diff options
Diffstat (limited to 'qpid/java/broker')
8 files changed, 76 insertions, 168 deletions
diff --git a/qpid/java/broker/src/main/java/org/apache/qpid/server/model/adapter/AuthenticationProviderAdapter.java b/qpid/java/broker/src/main/java/org/apache/qpid/server/model/adapter/AuthenticationProviderAdapter.java index 594ef7520a..f788923b3a 100644 --- a/qpid/java/broker/src/main/java/org/apache/qpid/server/model/adapter/AuthenticationProviderAdapter.java +++ b/qpid/java/broker/src/main/java/org/apache/qpid/server/model/adapter/AuthenticationProviderAdapter.java @@ -57,7 +57,6 @@ import org.apache.qpid.server.security.auth.UsernamePrincipal; import org.apache.qpid.server.security.auth.database.PrincipalDatabase; import org.apache.qpid.server.security.auth.manager.AuthenticationManager; import org.apache.qpid.server.security.auth.manager.PrincipalDatabaseAuthenticationManager; -import org.apache.qpid.server.security.group.GroupPrincipalAccessor; import org.apache.qpid.server.security.SecurityManager; public abstract class AuthenticationProviderAdapter<T extends AuthenticationManager> extends AbstractAdapter implements AuthenticationProvider @@ -252,7 +251,7 @@ public abstract class AuthenticationProviderAdapter<T extends AuthenticationMana @Override public SubjectCreator getSubjectCreator() { - return new SubjectCreator(_authManager, new GroupPrincipalAccessor(_broker.getGroupProviders())); + return new SubjectCreator(_authManager, _broker.getGroupProviders()); } @Override diff --git a/qpid/java/broker/src/main/java/org/apache/qpid/server/model/adapter/BrokerAdapter.java b/qpid/java/broker/src/main/java/org/apache/qpid/server/model/adapter/BrokerAdapter.java index ec5a0402b4..e968d91e79 100644 --- a/qpid/java/broker/src/main/java/org/apache/qpid/server/model/adapter/BrokerAdapter.java +++ b/qpid/java/broker/src/main/java/org/apache/qpid/server/model/adapter/BrokerAdapter.java @@ -135,7 +135,7 @@ public class BrokerAdapter extends AbstractAdapter implements Broker, Configurat public static final long DEFAULT_STORE_TRANSACTION_OPEN_TIMEOUT_WARN = 0l; private static final String DEFAULT_KEY_STORE_NAME = "defaultKeyStore"; private static final String DEFAULT_TRUST_STORE_NAME = "defaultTrustStore"; - private static final String DEFAULT_GROUP_PROFIDER_NAME = "defaultGroupProvider"; + private static final String DEFAULT_GROUP_PROVIDER_NAME = "defaultGroupProvider"; private static final String DEFAULT_PEER_STORE_NAME = "defaultPeerStore"; private static final String DUMMY_PASSWORD_MASK = "********"; @@ -238,13 +238,13 @@ public class BrokerAdapter extends AbstractAdapter implements Broker, Configurat { GroupManager groupManager = new FileGroupManager(groupFile); UUID groupProviderId = UUIDGenerator.generateBrokerChildUUID(GroupProvider.class.getSimpleName(), - DEFAULT_GROUP_PROFIDER_NAME); + DEFAULT_GROUP_PROVIDER_NAME); GroupProviderAdapter groupProviderAdapter = new GroupProviderAdapter(groupProviderId, groupManager, this); - _groupProviders.put(DEFAULT_GROUP_PROFIDER_NAME, groupProviderAdapter); + _groupProviders.put(DEFAULT_GROUP_PROVIDER_NAME, groupProviderAdapter); } else { - _groupProviders.remove(DEFAULT_GROUP_PROFIDER_NAME); + _groupProviders.remove(DEFAULT_GROUP_PROVIDER_NAME); } } @@ -1097,12 +1097,6 @@ public class BrokerAdapter extends AbstractAdapter implements Broker, Configurat } } } - - // the calls below are not thread safe but they should be fine in a management mode - // as there will be no user connected - // The new keystore/trustore/peerstore will be only used with new ports - // At the moment we cannot restart ports with new keystore/trustore/peerstore - if (keyStoreChanged) { createKeyStore(); @@ -1155,16 +1149,20 @@ public class BrokerAdapter extends AbstractAdapter implements Broker, Configurat } } Long queueFlowControlSize = (Long) convertedAttributes.get(QUEUE_FLOW_CONTROL_SIZE_BYTES); - if (queueFlowControlSize != null && queueFlowControlSize > 0) + Long queueFlowControlResumeSize = (Long) convertedAttributes.get(QUEUE_FLOW_CONTROL_RESUME_SIZE_BYTES); + if (queueFlowControlSize != null || queueFlowControlResumeSize != null ) { - Long queueFlowControlResumeSize = (Long) convertedAttributes.get(QUEUE_FLOW_CONTROL_RESUME_SIZE_BYTES); + if (queueFlowControlSize == null) + { + queueFlowControlSize = (Long)getAttribute(QUEUE_FLOW_CONTROL_SIZE_BYTES); + } if (queueFlowControlResumeSize == null) { - throw new IllegalConfigurationException("Flow control resume size attribute is not specified with flow control size attribute"); + queueFlowControlResumeSize = (Long)getAttribute(QUEUE_FLOW_CONTROL_RESUME_SIZE_BYTES); } - if (queueFlowControlResumeSize >= queueFlowControlSize) + if (queueFlowControlResumeSize > queueFlowControlSize) { - throw new IllegalConfigurationException("Flow control resume size should be less then flow control size"); + throw new IllegalConfigurationException("Flow resume size can't be greater than flow control size"); } } for (String attributeName : POSITIVE_NUMERIC_ATTRIBUTES) diff --git a/qpid/java/broker/src/main/java/org/apache/qpid/server/model/adapter/GroupProviderAdapter.java b/qpid/java/broker/src/main/java/org/apache/qpid/server/model/adapter/GroupProviderAdapter.java index 0fa834bc28..9ad58f9670 100644 --- a/qpid/java/broker/src/main/java/org/apache/qpid/server/model/adapter/GroupProviderAdapter.java +++ b/qpid/java/broker/src/main/java/org/apache/qpid/server/model/adapter/GroupProviderAdapter.java @@ -538,8 +538,6 @@ public class GroupProviderAdapter extends AbstractAdapter implements return true; } // TODO: DELETE state is ignored for now - // in case if we need to delete group provider, then we need AuthenticationProvider to be a change listener of it - // in order to remove deleted group provider from its group provider list return false; } diff --git a/qpid/java/broker/src/main/java/org/apache/qpid/server/model/adapter/PortAdapter.java b/qpid/java/broker/src/main/java/org/apache/qpid/server/model/adapter/PortAdapter.java index 59a2a50a24..4250de17a7 100644 --- a/qpid/java/broker/src/main/java/org/apache/qpid/server/model/adapter/PortAdapter.java +++ b/qpid/java/broker/src/main/java/org/apache/qpid/server/model/adapter/PortAdapter.java @@ -73,11 +73,6 @@ public class PortAdapter extends AbstractAdapter implements Port private AuthenticationProvider _authenticationProvider; private AtomicReference<State> _state; - /* - * TODO register PortAceptor as a listener. For supporting multiple - * protocols on the same port we need to introduce a special entity like - * PortAceptor which will be responsible for port binding/unbinding - */ public PortAdapter(UUID id, Broker broker, Map<String, Object> attributes, Map<String, Object> defaults, TaskExecutor taskExecutor) { super(id, defaults, MapValueConverter.convert(attributes, ATTRIBUTE_TYPES), taskExecutor); diff --git a/qpid/java/broker/src/main/java/org/apache/qpid/server/security/SubjectCreator.java b/qpid/java/broker/src/main/java/org/apache/qpid/server/security/SubjectCreator.java index 8138745486..213f19dc5c 100644 --- a/qpid/java/broker/src/main/java/org/apache/qpid/server/security/SubjectCreator.java +++ b/qpid/java/broker/src/main/java/org/apache/qpid/server/security/SubjectCreator.java @@ -21,17 +21,21 @@ package org.apache.qpid.server.security; import java.security.Principal; +import java.util.Collection; +import java.util.Collections; +import java.util.HashSet; +import java.util.Set; import javax.security.auth.Subject; import javax.security.sasl.SaslException; import javax.security.sasl.SaslServer; +import org.apache.qpid.server.model.GroupProvider; import org.apache.qpid.server.security.auth.AuthenticatedPrincipal; import org.apache.qpid.server.security.auth.AuthenticationResult; import org.apache.qpid.server.security.auth.AuthenticationResult.AuthenticationStatus; import org.apache.qpid.server.security.auth.SubjectAuthenticationResult; import org.apache.qpid.server.security.auth.manager.AuthenticationManager; -import org.apache.qpid.server.security.group.GroupPrincipalAccessor; /** * Creates a {@link Subject} formed by the {@link Principal}'s returned from: @@ -48,12 +52,12 @@ import org.apache.qpid.server.security.group.GroupPrincipalAccessor; public class SubjectCreator { private AuthenticationManager _authenticationManager; - private GroupPrincipalAccessor _groupAccessor; + private Collection<GroupProvider> _groupProviders; - public SubjectCreator(AuthenticationManager authenticationManager, GroupPrincipalAccessor groupAccessor) + public SubjectCreator(AuthenticationManager authenticationManager, Collection<GroupProvider> groupProviders) { _authenticationManager = authenticationManager; - _groupAccessor = groupAccessor; + _groupProviders = groupProviders; } /** @@ -112,7 +116,7 @@ public class SubjectCreator final Subject authenticationSubject = new Subject(); authenticationSubject.getPrincipals().addAll(authenticationResult.getPrincipals()); - authenticationSubject.getPrincipals().addAll(_groupAccessor.getGroupPrincipals(username)); + authenticationSubject.getPrincipals().addAll(getGroupPrincipals(username)); authenticationSubject.setReadOnly(); @@ -129,9 +133,24 @@ public class SubjectCreator Subject authenticationSubject = new Subject(); authenticationSubject.getPrincipals().add(new AuthenticatedPrincipal(username)); - authenticationSubject.getPrincipals().addAll(_groupAccessor.getGroupPrincipals(username)); + authenticationSubject.getPrincipals().addAll(getGroupPrincipals(username)); authenticationSubject.setReadOnly(); return authenticationSubject; } + + public Set<Principal> getGroupPrincipals(String username) + { + Set<Principal> principals = new HashSet<Principal>(); + for (GroupProvider groupProvider : _groupProviders) + { + Set<Principal> groups = groupProvider.getGroupPrincipalsForUser(username); + if (groups != null) + { + principals.addAll(groups); + } + } + + return Collections.unmodifiableSet(principals); + } } diff --git a/qpid/java/broker/src/main/java/org/apache/qpid/server/security/group/GroupPrincipalAccessor.java b/qpid/java/broker/src/main/java/org/apache/qpid/server/security/group/GroupPrincipalAccessor.java deleted file mode 100644 index 1b8cdc91bc..0000000000 --- a/qpid/java/broker/src/main/java/org/apache/qpid/server/security/group/GroupPrincipalAccessor.java +++ /dev/null @@ -1,52 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.qpid.server.security.group; - -import java.security.Principal; -import java.util.Collection; -import java.util.Collections; -import java.util.HashSet; -import java.util.Set; - -import org.apache.qpid.server.model.GroupProvider; - -public class GroupPrincipalAccessor -{ - private final Collection<GroupProvider> _groupProviders; - - public GroupPrincipalAccessor(Collection<GroupProvider> groupProviders) - { - _groupProviders = groupProviders; - } - - public Set<Principal> getGroupPrincipals(String username) - { - Set<Principal> principals = new HashSet<Principal>(); - for (GroupProvider groupProvider : _groupProviders) - { - Set<Principal> groups = groupProvider.getGroupPrincipalsForUser(username); - if (groups != null) - { - principals.addAll(groups); - } - } - - return Collections.unmodifiableSet(principals); - } -} diff --git a/qpid/java/broker/src/test/java/org/apache/qpid/server/security/SubjectCreatorTest.java b/qpid/java/broker/src/test/java/org/apache/qpid/server/security/SubjectCreatorTest.java index b1bc9bea68..9edd345360 100644 --- a/qpid/java/broker/src/test/java/org/apache/qpid/server/security/SubjectCreatorTest.java +++ b/qpid/java/broker/src/test/java/org/apache/qpid/server/security/SubjectCreatorTest.java @@ -23,19 +23,21 @@ import static org.mockito.Mockito.when; import java.security.Principal; import java.util.Arrays; +import java.util.Collections; import java.util.HashSet; +import java.util.Set; import javax.security.auth.Subject; import javax.security.sasl.SaslServer; import junit.framework.TestCase; +import org.apache.qpid.server.model.GroupProvider; import org.apache.qpid.server.security.auth.AuthenticatedPrincipal; import org.apache.qpid.server.security.auth.AuthenticationResult; import org.apache.qpid.server.security.auth.AuthenticationResult.AuthenticationStatus; import org.apache.qpid.server.security.auth.SubjectAuthenticationResult; import org.apache.qpid.server.security.auth.manager.AuthenticationManager; -import org.apache.qpid.server.security.group.GroupPrincipalAccessor; public class SubjectCreatorTest extends TestCase { @@ -43,13 +45,15 @@ public class SubjectCreatorTest extends TestCase private static final String PASSWORD = "password"; private AuthenticationManager _authenticationManager = mock(AuthenticationManager.class); - private GroupPrincipalAccessor _groupPrincipalAccessor = mock(GroupPrincipalAccessor.class); - private SubjectCreator _subjectCreator = new SubjectCreator(_authenticationManager, _groupPrincipalAccessor); + + private GroupProvider _groupManager1 = mock(GroupProvider.class); + private GroupProvider _groupManager2 = mock(GroupProvider.class); private Principal _userPrincipal = mock(Principal.class); private Principal _group1 = mock(Principal.class); private Principal _group2 = mock(Principal.class); + private SubjectCreator _subjectCreator; private AuthenticationResult _authenticationResult; private SaslServer _testSaslServer = mock(SaslServer.class); private byte[] _saslResponseBytes = PASSWORD.getBytes(); @@ -57,11 +61,12 @@ public class SubjectCreatorTest extends TestCase @Override public void setUp() { + when(_groupManager1.getGroupPrincipalsForUser(USERNAME)).thenReturn(Collections.singleton(_group1)); + when(_groupManager2.getGroupPrincipalsForUser(USERNAME)).thenReturn(Collections.singleton(_group2)); + + _subjectCreator = new SubjectCreator(_authenticationManager, new HashSet<GroupProvider>(Arrays.asList(_groupManager1, _groupManager2))); _authenticationResult = new AuthenticationResult(_userPrincipal); when(_authenticationManager.authenticate(USERNAME, PASSWORD)).thenReturn(_authenticationResult); - - when(_groupPrincipalAccessor.getGroupPrincipals(USERNAME)) - .thenReturn(new HashSet<Principal>(Arrays.asList(_group1, _group2))); } public void testAuthenticateUsernameAndPasswordReturnsSubjectWithUserAndGroupPrincipals() @@ -135,4 +140,30 @@ public class SubjectCreatorTest extends TestCase assertSame(expectedStatus, subjectAuthenticationResult.getStatus()); assertNull(subjectAuthenticationResult.getSubject()); } + + public void testGetGroupPrincipals() + { + getAndAssertGroupPrincipals(_group1, _group2); + } + + public void testGetGroupPrincipalsWhenAGroupManagerReturnsNull() + { + when(_groupManager1.getGroupPrincipalsForUser(USERNAME)).thenReturn(null); + + getAndAssertGroupPrincipals(_group2); + } + + public void testGetGroupPrincipalsWhenAGroupManagerReturnsEmptySet() + { + when(_groupManager2.getGroupPrincipalsForUser(USERNAME)).thenReturn(new HashSet<Principal>()); + + getAndAssertGroupPrincipals(_group1); + } + + private void getAndAssertGroupPrincipals(Principal... expectedGroups) + { + Set<Principal> actualGroupPrincipals = _subjectCreator.getGroupPrincipals(USERNAME); + Set<Principal> expectedGroupPrincipals = new HashSet<Principal>(Arrays.asList(expectedGroups)); + assertEquals(expectedGroupPrincipals, actualGroupPrincipals); + } } diff --git a/qpid/java/broker/src/test/java/org/apache/qpid/server/security/group/GroupPrincipalAccessorTest.java b/qpid/java/broker/src/test/java/org/apache/qpid/server/security/group/GroupPrincipalAccessorTest.java deleted file mode 100644 index e58a1a01f8..0000000000 --- a/qpid/java/broker/src/test/java/org/apache/qpid/server/security/group/GroupPrincipalAccessorTest.java +++ /dev/null @@ -1,80 +0,0 @@ -/* - * Licensed to the Apache Software Foundation (ASF) under one - * or more contributor license agreements. See the NOTICE file - * distributed with this work for additional information - * regarding copyright ownership. The ASF licenses this file - * to you under the Apache License, Version 2.0 (the - * "License"); you may not use this file except in compliance - * with the License. You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ -package org.apache.qpid.server.security.group; - -import static org.mockito.Mockito.mock; -import static org.mockito.Mockito.when; - -import java.security.Principal; -import java.util.Arrays; -import java.util.Collections; -import java.util.HashSet; -import java.util.Set; - -import junit.framework.TestCase; - -import org.apache.qpid.server.model.GroupProvider; - -public class GroupPrincipalAccessorTest extends TestCase -{ - private static final String USERNAME = "username"; - - private GroupProvider _groupManager1 = mock(GroupProvider.class); - private GroupProvider _groupManager2 = mock(GroupProvider.class); - - private Principal _group1 = mock(Principal.class); - private Principal _group2 = mock(Principal.class); - - @Override - public void setUp() - { - when(_groupManager1.getGroupPrincipalsForUser(USERNAME)).thenReturn(Collections.singleton(_group1)); - when(_groupManager2.getGroupPrincipalsForUser(USERNAME)).thenReturn(Collections.singleton(_group2)); - } - - public void testGetGroupPrincipals() - { - getAndAssertGroupPrincipals(_group1, _group2); - } - - public void testGetGroupPrincipalsWhenAGroupManagerReturnsNull() - { - when(_groupManager1.getGroupPrincipalsForUser(USERNAME)).thenReturn(null); - - getAndAssertGroupPrincipals(_group2); - } - - public void testGetGroupPrincipalsWhenAGroupManagerReturnsEmptySet() - { - when(_groupManager2.getGroupPrincipalsForUser(USERNAME)).thenReturn(new HashSet<Principal>()); - - getAndAssertGroupPrincipals(_group1); - } - - private void getAndAssertGroupPrincipals(Principal... expectedGroups) - { - GroupPrincipalAccessor groupPrincipalAccessor = new GroupPrincipalAccessor(Arrays.asList(_groupManager1, _groupManager2)); - - Set<Principal> actualGroupPrincipals = groupPrincipalAccessor.getGroupPrincipals(USERNAME); - - Set<Principal> expectedGroupPrincipals = new HashSet<Principal>(Arrays.asList(expectedGroups)); - - assertEquals(expectedGroupPrincipals, actualGroupPrincipals); - } -} |