You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@activemq.apache.org by cl...@apache.org on 2018/08/09 23:32:25 UTC
[1/2] activemq-artemis git commit: NO-JIRA spelling fixes on docs
Repository: activemq-artemis
Updated Branches:
refs/heads/2.6.x 170562882 -> 2c20fe471
NO-JIRA spelling fixes on docs
(cherry picked from commit bfc9aec33b10582f85e7c2d525681ddf7455ddad)
Project: http://git-wip-us.apache.org/repos/asf/activemq-artemis/repo
Commit: http://git-wip-us.apache.org/repos/asf/activemq-artemis/commit/f7637eb2
Tree: http://git-wip-us.apache.org/repos/asf/activemq-artemis/tree/f7637eb2
Diff: http://git-wip-us.apache.org/repos/asf/activemq-artemis/diff/f7637eb2
Branch: refs/heads/2.6.x
Commit: f7637eb2389ef69b9d88c0743881c1fbc65d0684
Parents: 1705628
Author: Codrin Bucur <cb...@redhat.com>
Authored: Wed Jul 18 11:22:44 2018 +0200
Committer: Clebert Suconic <cl...@apache.org>
Committed: Thu Aug 9 19:25:35 2018 -0400
----------------------------------------------------------------------
docs/user-manual/en/clusters.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/activemq-artemis/blob/f7637eb2/docs/user-manual/en/clusters.md
----------------------------------------------------------------------
diff --git a/docs/user-manual/en/clusters.md b/docs/user-manual/en/clusters.md
index 54dc54e..4aa2154 100644
--- a/docs/user-manual/en/clusters.md
+++ b/docs/user-manual/en/clusters.md
@@ -389,13 +389,13 @@ connection. The default value for this parameter is `10000` milliseconds.
Sometimes it may be impossible to use UDP on the network you are using.
In this case its possible to configure a connection with an initial list
-if possible servers. This could be just one server that you know will
+of possible servers. This could be just one server that you know will
always be available or a list of servers where at least one will be
available.
This doesn't mean that you have to know where all your servers are going
to be hosted, you can configure these servers to use the reliable
-servers to connect to. Once they are connected there connection details
+servers to connect to. Once they are connected their connection details
will be propagated via the server it connects to
#### Configuring a Cluster Connection
[2/2] activemq-artemis git commit: ARTEMIS-1974 document LDAP role
expansion
Posted by cl...@apache.org.
ARTEMIS-1974 document LDAP role expansion
(cherry picked from commit 7b4be5008dfaca122d5a277b4010807a176a2992)
Project: http://git-wip-us.apache.org/repos/asf/activemq-artemis/repo
Commit: http://git-wip-us.apache.org/repos/asf/activemq-artemis/commit/2c20fe47
Tree: http://git-wip-us.apache.org/repos/asf/activemq-artemis/tree/2c20fe47
Diff: http://git-wip-us.apache.org/repos/asf/activemq-artemis/diff/2c20fe47
Branch: refs/heads/2.6.x
Commit: 2c20fe471bbfd18d5755a30410617db05717f68e
Parents: f7637eb
Author: Justin Bertram <jb...@apache.org>
Authored: Mon Jul 9 09:36:33 2018 -0500
Committer: Clebert Suconic <cl...@apache.org>
Committed: Thu Aug 9 19:27:56 2018 -0400
----------------------------------------------------------------------
.../spi/core/security/jaas/LDAPLoginModule.java | 6 ++++++
docs/user-manual/en/security.md | 13 +++++++++++++
2 files changed, 19 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/activemq-artemis/blob/2c20fe47/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/jaas/LDAPLoginModule.java
----------------------------------------------------------------------
diff --git a/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/jaas/LDAPLoginModule.java b/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/jaas/LDAPLoginModule.java
index 19194fa..7d58a0b 100644
--- a/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/jaas/LDAPLoginModule.java
+++ b/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/jaas/LDAPLoginModule.java
@@ -480,6 +480,12 @@ public class LDAPLoginModule implements LoginModule {
while (!pendingNameExpansion.isEmpty()) {
String name = pendingNameExpansion.remove();
final String expandFilter = expandRolesMatchingFormat.format(new String[]{name});
+ if (logger.isDebugEnabled()) {
+ logger.debug("Get 'expanded' user roles.");
+ logger.debug("Looking for the 'expanded' user roles in LDAP with ");
+ logger.debug(" base DN: " + getLDAPPropertyValue(ROLE_BASE));
+ logger.debug(" filter: " + expandFilter);
+ }
try {
results = Subject.doAs(brokerGssapiIdentity, (PrivilegedExceptionAction< NamingEnumeration<SearchResult>>) () -> context.search(getLDAPPropertyValue(ROLE_BASE), expandFilter, constraints));
} catch (PrivilegedActionException e) {
http://git-wip-us.apache.org/repos/asf/activemq-artemis/blob/2c20fe47/docs/user-manual/en/security.md
----------------------------------------------------------------------
diff --git a/docs/user-manual/en/security.md b/docs/user-manual/en/security.md
index 47fb228..63e49a6 100644
--- a/docs/user-manual/en/security.md
+++ b/docs/user-manual/en/security.md
@@ -690,6 +690,19 @@ system. It is implemented by
- `referral` - specify how to handle referrals; valid values: `ignore`,
`follow`, `throw`; default is `ignore`.
+- `expandRoles` - boolean indicating whether to enable the role expansion
+ functionality or not; default false. If enabled, then roles within roles will
+ be found. For example, role `A` is in role `B`. User `X` is in role `A`,
+ which means user `X` is in role `B` by virtue of being in role `A`.
+
+- `expandRolesMatching` - specifies an LDAP search filter which is applied to
+ the subtree selected by `roleBase`. Before passing to the LDAP search operation,
+ the string value you provide here is subjected to string substitution, as
+ implemented by the `java.text.MessageFormat` class. Essentially, this means that
+ the special string, `{0}`, is substituted by the role name as extracted from the
+ previous role search. This option must always be set to enable role expansion
+ because it has no default value. Example value: `(member={0})`.
+
- `debug` - boolean flag; if `true`, enable debugging; this is used only for
testing or debugging; normally, it should be set to `false`, or omitted;
default is `false`