335,8 +337,7 @@ public class AbstractStandardVirtualHost
public void testStopVHNDeniedByACL() throws Exception
{
- SecurityManager mockSecurityManager = mock(SecurityManager.class);
- when(_broker.getSecurityManager()).thenReturn(mockSecurityManager);
+ AccessControl mockAccessControl = mock(AccessControl.class);
DurableConfigurationStore configStore = configStoreThatProducesNoRecords();
@@ -344,11 +345,13 @@ public class AbstractStandardVirtualHost
nodeAttributes.put(VirtualHostNode.NAME, TEST_VIRTUAL_HOST_NODE_NAME);
nodeAttributes.put(VirtualHostNode.ID, _nodeId);
- VirtualHostNode<?> node = new TestVirtualHostNode(_broker, nodeAttributes, configStore);
+ TestVirtualHostNode node = new TestVirtualHostNode(_broker, nodeAttributes, configStore);
+ node.setAccessControl(mockAccessControl);
+
node.open();
node.start();
- doThrow(new AccessControlException("mocked ACL exception")).when(mockSecurityManager).authoriseUpdate(node);
+ when(mockAccessControl.authorise(null, Operation.UPDATE, node, Collections.<String,Object>emptyMap())).thenReturn(Result.DENIED);
try
{
Modified: qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/virtualhostnode/TestVirtualHostNode.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/virtualhostnode/TestVirtualHostNode.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/virtualhostnode/TestVirtualHostNode.java (original)
+++ qpid/java/trunk/broker-core/src/test/java/org/apache/qpid/server/virtualhostnode/TestVirtualHostNode.java Fri Jul 8 13:23:25 2016
@@ -24,6 +24,7 @@ import java.util.Map;
import org.apache.qpid.server.model.Broker;
import org.apache.qpid.server.model.ManagedObject;
+import org.apache.qpid.server.security.AccessControl;
import org.apache.qpid.server.store.DurableConfigurationStore;
@ManagedObject(type=TestVirtualHostNode.VIRTUAL_HOST_NODE_TYPE, category=false)
@@ -32,6 +33,7 @@ public class TestVirtualHostNode extends
public static final String VIRTUAL_HOST_NODE_TYPE = "TestMemory";
private final DurableConfigurationStore _store;
+ private volatile AccessControl _accessControl;
public TestVirtualHostNode(Broker<?> parent, Map<String, Object> attributes)
{
@@ -62,4 +64,16 @@ public class TestVirtualHostNode extends
protected void writeLocationEventLog()
{
}
+
+ public void setAccessControl(final AccessControl accessControl)
+ {
+ _accessControl = accessControl;
+ }
+
+ @Override
+ protected AccessControl getAccessControl()
+ {
+
+ return _accessControl == null ? super.getAccessControl() : _accessControl;
+ }
}
Modified: qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/AclAction.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/AclAction.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/AclAction.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/AclAction.java Fri Jul 8 13:23:25 2016
@@ -18,7 +18,6 @@
*/
package org.apache.qpid.server.security.access.config;
-import org.apache.qpid.server.security.access.Operation;
import org.apache.qpid.server.security.access.firewall.FirewallRule;
public class AclAction
@@ -26,18 +25,18 @@ public class AclAction
private Action _action;
private FirewallRule _firewallRule;
- public AclAction(Operation operation, ObjectType object, AclRulePredicates predicates)
+ public AclAction(LegacyOperation operation, ObjectType object, AclRulePredicates predicates)
{
_action = new Action(operation, object, predicates.getObjectProperties());
_firewallRule = predicates.getFirewallRule();
}
- public AclAction(Operation operation)
+ public AclAction(LegacyOperation operation)
{
_action = new Action(operation);
}
- public AclAction(Operation operation, ObjectType object, ObjectProperties properties)
+ public AclAction(LegacyOperation operation, ObjectType object, ObjectProperties properties)
{
_action = new Action(operation, object, properties);
}
Modified: qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/AclFileParser.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/AclFileParser.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/AclFileParser.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/AclFileParser.java Fri Jul 8 13:23:25 2016
@@ -40,7 +40,6 @@ import org.slf4j.LoggerFactory;
import org.apache.qpid.server.configuration.IllegalConfigurationException;
import org.apache.qpid.server.logging.EventLoggerProvider;
import org.apache.qpid.server.security.Result;
-import org.apache.qpid.server.security.access.Operation;
import org.apache.qpid.server.security.access.RuleOutcome;
public final class AclFileParser
@@ -267,7 +266,7 @@ public final class AclFileParser
throw new IllegalArgumentException("Not a valid permission: " + text, e);
}
String identity = args.get(1);
- Operation operation = Operation.valueOf(args.get(2).toUpperCase());
+ LegacyOperation operation = LegacyOperation.valueOf(args.get(2).toUpperCase());
if (number != null && !ruleSetCreator.isValidNumber(number))
{
Modified: qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/Action.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/Action.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/Action.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/Action.java Fri Jul 8 13:23:25 2016
@@ -20,13 +20,11 @@
*/
package org.apache.qpid.server.security.access.config;
-import org.apache.qpid.server.security.access.Operation;
-
/**
* An access control v2 rule action.
*
- * An action consists of an {@link Operation} on an {@link ObjectType} with certain properties, stored in a {@link java.util.Map}.
- * The operation and object should be an allowable combination, based on the {@link ObjectType#isSupported(Operation)}
+ * An action consists of an {@link LegacyOperation} on an {@link ObjectType} with certain properties, stored in a {@link java.util.Map}.
+ * The operation and object should be an allowable combination, based on the {@link ObjectType#isSupported(LegacyOperation)}
* method of the object, which is exposed as the {@link #isSupported()} method here. The internal #propertiesMatch(Map)
* and #valueMatches(String, String) methods are used to determine wildcarded matching of properties, with
* the empty string or "*" matching all values, and "*" at the end of a rule value indicating prefix matching.
@@ -37,33 +35,33 @@ import org.apache.qpid.server.security.a
*/
public class Action
{
- private final Operation _operation;
+ private final LegacyOperation _operation;
private final ObjectType _object;
private final ObjectProperties _properties;
- public Action(Operation operation)
+ public Action(LegacyOperation operation)
{
this(operation, ObjectType.ALL);
}
- public Action(Operation operation, ObjectType object, String name)
+ public Action(LegacyOperation operation, ObjectType object, String name)
{
this(operation, object, new ObjectProperties(name));
}
- public Action(Operation operation, ObjectType object)
+ public Action(LegacyOperation operation, ObjectType object)
{
this(operation, object, ObjectProperties.EMPTY);
}
- public Action(Operation operation, ObjectType object, ObjectProperties properties)
+ public Action(LegacyOperation operation, ObjectType object, ObjectProperties properties)
{
_operation = operation;
_object = object;
_properties = properties;
}
- public Operation getOperation()
+ public LegacyOperation getOperation()
{
return _operation;
}
@@ -90,7 +88,7 @@ public class Action
private boolean operationsMatch(Action a)
{
- return Operation.ALL == a.getOperation() || getOperation() == a.getOperation();
+ return LegacyOperation.ALL == a.getOperation() || getOperation() == a.getOperation();
}
private boolean objectTypesMatch(Action a)
Modified: qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/CachingSecurityToken.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/CachingSecurityToken.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/CachingSecurityToken.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/CachingSecurityToken.java Fri Jul 8 13:23:25 2016
@@ -21,6 +21,7 @@
package org.apache.qpid.server.security.access.config;
import java.util.Map;
+import java.util.Objects;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.ConcurrentMap;
import java.util.concurrent.atomic.AtomicReferenceFieldUpdater;
@@ -30,6 +31,7 @@ import javax.security.auth.Subject;
import org.apache.qpid.server.model.ConfiguredObject;
import org.apache.qpid.server.security.Result;
import org.apache.qpid.server.security.SecurityToken;
+import org.apache.qpid.server.security.access.Operation;
class CachingSecurityToken implements SecurityToken
{
@@ -60,7 +62,7 @@ class CachingSecurityToken implements Se
{
CACHE_UPDATE.compareAndSet(this, cache, new AccessControlCache(ruleBasedAccessControl));
}
- final CachedMethodAuthKey key = new CachedMethodAuthKey(configuredObject, methodName, arguments);
+ final CachedMethodAuthKey key = new CachedMethodAuthKey(configuredObject, Operation.METHOD(methodName), arguments);
Result result = cache.getCache().get(key);
if(result == null)
{
@@ -70,22 +72,40 @@ class CachingSecurityToken implements Se
return result;
}
+ Result authorise(final RuleBasedAccessControl ruleBasedAccessControl, final Operation operation,
+ final ConfiguredObject<?> configuredObject,
+ final Map<String, Object> arguments)
+ {
+ AccessControlCache cache = CACHE_UPDATE.get(this);
+ while(cache.getAccessControl() != ruleBasedAccessControl)
+ {
+ CACHE_UPDATE.compareAndSet(this, cache, new AccessControlCache(ruleBasedAccessControl));
+ }
+ final CachedMethodAuthKey key = new CachedMethodAuthKey(configuredObject, operation, arguments);
+ Result result = cache.getCache().get(key);
+ if(result == null)
+ {
+ result = ruleBasedAccessControl.authorise(operation, configuredObject, arguments);
+ cache.getCache().putIfAbsent(key, result);
+ }
+ return result; }
+
private static final class CachedMethodAuthKey
{
private final ConfiguredObject<?> _configuredObject;
- private final String _methodName;
+ private final Operation _operation;
private final Map<String, Object> _arguments;
private final int _hashCode;
public CachedMethodAuthKey(final ConfiguredObject<?> configuredObject,
- final String methodName,
+ final Operation operation,
final Map<String, Object> arguments)
{
_configuredObject = configuredObject;
- _methodName = methodName;
+ _operation = operation;
_arguments = arguments;
int result = _configuredObject != null ? _configuredObject.hashCode() : 0;
- result = 31 * result + (_methodName != null ? _methodName.hashCode() : 0);
+ result = 31 * result + (operation != null ? operation.hashCode() : 0);
result = 31 * result + (_arguments != null ? _arguments.hashCode() : 0);
_hashCode = result;
}
@@ -104,13 +124,9 @@ class CachingSecurityToken implements Se
final CachedMethodAuthKey that = (CachedMethodAuthKey) o;
- return _configuredObject != null
- ? _configuredObject.equals(that._configuredObject)
- : that._configuredObject == null && (_methodName != null
- ? _methodName.equals(that._methodName)
- : that._methodName == null && (_arguments != null
- ? _arguments.equals(that._arguments)
- : that._arguments == null));
+ return Objects.equals(_configuredObject, that._configuredObject)
+ && Objects.equals(_operation, that._operation)
+ && Objects.equals(_arguments, that._arguments);
}
Modified: qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/ClientAction.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/ClientAction.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/ClientAction.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/ClientAction.java Fri Jul 8 13:23:25 2016
@@ -20,7 +20,6 @@ package org.apache.qpid.server.security.
import java.net.InetAddress;
-import org.apache.qpid.server.security.access.Operation;
import org.apache.qpid.server.security.access.firewall.FirewallRule;
/**
@@ -36,7 +35,7 @@ public class ClientAction
_clientAction = clientAction;
}
- public ClientAction(Operation operation, ObjectType objectType, ObjectProperties properties)
+ public ClientAction(LegacyOperation operation, ObjectType objectType, ObjectProperties properties)
{
_clientAction = new Action(operation, objectType, properties);
}
@@ -60,7 +59,7 @@ public class ClientAction
}
}
- public Operation getOperation()
+ public LegacyOperation getOperation()
{
return _clientAction.getOperation();
}
Modified: qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/LegacyAccessControl.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/LegacyAccessControl.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/LegacyAccessControl.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/LegacyAccessControl.java Fri Jul 8 13:23:25 2016
@@ -21,9 +21,8 @@
package org.apache.qpid.server.security.access.config;
import org.apache.qpid.server.security.Result;
-import org.apache.qpid.server.security.access.Operation;
interface LegacyAccessControl
{
- Result authorise(Operation authoriseOperation, ObjectType objectType, ObjectProperties properties);
+ Result authorise(LegacyOperation authoriseOperation, ObjectType objectType, ObjectProperties properties);
}
Modified: qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/LegacyAccessControlAdapter.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/LegacyAccessControlAdapter.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/LegacyAccessControlAdapter.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/LegacyAccessControlAdapter.java Fri Jul 8 13:23:25 2016
@@ -25,10 +25,10 @@ import static org.apache.qpid.server.sec
import static org.apache.qpid.server.security.access.config.ObjectType.METHOD;
import static org.apache.qpid.server.security.access.config.ObjectType.QUEUE;
import static org.apache.qpid.server.security.access.config.ObjectType.USER;
-import static org.apache.qpid.server.security.access.Operation.ACCESS_LOGS;
-import static org.apache.qpid.server.security.access.Operation.PUBLISH;
-import static org.apache.qpid.server.security.access.Operation.PURGE;
-import static org.apache.qpid.server.security.access.Operation.UPDATE;
+import static org.apache.qpid.server.security.access.config.LegacyOperation.ACCESS_LOGS;
+import static org.apache.qpid.server.security.access.config.LegacyOperation.PUBLISH;
+import static org.apache.qpid.server.security.access.config.LegacyOperation.PURGE;
+import static org.apache.qpid.server.security.access.config.LegacyOperation.UPDATE;
import java.util.Arrays;
import java.util.Collections;
@@ -59,6 +59,10 @@ class LegacyAccessControlAdapter
"setPreferences",
"deletePreferences")));
+ private static final Set<String> BDB_VIRTUAL_HOST_NODE_OPERATIONS =
+ Collections.unmodifiableSet(new HashSet<>(Arrays.asList("updateMutableConfig",
+ "cleanLog",
+ "checkpoint")));
private final LegacyAccessControl _accessControl;
private final Model _model;
@@ -74,7 +78,7 @@ class LegacyAccessControlAdapter
return _model;
}
- Result authorise(final Operation operation, final ConfiguredObject<?> configuredObject)
+ Result authorise(final LegacyOperation operation, final ConfiguredObject<?> configuredObject)
{
if (isAllowedOperation(operation, configuredObject))
{
@@ -90,26 +94,26 @@ class LegacyAccessControlAdapter
}
ObjectProperties properties = getACLObjectProperties(configuredObject, operation);
- Operation authoriseOperation = validateAuthoriseOperation(operation, categoryClass);
+ LegacyOperation authoriseOperation = validateAuthoriseOperation(operation, categoryClass);
return _accessControl.authorise(authoriseOperation, objectType, properties);
}
- private boolean isAllowedOperation(Operation operation, ConfiguredObject<?> configuredObject)
+ private boolean isAllowedOperation(LegacyOperation operation, ConfiguredObject<?> configuredObject)
{
- if (configuredObject instanceof Session && (operation == Operation.CREATE || operation == Operation.UPDATE
- || operation == Operation.DELETE))
+ if (configuredObject instanceof Session && (operation == LegacyOperation.CREATE || operation == LegacyOperation.UPDATE
+ || operation == LegacyOperation.DELETE))
{
return true;
}
- if (configuredObject instanceof Consumer && (operation == Operation.UPDATE || operation == Operation.DELETE))
+ if (configuredObject instanceof Consumer && (operation == LegacyOperation.UPDATE || operation == LegacyOperation.DELETE))
{
return true;
}
- if (configuredObject instanceof Connection && (operation == Operation.UPDATE || operation == Operation.DELETE))
+ if (configuredObject instanceof Connection && (operation == LegacyOperation.UPDATE || operation == LegacyOperation.DELETE))
{
return true;
}
@@ -192,7 +196,7 @@ class LegacyAccessControlAdapter
}
- private ObjectProperties getACLObjectProperties(ConfiguredObject<?> configuredObject, Operation configuredObjectOperation)
+ private ObjectProperties getACLObjectProperties(ConfiguredObject<?> configuredObject, LegacyOperation configuredObjectOperation)
{
String objectName = (String)configuredObject.getAttribute(ConfiguredObject.NAME);
Class<? extends ConfiguredObject> configuredObjectType = configuredObject.getCategoryClass();
@@ -272,53 +276,113 @@ class LegacyAccessControlAdapter
}
- private Operation validateAuthoriseOperation(Operation operation, Class<? extends ConfiguredObject> category)
+ private LegacyOperation validateAuthoriseOperation(LegacyOperation operation, Class<? extends ConfiguredObject> category)
{
- if (operation == Operation.CREATE || operation == Operation.UPDATE)
+ if (operation == LegacyOperation.CREATE || operation == LegacyOperation.UPDATE)
{
if (Binding.class.isAssignableFrom(category))
{
// CREATE BINDING is transformed into BIND EXCHANGE rule
- return Operation.BIND;
+ return LegacyOperation.BIND;
}
else if (Consumer.class.isAssignableFrom(category))
{
// CREATE CONSUMER is transformed into CONSUME QUEUE rule
- return Operation.CONSUME;
+ return LegacyOperation.CONSUME;
}
else if (GroupMember.class.isAssignableFrom(category))
{
// CREATE GROUP MEMBER is transformed into UPDATE GROUP rule
- return Operation.UPDATE;
+ return LegacyOperation.UPDATE;
}
else if (isBrokerType(category))
{
// CREATE/UPDATE broker child is transformed into CONFIGURE BROKER rule
- return Operation.CONFIGURE;
+ return LegacyOperation.CONFIGURE;
}
}
- else if (operation == Operation.DELETE)
+ else if (operation == LegacyOperation.DELETE)
{
if (Binding.class.isAssignableFrom(category))
{
// DELETE BINDING is transformed into UNBIND EXCHANGE rule
- return Operation.UNBIND;
+ return LegacyOperation.UNBIND;
}
else if (isBrokerType(category))
{
// DELETE broker child is transformed into CONFIGURE BROKER rule
- return Operation.CONFIGURE;
+ return LegacyOperation.CONFIGURE;
}
else if (GroupMember.class.isAssignableFrom(category))
{
// DELETE GROUP MEMBER is transformed into UPDATE GROUP rule
- return Operation.UPDATE;
+ return LegacyOperation.UPDATE;
}
}
return operation;
}
+ Result authoriseAction(final ConfiguredObject<?> configuredObject,
+ String methodName,
+ final Map<String, Object> arguments)
+ {
+ Class<? extends ConfiguredObject> categoryClass = configuredObject.getCategoryClass();
+ if(categoryClass == Exchange.class)
+ {
+ Exchange exchange = (Exchange) configuredObject;
+ if("publish".equals(methodName))
+ {
+
+ final ObjectProperties _props =
+ new ObjectProperties(exchange.getParent(VirtualHost.class).getName(), exchange.getName(), (String)arguments.get("routingKey"), (Boolean)arguments.get("immediate"));
+ return _accessControl.authorise(PUBLISH, EXCHANGE, _props);
+ }
+ }
+ else if(categoryClass == VirtualHost.class)
+ {
+ if("connect".equals(methodName))
+ {
+ String virtualHostName = configuredObject.getName();
+ ObjectProperties properties = new ObjectProperties(virtualHostName);
+ properties.put(ObjectProperties.Property.VIRTUALHOST_NAME, virtualHostName);
+ return _accessControl.authorise(LegacyOperation.ACCESS, ObjectType.VIRTUALHOST, properties);
+ }
+ }
+ else if(categoryClass == Broker.class)
+ {
+ if("manage".equals(methodName))
+ {
+ return _accessControl.authorise(LegacyOperation.ACCESS, ObjectType.MANAGEMENT, ObjectProperties.EMPTY);
+ }
+ }
+ else if(categoryClass == Queue.class)
+ {
+ Queue queue = (Queue) configuredObject;
+ final ObjectProperties properties = new ObjectProperties();
+ if("publish".equals(methodName))
+ {
+
+ final ObjectProperties _props =
+ new ObjectProperties(queue.getParent(VirtualHost.class).getName(), "", queue.getName(), (Boolean)arguments.get("immediate"));
+ return _accessControl.authorise(PUBLISH, EXCHANGE, _props);
+ }
+ }
+ else if(categoryClass == VirtualHostLogger.class)
+ {
+ VirtualHostLogger logger = (VirtualHostLogger)configuredObject;
+ if(LOG_ACCESS_METHOD_NAMES.contains(methodName))
+ {
+ return _accessControl.authorise(ACCESS_LOGS,
+ ObjectType.VIRTUALHOST,
+ new ObjectProperties(logger.getParent(VirtualHost.class).getName()));
+ }
+ }
+
+ return Result.DEFER;
+
+ }
+
Result authoriseExecute(final ConfiguredObject<?> configuredObject,
final String methodName,
final Map<String, Object> arguments)
@@ -342,14 +406,14 @@ class LegacyAccessControlAdapter
String virtualHostName = configuredObject.getName();
ObjectProperties properties = new ObjectProperties(virtualHostName);
properties.put(ObjectProperties.Property.VIRTUALHOST_NAME, virtualHostName);
- return _accessControl.authorise(Operation.ACCESS, ObjectType.VIRTUALHOST, properties);
+ return _accessControl.authorise(LegacyOperation.ACCESS, ObjectType.VIRTUALHOST, properties);
}
}
else if(categoryClass == Broker.class)
{
if("manage".equals(methodName))
{
- return _accessControl.authorise(Operation.ACCESS, ObjectType.MANAGEMENT, ObjectProperties.EMPTY);
+ return _accessControl.authorise(LegacyOperation.ACCESS, ObjectType.MANAGEMENT, ObjectProperties.EMPTY);
}
}
else if(categoryClass == Queue.class)
@@ -368,10 +432,10 @@ class LegacyAccessControlAdapter
properties.setName(methodName);
properties.put(ObjectProperties.Property.COMPONENT, "VirtualHost.Queue");
properties.put(ObjectProperties.Property.VIRTUALHOST_NAME, virtualHostName);
- return _accessControl.authorise(Operation.UPDATE, METHOD, properties);
+ return _accessControl.authorise(LegacyOperation.UPDATE, METHOD, properties);
}
- else if("queue".equals(methodName))
+ else if("publish".equals(methodName))
{
final ObjectProperties _props =
@@ -418,10 +482,42 @@ class LegacyAccessControlAdapter
}
}
}
+ else if(categoryClass == VirtualHostNode.class)
+ {
+ if(BDB_VIRTUAL_HOST_NODE_OPERATIONS.contains(methodName))
+ {
+ ObjectProperties properties = getACLObjectProperties(configuredObject.getParent(Broker.class), LegacyOperation.UPDATE);
+ return _accessControl.authorise(LegacyOperation.UPDATE, ObjectType.BROKER, properties);
+ }
+ }
return Result.ALLOWED;
}
+ Result authorise(final Operation operation,
+ final ConfiguredObject<?> configuredObject,
+ final Map<String, Object> arguments)
+ {
+ switch(operation.getType())
+ {
+ case CREATE:
+ return authorise(LegacyOperation.CREATE, configuredObject);
+ case UPDATE:
+ return authorise(LegacyOperation.UPDATE, configuredObject);
+ case DELETE:
+ return authorise(LegacyOperation.DELETE, configuredObject);
+ case METHOD:
+ return authoriseExecute(configuredObject, operation.getName(), arguments);
+ case ACTION:
+ return authoriseAction(configuredObject, operation.getName(), arguments);
+ case DISCOVER:
+ case READ:
+ return Result.DEFER;
+
+ default:
+ }
+ return null;
+ }
}
Copied: qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/LegacyOperation.java (from r1751899, qpid/java/trunk/broker-core/src/main/java/org/apache/qpid/server/security/access/Operation.java)
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/LegacyOperation.java?p2=qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/LegacyOperation.java&p1=qpid/java/trunk/broker-core/src/main/java/org/apache/qpid/server/security/access/Operation.java&r1=1751899&r2=1751900&rev=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-core/src/main/java/org/apache/qpid/server/security/access/Operation.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/LegacyOperation.java Fri Jul 8 13:23:25 2016
@@ -16,12 +16,12 @@
* specific language governing permissions and limitations
* under the License.
*/
-package org.apache.qpid.server.security.access;
+package org.apache.qpid.server.security.access.config;
/**
* An enumeration of all possible actions that can form part of an access control v2 rule.
*/
-public enum Operation
+public enum LegacyOperation
{
ALL,
CONSUME,
Modified: qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/ObjectType.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/ObjectType.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/ObjectType.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/ObjectType.java Fri Jul 8 13:23:25 2016
@@ -18,62 +18,60 @@
*/
package org.apache.qpid.server.security.access.config;
-import static org.apache.qpid.server.security.access.Operation.ACCESS;
-import static org.apache.qpid.server.security.access.Operation.ACCESS_LOGS;
-import static org.apache.qpid.server.security.access.Operation.BIND;
-import static org.apache.qpid.server.security.access.Operation.CONFIGURE;
-import static org.apache.qpid.server.security.access.Operation.CONSUME;
-import static org.apache.qpid.server.security.access.Operation.CREATE;
-import static org.apache.qpid.server.security.access.Operation.DELETE;
-import static org.apache.qpid.server.security.access.Operation.PUBLISH;
-import static org.apache.qpid.server.security.access.Operation.PURGE;
-import static org.apache.qpid.server.security.access.Operation.SHUTDOWN;
-import static org.apache.qpid.server.security.access.Operation.UNBIND;
-import static org.apache.qpid.server.security.access.Operation.UPDATE;
+import static org.apache.qpid.server.security.access.config.LegacyOperation.ACCESS;
+import static org.apache.qpid.server.security.access.config.LegacyOperation.ACCESS_LOGS;
+import static org.apache.qpid.server.security.access.config.LegacyOperation.BIND;
+import static org.apache.qpid.server.security.access.config.LegacyOperation.CONFIGURE;
+import static org.apache.qpid.server.security.access.config.LegacyOperation.CONSUME;
+import static org.apache.qpid.server.security.access.config.LegacyOperation.CREATE;
+import static org.apache.qpid.server.security.access.config.LegacyOperation.DELETE;
+import static org.apache.qpid.server.security.access.config.LegacyOperation.PUBLISH;
+import static org.apache.qpid.server.security.access.config.LegacyOperation.PURGE;
+import static org.apache.qpid.server.security.access.config.LegacyOperation.SHUTDOWN;
+import static org.apache.qpid.server.security.access.config.LegacyOperation.UNBIND;
+import static org.apache.qpid.server.security.access.config.LegacyOperation.UPDATE;
import java.util.EnumSet;
import java.util.Set;
-import org.apache.qpid.server.security.access.Operation;
-
/**
* An enumeration of all possible object types that can form part of an access control v2 rule.
*
- * Each object type is valid only for a certain set of {@link Operation}s, which are passed as a list to
- * the constructor, and can be checked using the {@link #isSupported(Operation)} method.
+ * Each object type is valid only for a certain set of {@link LegacyOperation}s, which are passed as a list to
+ * the constructor, and can be checked using the {@link #isSupported(LegacyOperation)} method.
*/
public enum ObjectType
{
- ALL(EnumSet.allOf(Operation.class)),
- VIRTUALHOSTNODE(Operation.ALL, CREATE, DELETE, UPDATE),
- VIRTUALHOST(Operation.ALL, ACCESS, CREATE, DELETE, UPDATE, ACCESS_LOGS),
- MANAGEMENT(Operation.ALL, ACCESS),
- QUEUE(Operation.ALL, CREATE, DELETE, PURGE, CONSUME, UPDATE),
- EXCHANGE(Operation.ALL, ACCESS, CREATE, DELETE, BIND, UNBIND, PUBLISH, UPDATE),
- METHOD(Operation.ALL, ACCESS, UPDATE),
- USER(Operation.ALL, CREATE, DELETE, UPDATE),
- GROUP(Operation.ALL, CREATE, DELETE, UPDATE),
- BROKER(Operation.ALL, CONFIGURE, ACCESS_LOGS, SHUTDOWN);
+ ALL(EnumSet.allOf(LegacyOperation.class)),
+ VIRTUALHOSTNODE(LegacyOperation.ALL, CREATE, DELETE, UPDATE),
+ VIRTUALHOST(LegacyOperation.ALL, ACCESS, CREATE, DELETE, UPDATE, ACCESS_LOGS),
+ MANAGEMENT(LegacyOperation.ALL, ACCESS),
+ QUEUE(LegacyOperation.ALL, CREATE, DELETE, PURGE, CONSUME, UPDATE),
+ EXCHANGE(LegacyOperation.ALL, ACCESS, CREATE, DELETE, BIND, UNBIND, PUBLISH, UPDATE),
+ METHOD(LegacyOperation.ALL, ACCESS, UPDATE),
+ USER(LegacyOperation.ALL, CREATE, DELETE, UPDATE),
+ GROUP(LegacyOperation.ALL, CREATE, DELETE, UPDATE),
+ BROKER(LegacyOperation.ALL, CONFIGURE, ACCESS_LOGS, SHUTDOWN);
- private EnumSet<Operation> _operations;
+ private EnumSet<LegacyOperation> _operations;
- ObjectType(Operation first, Operation... rest)
+ ObjectType(LegacyOperation first, LegacyOperation... rest)
{
this(EnumSet.of(first, rest));
}
- ObjectType(EnumSet<Operation> operations)
+ ObjectType(EnumSet<LegacyOperation> operations)
{
_operations = operations;
}
- public Set<Operation> getOperations()
+ public Set<LegacyOperation> getOperations()
{
return _operations;
}
- public boolean isSupported(Operation operation)
+ public boolean isSupported(LegacyOperation operation)
{
return _operations.contains(operation);
}
Modified: qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/RuleBasedAccessControl.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/RuleBasedAccessControl.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/RuleBasedAccessControl.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/RuleBasedAccessControl.java Fri Jul 8 13:23:25 2016
@@ -24,6 +24,7 @@ import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.SocketAddress;
import java.security.AccessController;
+import java.util.Collections;
import java.util.Map;
import java.util.Set;
@@ -73,7 +74,7 @@ public class RuleBasedAccessControl impl
* control rules granted to the current thread's {@link Subject}. If there is no current
* user the plugin will abstain.
*/
- public Result authorise(Operation operation, ObjectType objectType, ObjectProperties properties)
+ public Result authorise(LegacyOperation operation, ObjectType objectType, ObjectProperties properties)
{
InetAddress addressOfClient = null;
final Subject subject = Subject.getSubject(AccessController.getContext());
@@ -81,7 +82,7 @@ public class RuleBasedAccessControl impl
// Abstain if there is no subject/principal associated with this thread
if (subject == null || subject.getPrincipals().size() == 0)
{
- return Result.ABSTAIN;
+ return Result.DEFER;
}
Set<ConnectionPrincipal> principals = subject.getPrincipals(ConnectionPrincipal.class);
@@ -112,13 +113,6 @@ public class RuleBasedAccessControl impl
}
}
- @Override
- public Result authorise(final Operation operation, final ConfiguredObject<?> configuredObject)
- {
- return _adapter.authorise(operation, configuredObject);
- }
-
- @Override
public Result authoriseMethod(final ConfiguredObject<?> configuredObject,
final String methodName,
final Map<String, Object> arguments)
@@ -127,17 +121,34 @@ public class RuleBasedAccessControl impl
}
@Override
- public Result authoriseMethod(final CachingSecurityToken token,
- final ConfiguredObject<?> configuredObject,
- final String methodName,
- final Map<String,Object> arguments)
+ public Result authorise(final CachingSecurityToken token,
+ final Operation operation,
+ final ConfiguredObject<?> configuredObject)
+ {
+ return authorise(token, operation, configuredObject, Collections.<String,Object>emptyMap());
+ }
+
+ @Override
+ public Result authorise(final CachingSecurityToken token,
+ final Operation operation,
+ final ConfiguredObject<?> configuredObject,
+ final Map<String, Object> arguments)
{
if(token != null)
{
- return token.authoriseMethod(this, configuredObject, methodName, arguments);
-
+ return token.authorise(this, operation, configuredObject, arguments);
+ }
+ else
+ {
+ return authorise(operation, configuredObject, arguments);
}
- return authoriseMethod(configuredObject, methodName, arguments);
+ }
+
+ Result authorise(final Operation operation,
+ final ConfiguredObject<?> configuredObject,
+ final Map<String, Object> arguments)
+ {
+ return _adapter.authorise(operation, configuredObject, arguments);
}
Modified: qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/RuleSet.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/RuleSet.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/RuleSet.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/RuleSet.java Fri Jul 8 13:23:25 2016
@@ -41,7 +41,6 @@ import org.apache.qpid.server.logging.Ev
import org.apache.qpid.server.logging.EventLoggerProvider;
import org.apache.qpid.server.logging.messages.AccessControlMessages;
import org.apache.qpid.server.security.Result;
-import org.apache.qpid.server.security.access.Operation;
import org.apache.qpid.server.security.access.RuleOutcome;
/**
@@ -57,8 +56,8 @@ public class RuleSet implements EventLog
private static final Integer _increment = 10;
private final List<Rule> _rules;
- private final Map<Subject, Map<Operation, Map<ObjectType, List<Rule>>>> _cache =
- Collections.synchronizedMap(new WeakHashMap<Subject, Map<Operation, Map<ObjectType, List<Rule>>>>());
+ private final Map<Subject, Map<LegacyOperation, Map<ObjectType, List<Rule>>>> _cache =
+ Collections.synchronizedMap(new WeakHashMap<Subject, Map<LegacyOperation, Map<ObjectType, List<Rule>>>>());
private final Map<String, Boolean> _config = new HashMap<String, Boolean>();
private final EventLoggerProvider _eventLogger;
private Result _defaultResult = Result.DENIED;
@@ -83,7 +82,7 @@ public class RuleSet implements EventLog
* Allows only enabled rules with identity equal to all, the same, or a group with identity as a member,
* and operation is either all or the same operation.
*/
- private List<Rule> getRules(final Subject subject, final Operation operation, final ObjectType objectType)
+ private List<Rule> getRules(final Subject subject, final LegacyOperation operation, final ObjectType objectType)
{
final Map<ObjectType, List<Rule>> objects = getObjectToRuleCache(subject, operation);
@@ -96,7 +95,7 @@ public class RuleSet implements EventLog
for (Rule rule : _rules)
{
final Action ruleAction = rule.getAction();
- if ((ruleAction.getOperation() == Operation.ALL || ruleAction.getOperation() == operation)
+ if ((ruleAction.getOperation() == LegacyOperation.ALL || ruleAction.getOperation() == operation)
&& (ruleAction.getObjectType() == ObjectType.ALL || ruleAction.getObjectType() == objectType))
{
controlled = true;
@@ -131,9 +130,9 @@ public class RuleSet implements EventLog
/**
* Checks for the case when the client's address is not known.
*
- * @see #check(Subject, Operation, ObjectType, ObjectProperties, InetAddress)
+ * @see #check(Subject, LegacyOperation, ObjectType, ObjectProperties, InetAddress)
*/
- public Result check(Subject subject, Operation operation, ObjectType objectType, ObjectProperties properties)
+ public Result check(Subject subject, LegacyOperation operation, ObjectType objectType, ObjectProperties properties)
{
return check(subject, operation, objectType, properties, null);
}
@@ -147,7 +146,7 @@ public class RuleSet implements EventLog
* the first match found, or denies access if there are no matching rules. Normally, it would be expected
* to have a default deny or allow rule at the end of an access configuration however.
*/
- public Result check(Subject subject, Operation operation, ObjectType objectType, ObjectProperties properties, InetAddress addressOfClient)
+ public Result check(Subject subject, LegacyOperation operation, ObjectType objectType, ObjectProperties properties, InetAddress addressOfClient)
{
ClientAction action = new ClientAction(operation, objectType, properties);
@@ -172,6 +171,7 @@ public class RuleSet implements EventLog
if (action.matches(rule.getAclAction(), addressOfClient))
{
RuleOutcome ruleOutcome = rule.getRuleOutcome();
+ _logger.debug("Action matches. Result: {}", ruleOutcome);
boolean allowed = ruleOutcome.isAllowed();
if(ruleOutcome.isLogged())
{
@@ -195,7 +195,7 @@ public class RuleSet implements EventLog
return allowed ? Result.ALLOWED : Result.DENIED;
}
}
-
+ _logger.debug("Deferring result of ACL check");
// Defer to the next plugin of this type, if it exists
return Result.DEFER;
}
@@ -248,13 +248,13 @@ public class RuleSet implements EventLog
return false;
}
- private Map<ObjectType, List<Rule>> getObjectToRuleCache(final Subject subject, final Operation operation)
+ private Map<ObjectType, List<Rule>> getObjectToRuleCache(final Subject subject, final LegacyOperation operation)
{
// Lookup identity in cache and create empty operation map if required
- Map<Operation, Map<ObjectType, List<Rule>>> operations = _cache.get(subject);
+ Map<LegacyOperation, Map<ObjectType, List<Rule>>> operations = _cache.get(subject);
if (operations == null)
{
- operations = Collections.synchronizedMap(new EnumMap<Operation, Map<ObjectType, List<Rule>>>(Operation.class));
+ operations = Collections.synchronizedMap(new EnumMap<LegacyOperation, Map<ObjectType, List<Rule>>>(LegacyOperation.class));
_cache.put(subject, operations);
}
Modified: qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/RuleSetCreator.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/RuleSetCreator.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/RuleSetCreator.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/config/RuleSetCreator.java Fri Jul 8 13:23:25 2016
@@ -25,7 +25,6 @@ import java.util.TreeMap;
import org.apache.qpid.server.logging.EventLoggerProvider;
import org.apache.qpid.server.security.Result;
-import org.apache.qpid.server.security.access.Operation;
import org.apache.qpid.server.security.access.RuleOutcome;
final class RuleSetCreator
@@ -44,7 +43,7 @@ final class RuleSetCreator
return !_rules.containsKey(number);
}
- void grant(Integer number, String identity, RuleOutcome ruleOutcome, Operation operation)
+ void grant(Integer number, String identity, RuleOutcome ruleOutcome, LegacyOperation operation)
{
AclAction action = new AclAction(operation);
addRule(number, identity, ruleOutcome, action);
@@ -53,7 +52,7 @@ final class RuleSetCreator
void grant(Integer number,
String identity,
RuleOutcome ruleOutcome,
- Operation operation,
+ LegacyOperation operation,
ObjectType object,
ObjectProperties properties)
{
@@ -64,7 +63,7 @@ final class RuleSetCreator
void grant(Integer number,
String identity,
RuleOutcome ruleOutcome,
- Operation operation,
+ LegacyOperation operation,
ObjectType object,
AclRulePredicates predicates)
{
Modified: qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/plugins/ACLFileAccessControlProviderImpl.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/plugins/ACLFileAccessControlProviderImpl.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/plugins/ACLFileAccessControlProviderImpl.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/plugins/ACLFileAccessControlProviderImpl.java Fri Jul 8 13:23:25 2016
@@ -31,6 +31,7 @@ import org.apache.qpid.server.model.Brok
import org.apache.qpid.server.model.BrokerModel;
import org.apache.qpid.server.model.ManagedAttributeField;
import org.apache.qpid.server.model.ManagedObjectFactoryConstructor;
+import org.apache.qpid.server.security.access.Operation;
import org.apache.qpid.server.security.access.config.AclFileParser;
import org.apache.qpid.server.security.access.config.RuleBasedAccessControl;
import org.apache.qpid.server.util.urlstreamhandler.data.Handler;
@@ -70,7 +71,7 @@ public class ACLFileAccessControlProvide
@Override
public void reload()
{
- getSecurityManager().authoriseUpdate(this);
+ authorise(Operation.UPDATE);
reloadAclFile();
}
Modified: qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/plugins/AbstractRuleBasedAccessControlProvider.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/plugins/AbstractRuleBasedAccessControlProvider.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/plugins/AbstractRuleBasedAccessControlProvider.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/plugins/AbstractRuleBasedAccessControlProvider.java Fri Jul 8 13:23:25 2016
@@ -31,18 +31,18 @@ import org.apache.qpid.server.configurat
import org.apache.qpid.server.logging.EventLogger;
import org.apache.qpid.server.logging.messages.AccessControlMessages;
import org.apache.qpid.server.model.AbstractConfiguredObject;
+import org.apache.qpid.server.model.AccessControlProvider;
import org.apache.qpid.server.model.Broker;
import org.apache.qpid.server.model.ManagedAttributeField;
import org.apache.qpid.server.model.ManagedObjectFactoryConstructor;
import org.apache.qpid.server.model.State;
import org.apache.qpid.server.model.StateTransition;
import org.apache.qpid.server.security.AccessControl;
-import org.apache.qpid.server.security.access.config.AclFileParser;
import org.apache.qpid.server.security.access.config.RuleBasedAccessControl;
import org.apache.qpid.server.util.urlstreamhandler.data.Handler;
public abstract class AbstractRuleBasedAccessControlProvider<X extends AbstractRuleBasedAccessControlProvider<X>>
- extends AbstractConfiguredObject<X>
+ extends AbstractConfiguredObject<X> implements AccessControlProvider<X>
{
private static final Logger LOGGER = LoggerFactory.getLogger(AbstractRuleBasedAccessControlProvider.class);
@@ -55,6 +55,9 @@ public abstract class AbstractRuleBasedA
private final Broker _broker;
private final EventLogger _eventLogger;
+ @ManagedAttributeField
+ private int _priority;
+
public AbstractRuleBasedAccessControlProvider(Map<String, Object> attributes, Broker broker)
{
super(parentsMap(broker), attributes);
@@ -175,4 +178,10 @@ public abstract class AbstractRuleBasedA
{
return _accessControl;
}
+
+ @Override
+ public final int getPriority()
+ {
+ return _priority;
+ }
}
Modified: qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/plugins/AclRule.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/plugins/AclRule.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/plugins/AclRule.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/plugins/AclRule.java Fri Jul 8 13:23:25 2016
@@ -26,7 +26,7 @@ import org.apache.qpid.server.model.Mana
import org.apache.qpid.server.model.ManagedAttributeValueType;
import org.apache.qpid.server.security.access.config.ObjectProperties;
import org.apache.qpid.server.security.access.config.ObjectType;
-import org.apache.qpid.server.security.access.Operation;
+import org.apache.qpid.server.security.access.config.LegacyOperation;
import org.apache.qpid.server.security.access.RuleOutcome;
@ManagedAttributeValueType
@@ -34,7 +34,7 @@ public interface AclRule extends Managed
{
String getIdentity();
ObjectType getObjectType();
- Operation getOperation();
+ LegacyOperation getOperation();
Map<ObjectProperties.Property,String> getAttributes();
RuleOutcome getOutcome();
}
Modified: qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/plugins/RuleBasedAccessControlProviderImpl.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/plugins/RuleBasedAccessControlProviderImpl.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/plugins/RuleBasedAccessControlProviderImpl.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/main/java/org/apache/qpid/server/security/access/plugins/RuleBasedAccessControlProviderImpl.java Fri Jul 8 13:23:25 2016
@@ -40,7 +40,7 @@ import org.apache.qpid.server.model.Rest
import org.apache.qpid.server.security.Result;
import org.apache.qpid.server.security.access.config.ObjectProperties;
import org.apache.qpid.server.security.access.config.ObjectType;
-import org.apache.qpid.server.security.access.Operation;
+import org.apache.qpid.server.security.access.config.LegacyOperation;
import org.apache.qpid.server.security.access.RuleOutcome;
import org.apache.qpid.server.security.access.config.AclAction;
import org.apache.qpid.server.security.access.config.AclFileParser;
@@ -148,7 +148,7 @@ public class RuleBasedAccessControlProvi
}
@Override
- public Operation getOperation()
+ public LegacyOperation getOperation()
{
return _rule.getAction().getOperation();
}
Modified: qpid/java/trunk/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/config/AclActionTest.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/config/AclActionTest.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/config/AclActionTest.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/config/AclActionTest.java Fri Jul 8 13:23:25 2016
@@ -20,7 +20,6 @@ package org.apache.qpid.server.security.
import static org.mockito.Mockito.*;
-import org.apache.qpid.server.security.access.Operation;
import org.apache.qpid.server.security.access.firewall.FirewallRule;
import org.apache.qpid.test.utils.QpidTestCase;
@@ -31,7 +30,7 @@ public class AclActionTest extends QpidT
{
AclRulePredicates predicates = createAclRulePredicates();
ObjectType objectType = ObjectType.EXCHANGE;
- Operation operation = Operation.ACCESS;
+ LegacyOperation operation = LegacyOperation.ACCESS;
AclAction aclAction = new AclAction(operation, objectType, predicates);
AclAction equalAclAction = new AclAction(operation, objectType, predicates);
@@ -43,7 +42,7 @@ public class AclActionTest extends QpidT
assertTrue(aclAction.hashCode() == equalAclAction.hashCode());
assertFalse("Different operation should cause aclActions to be unequal",
- aclAction.equals(new AclAction(Operation.BIND, objectType, predicates)));
+ aclAction.equals(new AclAction(LegacyOperation.BIND, objectType, predicates)));
assertFalse("Different operation type should cause aclActions to be unequal",
aclAction.equals(new AclAction(operation, ObjectType.GROUP, predicates)));
Modified: qpid/java/trunk/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/config/AclFileParserTest.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/config/AclFileParserTest.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/config/AclFileParserTest.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/config/AclFileParserTest.java Fri Jul 8 13:23:25 2016
@@ -29,7 +29,6 @@ import java.util.List;
import org.apache.qpid.server.configuration.IllegalConfigurationException;
import org.apache.qpid.server.logging.EventLoggerProvider;
import org.apache.qpid.server.security.access.config.ObjectProperties.Property;
-import org.apache.qpid.server.security.access.Operation;
import org.apache.qpid.test.utils.QpidTestCase;
public class AclFileParserTest extends QpidTestCase
@@ -171,7 +170,7 @@ public class AclFileParserTest extends Q
assertEquals(1, rules.size());
final Rule rule = rules.get(0);
assertEquals("Rule has unexpected identity", "user1", rule.getIdentity());
- assertEquals("Rule has unexpected operation", Operation.ACCESS, rule.getAction().getOperation());
+ assertEquals("Rule has unexpected operation", LegacyOperation.ACCESS, rule.getAction().getOperation());
assertEquals("Rule has unexpected operation", ObjectType.VIRTUALHOST, rule.getAction().getObjectType());
assertEquals("Rule has unexpected object properties", ObjectProperties.EMPTY, rule.getAction().getProperties());
}
@@ -188,7 +187,7 @@ public class AclFileParserTest extends Q
assertEquals(1, rules.size());
final Rule rule = rules.get(0);
assertEquals("Rule has unexpected identity", "all", rule.getIdentity());
- assertEquals("Rule has unexpected operation", Operation.CREATE, rule.getAction().getOperation());
+ assertEquals("Rule has unexpected operation", LegacyOperation.CREATE, rule.getAction().getOperation());
assertEquals("Rule has unexpected operation", ObjectType.EXCHANGE, rule.getAction().getObjectType());
final ObjectProperties expectedProperties = new ObjectProperties();
expectedProperties.setName("value");
@@ -207,7 +206,7 @@ public class AclFileParserTest extends Q
assertEquals(1, rules.size());
final Rule rule = rules.get(0);
assertEquals("Rule has unexpected identity", "all", rule.getIdentity());
- assertEquals("Rule has unexpected operation", Operation.CREATE, rule.getAction().getOperation());
+ assertEquals("Rule has unexpected operation", LegacyOperation.CREATE, rule.getAction().getOperation());
assertEquals("Rule has unexpected operation", ObjectType.EXCHANGE, rule.getAction().getObjectType());
final ObjectProperties expectedProperties = new ObjectProperties();
expectedProperties.setName("value");
@@ -226,7 +225,7 @@ public class AclFileParserTest extends Q
assertEquals(1, rules.size());
final Rule rule = rules.get(0);
assertEquals("Rule has unexpected identity", "admin", rule.getIdentity());
- assertEquals("Rule has unexpected operation", Operation.DELETE, rule.getAction().getOperation());
+ assertEquals("Rule has unexpected operation", LegacyOperation.DELETE, rule.getAction().getOperation());
assertEquals("Rule has unexpected operation", ObjectType.QUEUE, rule.getAction().getObjectType());
final ObjectProperties expectedProperties = new ObjectProperties();
expectedProperties.setName("name1");
@@ -249,7 +248,7 @@ public class AclFileParserTest extends Q
assertEquals(3, rules.size());
final Rule rule1 = rules.get(0);
assertEquals("Rule has unexpected identity", "all", rule1.getIdentity());
- assertEquals("Rule has unexpected operation", Operation.CREATE, rule1.getAction().getOperation());
+ assertEquals("Rule has unexpected operation", LegacyOperation.CREATE, rule1.getAction().getOperation());
assertEquals("Rule has unexpected operation", ObjectType.EXCHANGE, rule1.getAction().getObjectType());
final ObjectProperties expectedProperties1 = new ObjectProperties();
expectedProperties1.put(Property.ROUTING_KEY,"news.#");
@@ -278,7 +277,7 @@ public class AclFileParserTest extends Q
assertEquals(1, rules.size());
final Rule rule = rules.get(0);
assertEquals("Rule has unexpected identity", "User1", rule.getIdentity());
- assertEquals("Rule has unexpected operation", Operation.BIND, rule.getAction().getOperation());
+ assertEquals("Rule has unexpected operation", LegacyOperation.BIND, rule.getAction().getOperation());
assertEquals("Rule has unexpected operation", ObjectType.EXCHANGE, rule.getAction().getObjectType());
final ObjectProperties expectedProperties = new ObjectProperties("AmQ.dIrect");
assertEquals("Rule has unexpected object properties", expectedProperties, rule.getAction().getProperties());
@@ -300,7 +299,7 @@ public class AclFileParserTest extends Q
assertEquals(1, rules.size());
final Rule rule = rules.get(0);
assertEquals("Rule has unexpected identity", "user1", rule.getIdentity());
- assertEquals("Rule has unexpected operation", Operation.ACCESS, rule.getAction().getOperation());
+ assertEquals("Rule has unexpected operation", LegacyOperation.ACCESS, rule.getAction().getOperation());
assertEquals("Rule has unexpected operation", ObjectType.VIRTUALHOST, rule.getAction().getObjectType());
assertEquals("Rule has unexpected object properties", ObjectProperties.EMPTY, rule.getAction().getProperties());
}
@@ -318,7 +317,7 @@ public class AclFileParserTest extends Q
assertEquals(1, rules.size());
final Rule rule = rules.get(0);
assertEquals("Rule has unexpected identity", "user1", rule.getIdentity());
- assertEquals("Rule has unexpected operation", Operation.ACCESS, rule.getAction().getOperation());
+ assertEquals("Rule has unexpected operation", LegacyOperation.ACCESS, rule.getAction().getOperation());
assertEquals("Rule has unexpected operation", ObjectType.VIRTUALHOST, rule.getAction().getObjectType());
assertEquals("Rule has unexpected object properties", ObjectProperties.EMPTY, rule.getAction().getProperties());
}
@@ -336,7 +335,7 @@ public class AclFileParserTest extends Q
assertEquals(1, rules.size());
final Rule rule = rules.get(0);
assertEquals("Rule has unexpected identity", "user1", rule.getIdentity());
- assertEquals("Rule has unexpected operation", Operation.ACCESS, rule.getAction().getOperation());
+ assertEquals("Rule has unexpected operation", LegacyOperation.ACCESS, rule.getAction().getOperation());
assertEquals("Rule has unexpected operation", ObjectType.VIRTUALHOST, rule.getAction().getObjectType());
assertEquals("Rule has unexpected object properties", ObjectProperties.EMPTY, rule.getAction().getProperties());
}
@@ -344,47 +343,47 @@ public class AclFileParserTest extends Q
public void testUserRuleParsing() throws Exception
{
validateRule(writeACLConfig("ACL ALLOW user1 CREATE USER"),
- "user1", Operation.CREATE, ObjectType.USER, ObjectProperties.EMPTY);
+ "user1", LegacyOperation.CREATE, ObjectType.USER, ObjectProperties.EMPTY);
validateRule(writeACLConfig("ACL ALLOW user1 CREATE USER name=\"otherUser\""),
- "user1", Operation.CREATE, ObjectType.USER, new ObjectProperties("otherUser"));
+ "user1", LegacyOperation.CREATE, ObjectType.USER, new ObjectProperties("otherUser"));
validateRule(writeACLConfig("ACL ALLOW user1 DELETE USER"),
- "user1", Operation.DELETE, ObjectType.USER, ObjectProperties.EMPTY);
+ "user1", LegacyOperation.DELETE, ObjectType.USER, ObjectProperties.EMPTY);
validateRule(writeACLConfig("ACL ALLOW user1 DELETE USER name=\"otherUser\""),
- "user1", Operation.DELETE, ObjectType.USER, new ObjectProperties("otherUser"));
+ "user1", LegacyOperation.DELETE, ObjectType.USER, new ObjectProperties("otherUser"));
validateRule(writeACLConfig("ACL ALLOW user1 UPDATE USER"),
- "user1", Operation.UPDATE, ObjectType.USER, ObjectProperties.EMPTY);
+ "user1", LegacyOperation.UPDATE, ObjectType.USER, ObjectProperties.EMPTY);
validateRule(writeACLConfig("ACL ALLOW user1 UPDATE USER name=\"otherUser\""),
- "user1", Operation.UPDATE, ObjectType.USER, new ObjectProperties("otherUser"));
+ "user1", LegacyOperation.UPDATE, ObjectType.USER, new ObjectProperties("otherUser"));
validateRule(writeACLConfig("ACL ALLOW user1 ALL USER"),
- "user1", Operation.ALL, ObjectType.USER, ObjectProperties.EMPTY);
+ "user1", LegacyOperation.ALL, ObjectType.USER, ObjectProperties.EMPTY);
validateRule(writeACLConfig("ACL ALLOW user1 ALL USER name=\"otherUser\""),
- "user1", Operation.ALL, ObjectType.USER, new ObjectProperties("otherUser"));
+ "user1", LegacyOperation.ALL, ObjectType.USER, new ObjectProperties("otherUser"));
}
public void testGroupRuleParsing() throws Exception
{
validateRule(writeACLConfig("ACL ALLOW user1 CREATE GROUP"),
- "user1", Operation.CREATE, ObjectType.GROUP, ObjectProperties.EMPTY);
+ "user1", LegacyOperation.CREATE, ObjectType.GROUP, ObjectProperties.EMPTY);
validateRule(writeACLConfig("ACL ALLOW user1 CREATE GROUP name=\"groupName\""),
- "user1", Operation.CREATE, ObjectType.GROUP, new ObjectProperties("groupName"));
+ "user1", LegacyOperation.CREATE, ObjectType.GROUP, new ObjectProperties("groupName"));
validateRule(writeACLConfig("ACL ALLOW user1 DELETE GROUP"),
- "user1", Operation.DELETE, ObjectType.GROUP, ObjectProperties.EMPTY);
+ "user1", LegacyOperation.DELETE, ObjectType.GROUP, ObjectProperties.EMPTY);
validateRule(writeACLConfig("ACL ALLOW user1 DELETE GROUP name=\"groupName\""),
- "user1", Operation.DELETE, ObjectType.GROUP, new ObjectProperties("groupName"));
+ "user1", LegacyOperation.DELETE, ObjectType.GROUP, new ObjectProperties("groupName"));
validateRule(writeACLConfig("ACL ALLOW user1 UPDATE GROUP"),
- "user1", Operation.UPDATE, ObjectType.GROUP, ObjectProperties.EMPTY);
+ "user1", LegacyOperation.UPDATE, ObjectType.GROUP, ObjectProperties.EMPTY);
validateRule(writeACLConfig("ACL ALLOW user1 UPDATE GROUP name=\"groupName\""),
- "user1", Operation.UPDATE, ObjectType.GROUP, new ObjectProperties("groupName"));
+ "user1", LegacyOperation.UPDATE, ObjectType.GROUP, new ObjectProperties("groupName"));
validateRule(writeACLConfig("ACL ALLOW user1 ALL GROUP"),
- "user1", Operation.ALL, ObjectType.GROUP, ObjectProperties.EMPTY);
+ "user1", LegacyOperation.ALL, ObjectType.GROUP, ObjectProperties.EMPTY);
validateRule(writeACLConfig("ACL ALLOW user1 ALL GROUP name=\"groupName\""),
- "user1", Operation.ALL, ObjectType.GROUP, new ObjectProperties("groupName"));
+ "user1", LegacyOperation.ALL, ObjectType.GROUP, new ObjectProperties("groupName"));
}
/** explicitly test for exception indicating that this functionality has been moved to Group Providers */
@@ -404,20 +403,20 @@ public class AclFileParserTest extends Q
public void testManagementRuleParsing() throws Exception
{
validateRule(writeACLConfig("ACL ALLOW user1 ALL MANAGEMENT"),
- "user1", Operation.ALL, ObjectType.MANAGEMENT, ObjectProperties.EMPTY);
+ "user1", LegacyOperation.ALL, ObjectType.MANAGEMENT, ObjectProperties.EMPTY);
validateRule(writeACLConfig("ACL ALLOW user1 ACCESS MANAGEMENT"),
- "user1", Operation.ACCESS, ObjectType.MANAGEMENT, ObjectProperties.EMPTY);
+ "user1", LegacyOperation.ACCESS, ObjectType.MANAGEMENT, ObjectProperties.EMPTY);
}
public void testBrokerRuleParsing() throws Exception
{
- validateRule(writeACLConfig("ACL ALLOW user1 CONFIGURE BROKER"), "user1", Operation.CONFIGURE, ObjectType.BROKER,
- ObjectProperties.EMPTY);
- validateRule(writeACLConfig("ACL ALLOW user1 ALL BROKER"), "user1", Operation.ALL, ObjectType.BROKER, ObjectProperties.EMPTY);
+ validateRule(writeACLConfig("ACL ALLOW user1 CONFIGURE BROKER"), "user1", LegacyOperation.CONFIGURE, ObjectType.BROKER,
+ ObjectProperties.EMPTY);
+ validateRule(writeACLConfig("ACL ALLOW user1 ALL BROKER"), "user1", LegacyOperation.ALL, ObjectType.BROKER, ObjectProperties.EMPTY);
}
- private void validateRule(final RuleSet rs, String username, Operation operation, ObjectType objectType, ObjectProperties objectProperties)
+ private void validateRule(final RuleSet rs, String username, LegacyOperation operation, ObjectType objectType, ObjectProperties objectProperties)
{
assertEquals(1, rs.getRuleCount());
Modified: qpid/java/trunk/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/config/ActionTest.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/config/ActionTest.java?rev=1751900&r1=1751899&r2=1751900&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/config/ActionTest.java (original)
+++ qpid/java/trunk/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/config/ActionTest.java Fri Jul 8 13:23:25 2016
@@ -20,8 +20,6 @@ package org.apache.qpid.server.security.
import static org.mockito.Mockito.*;
-import org.apache.qpid.server.security.access.Operation;
-
import org.apache.qpid.test.utils.QpidTestCase;
public class ActionTest extends QpidTestCase
@@ -34,50 +32,50 @@ public class ActionTest extends QpidTest
when(_properties1.matches(_properties2)).thenReturn(true);
assertMatches(
- new Action(Operation.CONSUME, ObjectType.QUEUE, _properties1),
- new Action(Operation.CONSUME, ObjectType.QUEUE, _properties2));
+ new Action(LegacyOperation.CONSUME, ObjectType.QUEUE, _properties1),
+ new Action(LegacyOperation.CONSUME, ObjectType.QUEUE, _properties2));
}
public void testMatchesReturnsFalseWhenOperationsDiffer()
{
assertDoesntMatch(
- new Action(Operation.CONSUME, ObjectType.QUEUE, _properties1),
- new Action(Operation.CREATE, ObjectType.QUEUE, _properties1));
+ new Action(LegacyOperation.CONSUME, ObjectType.QUEUE, _properties1),
+ new Action(LegacyOperation.CREATE, ObjectType.QUEUE, _properties1));
}
public void testMatchesReturnsFalseWhenOperationTypesDiffer()
{
assertDoesntMatch(
- new Action(Operation.CREATE, ObjectType.QUEUE, _properties1),
- new Action(Operation.CREATE, ObjectType.EXCHANGE, _properties1));
+ new Action(LegacyOperation.CREATE, ObjectType.QUEUE, _properties1),
+ new Action(LegacyOperation.CREATE, ObjectType.EXCHANGE, _properties1));
}
public void testMatchesReturnsFalseWhenOperationPropertiesDiffer()
{
assertDoesntMatch(
- new Action(Operation.CREATE, ObjectType.QUEUE, _properties1),
- new Action(Operation.CREATE, ObjectType.QUEUE, _properties2));
+ new Action(LegacyOperation.CREATE, ObjectType.QUEUE, _properties1),
+ new Action(LegacyOperation.CREATE, ObjectType.QUEUE, _properties2));
}
public void testMatchesReturnsFalseWhenMyOperationPropertiesIsNull()
{
assertDoesntMatch(
- new Action(Operation.CREATE, ObjectType.QUEUE, (ObjectProperties)null),
- new Action(Operation.CREATE, ObjectType.QUEUE, _properties1));
+ new Action(LegacyOperation.CREATE, ObjectType.QUEUE, (ObjectProperties)null),
+ new Action(LegacyOperation.CREATE, ObjectType.QUEUE, _properties1));
}
public void testMatchesReturnsFalseWhenOtherOperationPropertiesIsNull()
{
assertDoesntMatch(
- new Action(Operation.CREATE, ObjectType.QUEUE, _properties1),
- new Action(Operation.CREATE, ObjectType.QUEUE, (ObjectProperties)null));
+ new Action(LegacyOperation.CREATE, ObjectType.QUEUE, _properties1),
+ new Action(LegacyOperation.CREATE, ObjectType.QUEUE, (ObjectProperties)null));
}
public void testMatchesReturnsTrueWhenBothOperationPropertiesAreNull()
{
assertMatches(
- new Action(Operation.CREATE, ObjectType.QUEUE, (ObjectProperties)null),
- new Action(Operation.CREATE, ObjectType.QUEUE, (ObjectProperties)null));
+ new Action(LegacyOperation.CREATE, ObjectType.QUEUE, (ObjectProperties)null),
+ new Action(LegacyOperation.CREATE, ObjectType.QUEUE, (ObjectProperties)null));
}
private void assertMatches(Action action1, Action action2)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@qpid.apache.org
For additional commands, e-mail: commits-help@qpid.apache.org