QPID-5634: [Java Broker] Remove support for AccessPlugins at the level of the virtualhost. Introduce supports for ACLs rules that include virtualhost predicate.

git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1579986 13f79535-47bb-0310-9956-ffa450edef68

12 files changed, 212 insertions, 207 deletions

diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/server/logging/AccessControlLoggingTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/server/logging/AccessControlLoggingTest.java
index 37f960a65a..a0188626ee 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/server/logging/AccessControlLoggingTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/server/logging/AccessControlLoggingTest.java
@@ -49,8 +49,7 @@ public class AccessControlLoggingTest extends AbstractTestLogging
     public void setUp() throws Exception
     {
         // Write out ACL for this test
-        AbstractACLTestCase.writeACLFileUtil(this, "test",
-                "ACL ALLOW client ACCESS VIRTUALHOST",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW client ACCESS VIRTUALHOST",
                 "ACL ALLOW client CREATE QUEUE name='allow'",
                 "ACL ALLOW-LOG client CREATE QUEUE name='allow-log'",
                 "ACL DENY client CREATE QUEUE name='deny'",
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/AbstractACLTestCase.java b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/AbstractACLTestCase.java
index 7a3edd316f..461670dc1e 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/AbstractACLTestCase.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/AbstractACLTestCase.java
@@ -26,7 +26,6 @@ import org.apache.qpid.client.AMQConnection;
 import org.apache.qpid.client.AMQConnectionURL;
 import org.apache.qpid.jms.ConnectionListener;
 import org.apache.qpid.protocol.AMQConstant;
-import org.apache.qpid.server.model.Broker;
 import org.apache.qpid.test.utils.QpidBrokerTestCase;
 import org.apache.qpid.url.URLSyntaxException;
 
@@ -45,12 +44,10 @@ import java.util.concurrent.TimeUnit;
 
 /**
  * Abstract test case for ACLs.
- * 
+ *
  * This base class contains convenience methods to manage ACL files and implements a mechanism that allows each
  * test method to run its own setup code before the broker starts.
- * 
- * TODO move the pre broker-startup setup method invocation code to {@link QpidBrokerTestCase}
- * 
+ *
  * @see ExternalACLTest
  * @see ExternalACLJMXTest
  * @see ExhaustiveACLTest
@@ -80,7 +77,7 @@ public abstract class AbstractACLTestCase extends QpidBrokerTestCase implements
         {
             throw (Exception) e.getTargetException();
         }
-        
+
         super.setUp();
     }
 
@@ -97,25 +94,18 @@ public abstract class AbstractACLTestCase extends QpidBrokerTestCase implements
             //that we provoked with authentication failures, where the test passes - we can ignore on con close
         }
     }
-    
-    public void writeACLFile(final String vhost, final String...rules) throws ConfigurationException, IOException
+
+    public void writeACLFile(final String...rules) throws ConfigurationException, IOException
     {
-        writeACLFileUtil(this, vhost, rules);
+        writeACLFileUtil(this, rules);
     }
 
-    public static void writeACLFileUtil(QpidBrokerTestCase testcase, String vhost, String...rules) throws ConfigurationException, IOException
+    public static void writeACLFileUtil(QpidBrokerTestCase testcase, String...rules) throws ConfigurationException, IOException
     {
         File aclFile = File.createTempFile(testcase.getClass().getSimpleName(), testcase.getName());
         aclFile.deleteOnExit();
 
-        if (vhost == null)
-        {
-            testcase.getBrokerConfiguration().addAclFileConfiguration(aclFile.getAbsolutePath());
-        }
-        else
-        {
-            testcase.setVirtualHostConfigurationProperty("virtualhosts.virtualhost." + vhost + ".security.acl", aclFile.getAbsolutePath());
-        }
+        testcase.getBrokerConfiguration().addAclFileConfiguration(aclFile.getAbsolutePath());
 
         PrintWriter out = new PrintWriter(new FileWriter(aclFile));
         out.println(String.format("# %s", testcase.getName()));
@@ -127,7 +117,7 @@ public abstract class AbstractACLTestCase extends QpidBrokerTestCase implements
     }
 
     /**
-     * Creates a connection to the broker, and sets a connection listener to prevent failover and an exception listener 
+     * Creates a connection to the broker, and sets a connection listener to prevent failover and an exception listener
      * with a {@link CountDownLatch} to synchronise in the {@link #check403Exception(Throwable)} method and allow the
      * {@link #tearDown()} method to complete properly.
      */
@@ -137,8 +127,8 @@ public abstract class AbstractACLTestCase extends QpidBrokerTestCase implements
 
         //Prevent Failover
         connection.setConnectionListener(this);
-        
-        //QPID-2081: use a latch to sync on exception causing connection close, to work 
+
+        //QPID-2081: use a latch to sync on exception causing connection close, to work
         //around the connection close race during tearDown() causing sporadic failures
         _exceptionReceived = new CountDownLatch(1);
 
@@ -195,8 +185,8 @@ public abstract class AbstractACLTestCase extends QpidBrokerTestCase implements
         assertNotNull("There was no linked exception", t);
         assertTrue("Wrong linked exception type : " + t.getClass(), t instanceof AMQException);
         assertEquals("Incorrect error code received", 403, ((AMQException) t).getErrorCode().getCode());
-    
-        //use the latch to ensure the control thread waits long enough for the exception thread 
+
+        //use the latch to ensure the control thread waits long enough for the exception thread
         //to have done enough to mark the connection closed before teardown commences
         assertTrue("Timed out waiting for conneciton to report close", _exceptionReceived.await(2, TimeUnit.SECONDS));
     }
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExhaustiveACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExhaustiveACLTest.java
index 50c80692dd..07fe88b38f 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExhaustiveACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExhaustiveACLTest.java
@@ -39,20 +39,20 @@ public class ExhaustiveACLTest extends AbstractACLTestCase
 
     /**
      * Creates a queue.
-     * 
+     *
      * Connects to the broker as a particular user and create the named queue on a virtual host, with the provided
      * parameters. Uses a new {@link Connection} and {@link Session} and closes them afterwards.
      */
 	private void createQueue(String vhost, String user, String name, boolean autoDelete, boolean durable) throws Exception
 	{
-		Connection conn = getConnection(vhost, user, "guest");	
+		Connection conn = getConnection(vhost, user, "guest");
 		Session sess = conn.createSession(true, Session.SESSION_TRANSACTED);
 		conn.start();
 		((AMQSession<?, ?>) sess).createQueue(new AMQShortString(name), autoDelete, durable, false);
 		sess.commit();
 		conn.close();
 	}
-	
+
 	/**
 	 * Calls {@link #createQueue(String, String, String, boolean, boolean)} with the provided parameters and checks that
 	 * no exceptions were thrown.
@@ -61,7 +61,7 @@ public class ExhaustiveACLTest extends AbstractACLTestCase
 	{
 		try
 		{
-			createQueue(vhost, user, name, autoDelete, durable);			
+			createQueue(vhost, user, name, autoDelete, durable);
 		}
 		catch (AMQException e)
 		{
@@ -72,7 +72,7 @@ public class ExhaustiveACLTest extends AbstractACLTestCase
 
 	/**
 	 * Calls {@link #createQueue(String, String, String, boolean, boolean)} with the provided parameters and checks that
-	 * the exception thrown was an {@link AMQConstant#ACCESS_REFUSED} or 403 error code. 
+	 * the exception thrown was an {@link AMQConstant#ACCESS_REFUSED} or 403 error code.
 	 */
 	private void createQueueFailure(String vhost, String user, String name, boolean autoDelete, boolean durable) throws Exception
 	{
@@ -87,67 +87,64 @@ public class ExhaustiveACLTest extends AbstractACLTestCase
 			assertEquals("Should be an ACCESS_REFUSED error", 403, e.getErrorCode().getCode());
 		}
 	}
-	
+
     public void setUpAuthoriseCreateQueueAutodelete() throws Exception
     {
-        writeACLFile("test",
-					 "acl allow client access virtualhost",
+        writeACLFile("acl allow client access virtualhost",
 					 "acl allow server access virtualhost",
 					 "acl allow client create queue name=\"temp.true.*\" autodelete=true",
 					 "acl allow client create queue name=\"temp.false.*\" autodelete=false",
-					 "acl deny client create queue",	
-					 "acl allow client delete queue",				 
+					 "acl deny client create queue",
+					 "acl allow client delete queue",
 					 "acl deny all create queue"
             );
     }
-    
+
     /**
      * Test creation of temporary queues, with the autodelete property set to true.
      */
     public void testAuthoriseCreateQueueAutodelete() throws Exception
 	{
-		createQueueSuccess("test", "client", "temp.true.00", true, false); 
+		createQueueSuccess("test", "client", "temp.true.00", true, false);
 		createQueueSuccess("test", "client", "temp.true.01", true, false);
 		createQueueSuccess("test", "client", "temp.true.02", true, true);
-		createQueueSuccess("test", "client", "temp.false.03", false, false); 
+		createQueueSuccess("test", "client", "temp.false.03", false, false);
 		createQueueSuccess("test", "client", "temp.false.04", false, false);
 		createQueueSuccess("test", "client", "temp.false.05", false, true);
-		createQueueFailure("test", "client", "temp.true.06", false, false); 
+		createQueueFailure("test", "client", "temp.true.06", false, false);
 		createQueueFailure("test", "client", "temp.false.07", true, false);
-		createQueueFailure("test", "server", "temp.true.08", true, false); 
+		createQueueFailure("test", "server", "temp.true.08", true, false);
 		createQueueFailure("test", "client", "temp.other.09", false, false);
     }
-	
+
     public void setUpAuthoriseCreateQueue() throws Exception
     {
-        writeACLFile("test",
-                     "acl allow client access virtualhost",
+        writeACLFile("acl allow client access virtualhost",
                      "acl allow server access virtualhost",
                      "acl allow client create queue name=\"create.*\""
             );
     }
-    
+
     /**
      * Tests creation of named queues.
      *
-     * If a named queue is specified 
+     * If a named queue is specified
      */
     public void testAuthoriseCreateQueue() throws Exception
     {
         createQueueSuccess("test", "client", "create.00", true, true);
         createQueueSuccess("test", "client", "create.01", true, false);
         createQueueSuccess("test", "client", "create.02", false, true);
-        createQueueSuccess("test", "client", "create.03", true, false); 
+        createQueueSuccess("test", "client", "create.03", true, false);
         createQueueFailure("test", "server", "create.04", true, true);
         createQueueFailure("test", "server", "create.05", true, false);
         createQueueFailure("test", "server", "create.06", false, true);
-        createQueueFailure("test", "server", "create.07", true, false); 
+        createQueueFailure("test", "server", "create.07", true, false);
     }
-	
+
     public void setUpAuthoriseCreateQueueBoth() throws Exception
     {
-        writeACLFile("test",
-                     "acl allow all access virtualhost",
+        writeACLFile("acl allow all access virtualhost",
                      "acl allow client create queue name=\"create.*\"",
                      "acl allow all create queue temporary=true"
             );
@@ -156,16 +153,16 @@ public class ExhaustiveACLTest extends AbstractACLTestCase
     /**
      * Tests creation of named queues.
      *
-     * If a named queue is specified 
+     * If a named queue is specified
      */
     public void testAuthoriseCreateQueueBoth() throws Exception
     {
         createQueueSuccess("test", "client", "create.00", true, false);
         createQueueSuccess("test", "client", "create.01", false, false);
         createQueueFailure("test", "server", "create.02", false, false);
-        createQueueFailure("test", "guest", "create.03", false, false); 
+        createQueueFailure("test", "guest", "create.03", false, false);
         createQueueSuccess("test", "client", "tmp.00", true, false);
-        createQueueSuccess("test", "server", "tmp.01", true, false); 
+        createQueueSuccess("test", "server", "tmp.01", true, false);
         createQueueSuccess("test", "guest", "tmp.02", true, false);
     }
 }
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExternalACLJMXTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExternalACLJMXTest.java
index 389ac5ff4d..7a1a6cd639 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExternalACLJMXTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExternalACLJMXTest.java
@@ -56,7 +56,7 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
         super.setUp();
         _jmx.open();
     }
-    
+
     @Override
     public void tearDown() throws Exception
     {
@@ -66,9 +66,8 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
 
     public void setUpDenyAllIsCatchAllRule() throws Exception
     {
-        writeACLFile(null,
-                "ACL ALLOW admin ACCESS MANAGEMENT",
-                "#No more rules, default catch all (deny all) should apply");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "#No more rules, default catch all (deny all) should apply");
     }
 
     public void testDenyAllIsCatchAllRule() throws Exception
@@ -107,7 +106,7 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
      */
     public void setUpAllowAll() throws Exception
     {
-        writeACLFile(null, "ACL ALLOW ALL ALL");
+        writeACLFile("ACL ALLOW ALL ALL");
     }
 
     public void testAllowAll() throws Exception
@@ -118,24 +117,17 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
         // PASS
     }
 
-    /**
-     * admin user is denied at broker level but allowed at vhost level.
-     */
-    public void setUpVhostAllowOverridesGlobalDeny() throws Exception
+    public void setUpVhostWithName() throws Exception
     {
-        writeACLFile(null,
-                "ACL ALLOW admin ACCESS MANAGEMENT",
-                "ACL DENY admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue'");
-        writeACLFile(TEST_VHOST,
-                "ACL ALLOW admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue'");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL ALLOW admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue' virtualhost_name='"+ TEST_VHOST + "'",
+                     "ACL DENY  admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue' virtualhost_name='"+ TEST2_VHOST + "'");
     }
 
-    public void testVhostAllowOverridesGlobalDeny() throws Exception
+    public void testVhostWithName() throws Exception
     {
-        //try a vhost-level method on the allowed vhost
         _jmx.createQueue(TEST_VHOST, getTestQueueName(), TEST_QUEUE_OWNER, true);
 
-        //try a vhost-level method on a different vhost
         try
         {
             _jmx.createQueue(TEST2_VHOST, getTestQueueName(), TEST_QUEUE_OWNER, true);
@@ -153,9 +145,8 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
      */
     public void setUpUpdateComponentOnlyAllow() throws Exception
     {
-        writeACLFile(null,
-                "ACL ALLOW admin ACCESS MANAGEMENT",
-                "ACL ALLOW admin UPDATE METHOD component='VirtualHost.VirtualHostManager'");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL ALLOW admin UPDATE METHOD component='VirtualHost.VirtualHostManager'");
     }
 
     public void testUpdateComponentOnlyAllow() throws Exception
@@ -172,9 +163,8 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
      */
     public void setUpUpdateMethodOnlyAllow() throws Exception
     {
-        writeACLFile(null,
-                "ACL ALLOW admin ACCESS MANAGEMENT",
-                "ACL ALLOW admin UPDATE METHOD");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL ALLOW admin UPDATE METHOD");
     }
 
     public void testUpdateMethodOnlyAllow() throws Exception
@@ -187,12 +177,12 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
 
 
     /**
-     * admin user has JMX right, AMPQ right is irrelevant.
+     * admin user has JMX right, AMQP right is irrelevant.
      */
     public void setUpCreateQueueSuccess() throws Exception
     {
-        writeACLFile(null, "ACL ALLOW admin ACCESS MANAGEMENT");
-        writeACLFile(TEST_VHOST, "ACL ALLOW admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue'");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL ALLOW admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue'");
     }
 
     public void testCreateQueueSuccess() throws Exception
@@ -202,14 +192,13 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
 
 
     /**
-     * admin user has JMX right, verifies lack of AMPQ rights is irrelevant.
+     * admin user has JMX right, verifies lack of AMQP rights is irrelevant.
      */
     public void setUpCreateQueueSuccessNoAMQPRights() throws Exception
     {
-        writeACLFile(null, "ACL ALLOW admin ACCESS MANAGEMENT");
-        writeACLFile(TEST_VHOST,
-                "ACL ALLOW admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue'",
-                "ACL DENY admin CREATE QUEUE");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL ALLOW admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue'",
+                     "ACL DENY admin CREATE QUEUE");
     }
 
     public void testCreateQueueSuccessNoAMQPRights() throws Exception
@@ -219,13 +208,12 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
 
 
     /**
-     * admin user does not have JMX right, AMPQ right is irrelevant.
+     * admin user does not have JMX right, AMQP right is irrelevant.
      */
     public void setUpCreateQueueDenied() throws Exception
     {
-        writeACLFile(null, "ACL ALLOW admin ACCESS MANAGEMENT");
-        writeACLFile(TEST_VHOST,
-                "ACL DENY admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue'");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL DENY admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue'");
     }
 
     public void testCreateQueueDenied() throws Exception
@@ -247,9 +235,8 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
      */
     public void setUpServerInformationUpdateDenied() throws Exception
     {
-        writeACLFile(null,
-                "ACL ALLOW admin ACCESS MANAGEMENT",
-                "ACL DENY admin UPDATE METHOD component='ServerInformation' name='resetStatistics'");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL DENY admin UPDATE METHOD component='ServerInformation' name='resetStatistics'");
     }
 
     public void testServerInformationUpdateDenied() throws Exception
@@ -272,9 +259,8 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
      */
     public void setUpServerInformationAccessGranted() throws Exception
     {
-        writeACLFile(null,
-        "ACL ALLOW admin ACCESS MANAGEMENT",
-        "ACL ALLOW-LOG admin ACCESS METHOD component='ServerInformation' name='getManagementApiMajorVersion'");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL ALLOW-LOG admin ACCESS METHOD component='ServerInformation' name='getManagementApiMajorVersion'");
     }
 
     public void testServerInformationAccessGranted() throws Exception
@@ -299,9 +285,8 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
      */
     public void setUpServerInformationUpdateMethodPermission() throws Exception
     {
-        writeACLFile(null,
-                "ACL ALLOW admin ACCESS MANAGEMENT",
-                "ACL ALLOW admin UPDATE METHOD component='ServerInformation' name='resetStatistics'");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL ALLOW admin UPDATE METHOD component='ServerInformation' name='resetStatistics'");
     }
 
     public void testServerInformationUpdateMethodPermission() throws Exception
@@ -317,9 +302,8 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
      */
     public void setUpServerInformationAllMethodPermissions() throws Exception
     {
-        writeACLFile(null,
-                "ACL ALLOW admin ACCESS MANAGEMENT",
-                "ACL ALLOW admin ALL METHOD component='ServerInformation'");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL ALLOW admin ALL METHOD component='ServerInformation'");
     }
 
     public void testServerInformationAllMethodPermissions() throws Exception
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExternalACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExternalACLTest.java
index 00c85e80c8..0e8f3cb7d8 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExternalACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExternalACLTest.java
@@ -18,12 +18,6 @@
  */
 package org.apache.qpid.server.security.acl;
 
-import org.apache.qpid.AMQException;
-import org.apache.qpid.client.AMQDestination;
-import org.apache.qpid.client.AMQSession;
-import org.apache.qpid.protocol.AMQConstant;
-import org.apache.qpid.url.URLSyntaxException;
-
 import javax.jms.Connection;
 import javax.jms.Destination;
 import javax.jms.JMSException;
@@ -37,8 +31,14 @@ import javax.jms.Topic;
 import javax.jms.TopicSubscriber;
 import javax.naming.NamingException;
 
+import org.apache.qpid.AMQException;
+import org.apache.qpid.client.AMQDestination;
+import org.apache.qpid.client.AMQSession;
+import org.apache.qpid.protocol.AMQConstant;
+import org.apache.qpid.url.URLSyntaxException;
+
 /**
- * Tests the V2 ACLs.  The tests perform basic AMQP operations like creating queues or excahnges and publishing and consuming messages, using
+ * Tests the V2 ACLs.  The tests perform basic AMQP operations like creating queues or exchanges and publishing and consuming messages, using
  * JMS to contact the broker.
  */
 public class ExternalACLTest extends AbstractACLTestCase
@@ -46,65 +46,113 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpAccessAuthorizedSuccess() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST");
     }
 
     public void testAccessAuthorizedSuccess() throws Exception
     {
+        Connection conn = getConnection("test", "client", "guest");
+        conn.close();
+    }
+
+    public void setUpAccessNoRightsFailure() throws Exception
+    {
+        writeACLFile("ACL DENY-LOG client ACCESS VIRTUALHOST");
+    }
+
+    public void testAccessNoRightsFailure() throws Exception
+    {
         try
         {
-            Connection conn = getConnection("test", "client", "guest");
-            Session sess = conn.createSession(true, Session.SESSION_TRANSACTED);
-            conn.start();
+            getConnection("test", "client", "guest");
+            fail("Connection was created.");
+        }
+        catch (JMSException e)
+        {
+            assertAccessDeniedException(e);
+        }
+    }
 
-            //Do something to show connection is active.
-            sess.rollback();
+    private void assertAccessDeniedException(JMSException e)
+    {
+        assertEquals("Unexpected exception message", "Error creating connection: Permission denied: test", e.getMessage());
+
+        // JMSException -> linkedException -> cause = AMQException (403 or 320)
+        Exception linkedException = e.getLinkedException();
+        assertNotNull("There was no linked exception", linkedException);
+        Throwable cause = linkedException.getCause();
+        assertNotNull("Cause was null", cause);
+        assertTrue("Wrong linked exception type", cause instanceof AMQException);
+        AMQConstant errorCode = isBroker010() ? AMQConstant.CONNECTION_FORCED : AMQConstant.ACCESS_REFUSED;
+        assertEquals("Incorrect error code received", errorCode, ((AMQException) cause).getErrorCode());
+    }
+
+    public void setUpAccessVirtualHostWithName() throws Exception
+    {
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST name='test'", "ACL DENY-LOG guest ACCESS VIRTUALHOST name='test'",
+                           "ACL ALLOW-LOG server ACCESS VIRTUALHOST name='*'");
+    }
 
-            conn.close();
+    public void testAccessVirtualHostWithName() throws Exception
+    {
+        Connection conn = getConnection("test", "client", "guest");
+        conn.close();
+
+        try
+        {
+            getConnection("test", "guest", "guest");
+            fail("Access should be denied");
         }
-        catch (Exception e)
+        catch (JMSException e)
         {
-            fail("Connection was not created due to:" + e);
+            assertAccessDeniedException(e);
         }
+
+        Connection conn2 = getConnection("test", "server", "guest");
+        conn2.close();
     }
 
-    public void setUpAccessNoRightsFailure() throws Exception
+    public void setUpClientCreateVirtualHostQueue() throws Exception
     {
-        writeACLFile("test", "ACL DENY-LOG client ACCESS VIRTUALHOST");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client CREATE QUEUE virtualhost_name='test'",
+                     "ACL ALLOW-LOG client CONSUME QUEUE",
+                     "ACL ALLOW-LOG client BIND EXCHANGE",
+                     "ACL ALLOW-LOG guest ACCESS VIRTUALHOST",
+                     "ACL DENY-LOG  guest CREATE QUEUE virtualhost_name='test'");
     }
 
-    public void testAccessNoRightsFailure() throws Exception
+    public void testClientCreateVirtualHostQueue() throws NamingException, JMSException, AMQException, Exception
     {
+        Connection conn = getConnection("test", "client", "guest");
+        Session sess = conn.createSession(false, Session.AUTO_ACKNOWLEDGE);
+        Destination dest = sess.createQueue(getTestQueueName());
+        sess.createConsumer(dest);
+        conn.close();
+
         try
         {
-            Connection conn = getConnection("test", "guest", "guest");
-            Session sess = conn.createSession(true, Session.SESSION_TRANSACTED);
-            conn.start();
-            sess.rollback();
+            conn = getConnection("test", "guest", "guest");
+            sess = conn.createSession(false, Session.AUTO_ACKNOWLEDGE);
+            sess.createConsumer(dest);
 
-            fail("Connection was created.");
+            fail("Queue creation for user 'guest' is denied");
         }
         catch (JMSException e)
         {
-            // JMSException -> linkedException -> cause = AMQException (403 or 320)
-            Exception linkedException = e.getLinkedException();
-            assertNotNull("There was no linked exception", linkedException);
-            Throwable cause = linkedException.getCause();
-            assertNotNull("Cause was null", cause);
-            assertTrue("Wrong linked exception type", cause instanceof AMQException);
-            AMQConstant errorCode = isBroker010() ? AMQConstant.CONNECTION_FORCED : AMQConstant.ACCESS_REFUSED;
-            assertEquals("Incorrect error code received", errorCode, ((AMQException) cause).getErrorCode());
+            check403Exception(e.getLinkedException());
         }
     }
 
+
     public void setUpClientDeleteQueueSuccess() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                             "ACL ALLOW-LOG client CREATE QUEUE durable=\"true\"" ,
-                             "ACL ALLOW-LOG client CONSUME QUEUE name=\"clientid:kipper\"",
-                             "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.topic\" durable=true routingKey=kipper",
-                             "ACL ALLOW-LOG client DELETE QUEUE durable=\"true\"",
-                             "ACL ALLOW-LOG client UNBIND EXCHANGE name=\"amq.topic\" durable=true routingKey=kipper");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client CREATE QUEUE durable=\"true\"",
+                     "ACL ALLOW-LOG client CONSUME QUEUE name=\"clientid:kipper\"" ,
+                     "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.topic\" durable=true routingKey=kipper",
+                     "ACL ALLOW-LOG client DELETE QUEUE durable=\"true\"",
+                     "ACL ALLOW-LOG client UNBIND EXCHANGE name=\"amq.topic\" durable=true routingKey=kipper");
     }
 
     public void testClientDeleteQueueSuccess() throws Exception
@@ -128,12 +176,12 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpClientDeleteQueueFailure() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                             "ACL ALLOW-LOG client CREATE QUEUE durable=\"true\"" ,
-                             "ACL ALLOW-LOG client CONSUME QUEUE name=\"clientid:kipper\"",
-                             "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.topic\" durable=true routingKey=kipper",
-                             "ACL DENY-LOG client DELETE QUEUE durable=\"true\"",
-                             "ACL DENY-LOG client UNBIND EXCHANGE name=\"amq.topic\" durable=true routingKey=kipper");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client CREATE QUEUE durable=\"true\"",
+                     "ACL ALLOW-LOG client CONSUME QUEUE name=\"clientid:kipper\"" ,
+                     "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.topic\" durable=true routingKey=kipper",
+                     "ACL DENY-LOG client DELETE QUEUE durable=\"true\"",
+                     "ACL DENY-LOG client UNBIND EXCHANGE name=\"amq.topic\" durable=true routingKey=kipper");
     }
 
     public void testClientDeleteQueueFailure() throws Exception
@@ -177,10 +225,10 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpClientConsumeFromNamedQueueValid() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                             "ACL ALLOW-LOG client CREATE QUEUE name=\"example.RequestQueue\"" ,
-                             "ACL ALLOW-LOG client CONSUME QUEUE name=\"example.RequestQueue\"",
-                             "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.direct\" routingKey=\"example.RequestQueue\"");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client CREATE QUEUE name=\"example.RequestQueue\"",
+                     "ACL ALLOW-LOG client CONSUME QUEUE name=\"example.RequestQueue\"" ,
+                     "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.direct\" routingKey=\"example.RequestQueue\"");
     }
 
 
@@ -197,10 +245,10 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpClientConsumeFromNamedQueueFailure() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                "ACL ALLOW-LOG client CREATE QUEUE" ,
-                "ACL ALLOW-LOG client BIND EXCHANGE",
-                "ACL DENY-LOG client CONSUME QUEUE name=\"IllegalQueue\"");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client CREATE QUEUE",
+                     "ACL ALLOW-LOG client BIND EXCHANGE" ,
+                     "ACL DENY-LOG client CONSUME QUEUE name=\"IllegalQueue\"");
     }
 
     public void testClientConsumeFromNamedQueueFailure() throws NamingException, Exception
@@ -224,11 +272,11 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpClientCreateTemporaryQueueSuccess() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                             "ACL ALLOW-LOG client CREATE QUEUE temporary=\"true\"" ,
-                             "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.direct\" temporary=true",
-                             "ACL ALLOW-LOG client DELETE QUEUE temporary=\"true\"",
-                             "ACL ALLOW-LOG client UNBIND EXCHANGE name=\"amq.direct\" temporary=true");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client CREATE QUEUE temporary=\"true\"",
+                     "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.direct\" temporary=true" ,
+                     "ACL ALLOW-LOG client DELETE QUEUE temporary=\"true\"",
+                     "ACL ALLOW-LOG client UNBIND EXCHANGE name=\"amq.direct\" temporary=true");
     }
 
     public void testClientCreateTemporaryQueueSuccess() throws JMSException, URLSyntaxException, Exception
@@ -243,8 +291,8 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpClientCreateTemporaryQueueFailed() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                             "ACL DENY-LOG client CREATE QUEUE temporary=\"true\"");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL DENY-LOG client CREATE QUEUE temporary=\"true\"");
     }
 
     public void testClientCreateTemporaryQueueFailed() throws NamingException, Exception
@@ -268,9 +316,8 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpClientCreateNamedQueueFailure() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                             "ACL ALLOW-LOG client CREATE QUEUE name=\"ValidQueue\"",
-                             "ACL ALLOW-LOG client CONSUME QUEUE");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client CREATE QUEUE name=\"ValidQueue\"");
     }
 
     public void testClientCreateNamedQueueFailure() throws NamingException, JMSException, AMQException, Exception
@@ -294,10 +341,10 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpClientPublishUsingTransactionSuccess() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                             "ACL ALLOW-LOG client CREATE QUEUE" ,
-                             "ACL ALLOW-LOG client BIND EXCHANGE",
-                             "ACL ALLOW-LOG client PUBLISH EXCHANGE name=\"amq.direct\" routingKey=\"example.RequestQueue\"");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client CREATE QUEUE",
+                     "ACL ALLOW-LOG client BIND EXCHANGE" ,
+                     "ACL ALLOW-LOG client PUBLISH EXCHANGE name=\"amq.direct\" routingKey=\"example.RequestQueue\"");
     }
 
     public void testClientPublishUsingTransactionSuccess() throws Exception
@@ -329,19 +376,18 @@ public class ExternalACLTest extends AbstractACLTestCase
         // We tolerate a dependency from this test to that file because its
         // contents are expected to change rarely.
 
-        writeACLFile("test", "ACL ALLOW-LOG messaging-users ACCESS VIRTUALHOST",
-                             "# Server side",
-                             "ACL ALLOW-LOG server CREATE QUEUE name=\"example.RequestQueue\"" ,
-                             "ACL ALLOW-LOG server BIND EXCHANGE",
-                             "ACL ALLOW-LOG server PUBLISH EXCHANGE name=\"amq.direct\" routingKey=\"TempQueue*\"",
-                             "ACL ALLOW-LOG server CONSUME QUEUE name=\"example.RequestQueue\"",
-                             "# Client side",
-                             "ACL ALLOW-LOG client PUBLISH EXCHANGE name=\"amq.direct\" routingKey=\"example.RequestQueue\"",
-                             "ACL ALLOW-LOG client CONSUME QUEUE temporary=true",
-                             "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.direct\" temporary=true",
-                             "ACL ALLOW-LOG client UNBIND EXCHANGE name=\"amq.direct\" temporary=true",
-                             "ACL ALLOW-LOG client CREATE QUEUE temporary=true",
-                             "ACL ALLOW-LOG client DELETE QUEUE temporary=true");
+        writeACLFile("ACL ALLOW-LOG messaging-users ACCESS VIRTUALHOST", "# Server side",
+                     "ACL ALLOW-LOG server CREATE QUEUE name=\"example.RequestQueue\"",
+                     "ACL ALLOW-LOG server BIND EXCHANGE" ,
+                     "ACL ALLOW-LOG server PUBLISH EXCHANGE name=\"amq.direct\" routingKey=\"TempQueue*\"",
+                     "ACL ALLOW-LOG server CONSUME QUEUE name=\"example.RequestQueue\"",
+                     "# Client side",
+                     "ACL ALLOW-LOG client PUBLISH EXCHANGE name=\"amq.direct\" routingKey=\"example.RequestQueue\"",
+                     "ACL ALLOW-LOG client CONSUME QUEUE temporary=true",
+                     "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.direct\" temporary=true",
+                     "ACL ALLOW-LOG client UNBIND EXCHANGE name=\"amq.direct\" temporary=true",
+                     "ACL ALLOW-LOG client CREATE QUEUE temporary=true",
+                     "ACL ALLOW-LOG client DELETE QUEUE temporary=true");
     }
 
 
@@ -386,9 +432,9 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpClientDeleteQueueSuccessWithOnlyAllPermissions() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                             "ACL ALLOW-LOG client ALL QUEUE",
-                             "ACL ALLOW-LOG client ALL EXCHANGE");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client ALL QUEUE",
+                     "ACL ALLOW-LOG client ALL EXCHANGE");
     }
 
     public void testClientDeleteQueueSuccessWithOnlyAllPermissions() throws Exception
@@ -412,7 +458,7 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpFirewallAllow() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW client ACCESS VIRTUALHOST from_network=\"127.0.0.1\"");
+        writeACLFile("ACL ALLOW client ACCESS VIRTUALHOST from_network=\"127.0.0.1\"");
     }
 
     public void testFirewallAllow() throws Exception
@@ -423,7 +469,7 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpFirewallDeny() throws Exception
     {
-        writeACLFile("test", "ACL DENY client ACCESS VIRTUALHOST from_network=\"127.0.0.1\"");
+        writeACLFile("ACL DENY client ACCESS VIRTUALHOST from_network=\"127.0.0.1\"");
     }
 
     public void testFirewallDeny() throws Exception
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/BrokerACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/BrokerACLTest.java
index 7f41a8eb2e..2d88d02ee5 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/BrokerACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/BrokerACLTest.java
@@ -63,8 +63,7 @@ public class BrokerACLTest extends QpidRestTestCase
         super.customizeConfiguration();
         getRestTestHelper().configureTemporaryPasswordFile(this, ALLOWED_USER, DENIED_USER);
 
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_USER + " CONFIGURE BROKER",
                 "ACL DENY-LOG " + DENIED_USER + " CONFIGURE BROKER",
                 "ACL DENY-LOG ALL ALL");
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/ExchangeRestACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/ExchangeRestACLTest.java
index b39d994198..3b9027fb97 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/ExchangeRestACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/ExchangeRestACLTest.java
@@ -46,8 +46,7 @@ public class ExchangeRestACLTest extends QpidRestTestCase
         super.customizeConfiguration();
         getRestTestHelper().configureTemporaryPasswordFile(this, ALLOWED_USER, DENIED_USER);
 
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_USER + " CREATE EXCHANGE",
                 "ACL DENY-LOG " + DENIED_USER + " CREATE EXCHANGE",
                 "ACL ALLOW-LOG " + ALLOWED_USER + " UPDATE EXCHANGE",
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/GroupRestACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/GroupRestACLTest.java
index 9a578d01fb..02d6e48d81 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/GroupRestACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/GroupRestACLTest.java
@@ -95,8 +95,7 @@ public class GroupRestACLTest extends QpidRestTestCase
 
     public void testCreateGroup() throws Exception
     {
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_GROUP + " CREATE GROUP",
                 "ACL DENY-LOG " + DENIED_GROUP + " CREATE GROUP");
 
@@ -122,8 +121,7 @@ public class GroupRestACLTest extends QpidRestTestCase
 
     public void testDeleteGroup() throws Exception
     {
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_GROUP + " DELETE GROUP",
                 "ACL DENY-LOG " + DENIED_GROUP + " DELETE GROUP");
 
@@ -149,8 +147,7 @@ public class GroupRestACLTest extends QpidRestTestCase
 
     public void testUpdateGroupAddMember() throws Exception
     {
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_GROUP + " UPDATE GROUP",
                 "ACL DENY-LOG " + DENIED_GROUP + " UPDATE GROUP");
 
@@ -170,8 +167,7 @@ public class GroupRestACLTest extends QpidRestTestCase
 
     public void testUpdateGroupDeleteMember() throws Exception
     {
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_GROUP + " UPDATE GROUP",
                 "ACL DENY-LOG " + DENIED_GROUP + " UPDATE GROUP");
 
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/LogViewerACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/LogViewerACLTest.java
index 96ea5c92b3..8dd3a52333 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/LogViewerACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/LogViewerACLTest.java
@@ -39,8 +39,7 @@ public class LogViewerACLTest extends QpidRestTestCase
         super.customizeConfiguration();
         getRestTestHelper().configureTemporaryPasswordFile(this, ALLOWED_USER, DENIED_USER);
 
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_USER + " ACCESS_LOGS BROKER",
                 "ACL DENY-LOG " + DENIED_USER + " ACCESS_LOGS BROKER",
                 "ACL DENY-LOG ALL ALL");
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/QueueRestACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/QueueRestACLTest.java
index b187ca955a..07206a1379 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/QueueRestACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/QueueRestACLTest.java
@@ -43,8 +43,7 @@ public class QueueRestACLTest extends QpidRestTestCase
         super.customizeConfiguration();
         getRestTestHelper().configureTemporaryPasswordFile(this, ALLOWED_USER, DENIED_USER);
 
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_USER + " CREATE QUEUE",
                 "ACL DENY-LOG " + DENIED_USER + " CREATE QUEUE",
                 "ACL ALLOW-LOG " + ALLOWED_USER + " UPDATE QUEUE",
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/UserPreferencesRestACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/UserPreferencesRestACLTest.java
index 6ed84ac95a..efde7d51b7 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/UserPreferencesRestACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/UserPreferencesRestACLTest.java
@@ -77,7 +77,7 @@ public class UserPreferencesRestACLTest extends QpidRestTestCase
         super.customizeConfiguration();
         getRestTestHelper().configureTemporaryPasswordFile(this, ALLOWED_USER, DENIED_USER);
 
-        AbstractACLTestCase.writeACLFileUtil(this, null, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT", "ACL ALLOW-LOG " + ALLOWED_USER
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT", "ACL ALLOW-LOG " + ALLOWED_USER
                 + " UPDATE USER", "ACL DENY-LOG " + DENIED_USER + " UPDATE USER", "ACL DENY-LOG ALL ALL");
 
         TestBrokerConfiguration brokerConfiguration = getBrokerConfiguration();
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/UserRestACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/UserRestACLTest.java
index 4c4e219695..b4f4d0b4dd 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/UserRestACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/UserRestACLTest.java
@@ -97,8 +97,7 @@ public class UserRestACLTest extends QpidRestTestCase
 
     public void testAddUser() throws Exception
     {
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_GROUP + " CREATE USER",
                 "ACL DENY-LOG " + DENIED_GROUP + " CREATE USER");
 
@@ -122,8 +121,7 @@ public class UserRestACLTest extends QpidRestTestCase
 
     public void testDeleteUser() throws Exception
     {
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_GROUP + " DELETE USER",
                 "ACL DENY-LOG " + DENIED_GROUP + " DELETE USER");
 
@@ -143,8 +141,7 @@ public class UserRestACLTest extends QpidRestTestCase
 
     public void testUpdateUser() throws Exception
     {
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_GROUP + " UPDATE USER",
                 "ACL DENY-LOG " + DENIED_GROUP + " UPDATE USER");