You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@artemis.apache.org by jb...@apache.org on 2026/04/21 17:35:42 UTC
(artemis) branch main updated (7423a9e7cd -> ad85b2053b)
This is an automated email from the ASF dual-hosted git repository.
jbertram pushed a change to branch main
in repository https://gitbox.apache.org/repos/asf/artemis.git
from 7423a9e7cd ARTEMIS-6013 add unit tests for SecurityManagerUtil
new 039d185224 ARTEMIS-6010 - Improve roles checking in authorize call
new ad85b2053b ARTEMIS-6010 - Move logging to SecurityManagerUtil.authorize
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../security/ActiveMQBasicSecurityManager.java | 5 ----
.../core/security/ActiveMQJAASSecurityManager.java | 6 -----
.../artemis/utils/SecurityManagerUtil.java | 28 ++++++++++++----------
3 files changed, 15 insertions(+), 24 deletions(-)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@artemis.apache.org
For additional commands, e-mail: commits-help@artemis.apache.org
(artemis) 01/02: ARTEMIS-6010 - Improve roles checking in authorize call
Posted by jb...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jbertram pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/artemis.git
commit 039d18522455dc6782b9f34ad304f2606422a089
Author: gchuf <ga...@gmail.com>
AuthorDate: Thu Apr 16 10:26:18 2026 +0200
ARTEMIS-6010 - Improve roles checking in authorize call
---
.../activemq/artemis/utils/SecurityManagerUtil.java | 20 +++++++-------------
1 file changed, 7 insertions(+), 13 deletions(-)
diff --git a/artemis-server/src/main/java/org/apache/activemq/artemis/utils/SecurityManagerUtil.java b/artemis-server/src/main/java/org/apache/activemq/artemis/utils/SecurityManagerUtil.java
index bda8d36785..6ec9bbcffd 100644
--- a/artemis-server/src/main/java/org/apache/activemq/artemis/utils/SecurityManagerUtil.java
+++ b/artemis-server/src/main/java/org/apache/activemq/artemis/utils/SecurityManagerUtil.java
@@ -21,7 +21,6 @@ import java.lang.reflect.Constructor;
import java.lang.reflect.Method;
import java.security.Principal;
import java.util.HashSet;
-import java.util.Iterator;
import java.util.Set;
import org.apache.activemq.artemis.core.security.CheckType;
@@ -114,31 +113,26 @@ public class SecurityManagerUtil {
* This method tries to match the RolePrincipals in the Subject with the provided Set of Roles and CheckType
*/
public static boolean authorize(final Subject subject, final Set<Role> roles, final CheckType checkType, final Class rolePrincipalClass) {
- boolean authorized = false;
if (subject != null) {
Set<RolePrincipal> rolesWithPermission = getPrincipalsInRole(checkType, roles, rolePrincipalClass);
// Check the caller's roles
- Set<Principal> rolesForSubject = new HashSet<>();
+ Set<Principal> rolesForSubject;
try {
- rolesForSubject.addAll(subject.getPrincipals(rolePrincipalClass));
+ rolesForSubject = subject.getPrincipals(rolePrincipalClass);
} catch (Exception e) {
ActiveMQServerLogger.LOGGER.failedToFindRolesForTheSubject(e);
+ return false;
}
if (!rolesForSubject.isEmpty() && !rolesWithPermission.isEmpty()) {
- Iterator<Principal> rolesForSubjectIter = rolesForSubject.iterator();
- while (!authorized && rolesForSubjectIter.hasNext()) {
- Iterator<RolePrincipal> rolesWithPermissionIter = rolesWithPermission.iterator();
- Principal subjectRole = rolesForSubjectIter.next();
- while (!authorized && rolesWithPermissionIter.hasNext()) {
- Principal roleWithPermission = rolesWithPermissionIter.next();
- authorized = subjectRole.equals(roleWithPermission);
+ for (Principal subjectRole : rolesForSubject) {
+ if (rolesWithPermission.contains(subjectRole)) {
+ return true;
}
}
}
}
-
- return authorized;
+ return false;
}
}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@artemis.apache.org
For additional commands, e-mail: commits-help@artemis.apache.org
(artemis) 02/02: ARTEMIS-6010 - Move logging to SecurityManagerUtil.authorize
Posted by jb...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jbertram pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/artemis.git
commit ad85b2053b31f651a1b0d758a498eeb08bebb2b7
Author: gchuf <ga...@gmail.com>
AuthorDate: Thu Apr 16 10:25:39 2026 +0200
ARTEMIS-6010 - Move logging to SecurityManagerUtil.authorize
---
.../artemis/spi/core/security/ActiveMQBasicSecurityManager.java | 5 -----
.../artemis/spi/core/security/ActiveMQJAASSecurityManager.java | 6 ------
.../org/apache/activemq/artemis/utils/SecurityManagerUtil.java | 8 ++++++++
3 files changed, 8 insertions(+), 11 deletions(-)
diff --git a/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQBasicSecurityManager.java b/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQBasicSecurityManager.java
index fb52093bc4..3a0cb58f61 100644
--- a/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQBasicSecurityManager.java
+++ b/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQBasicSecurityManager.java
@@ -108,11 +108,6 @@ public class ActiveMQBasicSecurityManager implements ActiveMQSecurityManager5, U
final CheckType checkType,
final String address) {
boolean authorized = SecurityManagerUtil.authorize(subject, roles, checkType, RolePrincipal.class);
- if (authorized) {
- logger.trace("user is authorized");
- } else {
- logger.trace("user is NOT authorized");
- }
return authorized;
}
diff --git a/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQJAASSecurityManager.java b/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQJAASSecurityManager.java
index a0aaed7641..fb81e525f5 100644
--- a/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQJAASSecurityManager.java
+++ b/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQJAASSecurityManager.java
@@ -116,12 +116,6 @@ public class ActiveMQJAASSecurityManager implements ActiveMQSecurityManager5 {
final String address) {
boolean authorized = SecurityManagerUtil.authorize(subject, roles, checkType, rolePrincipalClass);
- if (authorized) {
- logger.trace("user is authorized");
- } else {
- logger.trace("user is NOT authorized");
- }
-
return authorized;
}
diff --git a/artemis-server/src/main/java/org/apache/activemq/artemis/utils/SecurityManagerUtil.java b/artemis-server/src/main/java/org/apache/activemq/artemis/utils/SecurityManagerUtil.java
index 6ec9bbcffd..16646229f4 100644
--- a/artemis-server/src/main/java/org/apache/activemq/artemis/utils/SecurityManagerUtil.java
+++ b/artemis-server/src/main/java/org/apache/activemq/artemis/utils/SecurityManagerUtil.java
@@ -17,6 +17,8 @@
package org.apache.activemq.artemis.utils;
import javax.security.auth.Subject;
+
+import java.lang.invoke.MethodHandles;
import java.lang.reflect.Constructor;
import java.lang.reflect.Method;
import java.security.Principal;
@@ -27,9 +29,13 @@ import org.apache.activemq.artemis.core.security.CheckType;
import org.apache.activemq.artemis.core.security.Role;
import org.apache.activemq.artemis.core.server.ActiveMQServerLogger;
import org.apache.activemq.artemis.spi.core.security.jaas.RolePrincipal;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
public class SecurityManagerUtil {
+ private static final Logger logger = LoggerFactory.getLogger(MethodHandles.lookup().lookupClass());
+
private static final String WILDCARD = "*";
public static Set<RolePrincipal> getPrincipalsInRole(final CheckType checkType, final Set<Role> roles, final Class rolePrincipalClass) {
@@ -128,11 +134,13 @@ public class SecurityManagerUtil {
if (!rolesForSubject.isEmpty() && !rolesWithPermission.isEmpty()) {
for (Principal subjectRole : rolesForSubject) {
if (rolesWithPermission.contains(subjectRole)) {
+ logger.trace("user is authorized");
return true;
}
}
}
}
+ logger.trace("user is NOT authorized");
return false;
}
}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@artemis.apache.org
For additional commands, e-mail: commits-help@artemis.apache.org