From 84d997ffc8c4c94dab6797e6d2b477d15f9e5c86 Mon Sep 17 00:00:00 2001 From: Alex Rudyy Date: Tue, 10 Mar 2015 08:03:38 +0000 Subject: QPID-6436: [Java Broker] Move ACL functionality scattered over the configured objects into SecurityManager and AbstractConfiguredObjects git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1665410 13f79535-47bb-0310-9956-ffa450edef68 --- .../berkeleydb/BDBHARemoteReplicationNodeImpl.java | 24 - .../berkeleydb/BDBHARemoteReplicationNodeTest.java | 9 +- .../replication/BDBHAVirtualHostNodeRestTest.java | 4 +- .../apache/qpid/server/binding/BindingImpl.java | 9 +- .../qpid/server/exchange/AbstractExchange.java | 19 +- .../server/model/AbstractConfiguredObject.java | 144 +++- .../model/adapter/AbstractPluginAdapter.java | 24 - .../qpid/server/model/adapter/BrokerAdapter.java | 30 - .../model/adapter/FileBasedGroupProviderImpl.java | 34 +- .../adapter/FileSystemPreferencesProviderImpl.java | 5 + .../qpid/server/model/port/AbstractPort.java | 24 - .../apache/qpid/server/queue/AbstractQueue.java | 12 - .../qpid/server/queue/QueueConsumerImpl.java | 9 +- .../qpid/server/security/FileKeyStoreImpl.java | 23 - .../qpid/server/security/FileTrustStoreImpl.java | 23 - .../qpid/server/security/NonJavaKeyStoreImpl.java | 25 - .../server/security/NonJavaTrustStoreImpl.java | 25 - .../qpid/server/security/SecurityManager.java | 449 ++++++---- .../server/security/access/ObjectProperties.java | 64 -- .../manager/AbstractAuthenticationManager.java | 24 - ...odelPasswordManagingAuthenticationProvider.java | 35 +- .../server/security/auth/manager/ManagedUser.java | 43 +- .../PrincipalDatabaseAuthenticationManager.java | 72 +- .../server/virtualhost/AbstractVirtualHost.java | 32 +- .../virtualhostnode/AbstractVirtualHostNode.java | 39 - .../qpid/server/exchange/FanoutExchangeTest.java | 19 +- .../qpid/server/exchange/HeadersExchangeTest.java | 18 +- .../apache/qpid/server/model/VirtualHostTest.java | 16 +- .../model/testmodels/hierarchy/TestKitCarImpl.java | 9 + .../testmodels/hierarchy/TestStandardCarImpl.java | 9 + .../testmodels/lifecycle/TestConfiguredObject.java | 9 + .../testmodels/singleton/TestSingletonImpl.java | 10 + .../qpid/server/security/FileKeyStoreTest.java | 13 +- .../qpid/server/security/FileTrustStoreTest.java | 18 +- .../qpid/server/security/SecurityManagerTest.java | 900 +++++++++++++++------ .../apache/qpid/server/util/BrokerTestHelper.java | 5 +- .../virtualhost/AbstractVirtualHostTest.java | 4 +- .../virtualhost/VirtualHostQueueCreationTest.java | 1 - .../AbstractStandardVirtualHostNodeTest.java | 13 +- .../plugins/ACLFileAccessControlProviderImpl.java | 24 - .../security/access/plugins/RuleSetTest.java | 36 +- .../servlet/rest/UserPreferencesServlet.java | 46 +- .../server/jmx/mbeans/VirtualHostManagerMBean.java | 2 +- .../jmx/mbeans/VirtualHostManagerMBeanTest.java | 2 +- 44 files changed, 1274 insertions(+), 1081 deletions(-) (limited to 'qpid/java') diff --git a/qpid/java/bdbstore/src/main/java/org/apache/qpid/server/virtualhostnode/berkeleydb/BDBHARemoteReplicationNodeImpl.java b/qpid/java/bdbstore/src/main/java/org/apache/qpid/server/virtualhostnode/berkeleydb/BDBHARemoteReplicationNodeImpl.java index dfbdce4399..61a2470173 100644 --- a/qpid/java/bdbstore/src/main/java/org/apache/qpid/server/virtualhostnode/berkeleydb/BDBHARemoteReplicationNodeImpl.java +++ b/qpid/java/bdbstore/src/main/java/org/apache/qpid/server/virtualhostnode/berkeleydb/BDBHARemoteReplicationNodeImpl.java @@ -21,10 +21,8 @@ package org.apache.qpid.server.virtualhostnode.berkeleydb; -import java.security.AccessControlException; import java.util.Map; import java.util.Set; -import java.util.concurrent.atomic.AtomicReference; import com.sleepycat.je.rep.MasterStateException; @@ -43,7 +41,6 @@ import org.apache.qpid.server.model.State; import org.apache.qpid.server.model.StateTransition; import org.apache.qpid.server.model.SystemConfig; import org.apache.qpid.server.model.VirtualHostNode; -import org.apache.qpid.server.security.access.Operation; import org.apache.qpid.server.store.berkeleydb.replication.ReplicatedEnvironmentFacade; public class BDBHARemoteReplicationNodeImpl extends AbstractConfiguredObject implements BDBHARemoteReplicationNode @@ -121,27 +118,6 @@ public class BDBHARemoteReplicationNodeImpl extends AbstractConfiguredObject proxyForValidation, - final Set modifiedAttributes) - { - _broker.getSecurityManager().authoriseVirtualHostNode(getName(), Operation.UPDATE); - } - - @Override - protected void authoriseSetDesiredState(State desiredState) throws AccessControlException - { - if(desiredState == State.DELETED) - { - _broker.getSecurityManager().authoriseVirtualHostNode(getName(), Operation.DELETE); - } - else - { - _broker.getSecurityManager().authoriseVirtualHostNode(getName(), Operation.UPDATE); - } - } - @Override public String toString() { diff --git a/qpid/java/bdbstore/src/test/java/org/apache/qpid/server/virtualhostnode/berkeleydb/BDBHARemoteReplicationNodeTest.java b/qpid/java/bdbstore/src/test/java/org/apache/qpid/server/virtualhostnode/berkeleydb/BDBHARemoteReplicationNodeTest.java index 8522a39918..cb9d02c767 100644 --- a/qpid/java/bdbstore/src/test/java/org/apache/qpid/server/virtualhostnode/berkeleydb/BDBHARemoteReplicationNodeTest.java +++ b/qpid/java/bdbstore/src/test/java/org/apache/qpid/server/virtualhostnode/berkeleydb/BDBHARemoteReplicationNodeTest.java @@ -36,7 +36,6 @@ import org.apache.qpid.server.model.ConfiguredObjectFactory; import org.apache.qpid.server.model.VirtualHost; import org.apache.qpid.server.model.VirtualHostNode; import org.apache.qpid.server.security.SecurityManager; -import org.apache.qpid.server.security.access.Operation; import org.apache.qpid.server.store.DurableConfigurationStore; import org.apache.qpid.server.store.berkeleydb.replication.ReplicatedEnvironmentFacade; import org.apache.qpid.server.util.BrokerTestHelper; @@ -106,9 +105,7 @@ public class BDBHARemoteReplicationNodeTest extends QpidTestCase String remoteReplicationName = getName(); BDBHARemoteReplicationNode remoteReplicationNode = createRemoteReplicationNode(remoteReplicationName); - doThrow(new AccessControlException("mocked ACL exception")).when(_mockSecurityManager).authoriseVirtualHostNode( - remoteReplicationName, - Operation.UPDATE); + doThrow(new AccessControlException("mocked ACL exception")).when(_mockSecurityManager).authoriseUpdate(remoteReplicationNode); assertNull(remoteReplicationNode.getDescription()); @@ -130,9 +127,7 @@ public class BDBHARemoteReplicationNodeTest extends QpidTestCase String remoteReplicationName = getName(); BDBHARemoteReplicationNode remoteReplicationNode = createRemoteReplicationNode(remoteReplicationName); - doThrow(new AccessControlException("mocked ACL exception")).when(_mockSecurityManager).authoriseVirtualHostNode( - remoteReplicationName, - Operation.DELETE); + doThrow(new AccessControlException("mocked ACL exception")).when(_mockSecurityManager).authoriseDelete(remoteReplicationNode); assertNull(remoteReplicationNode.getDescription()); diff --git a/qpid/java/bdbstore/systests/src/test/java/org/apache/qpid/server/store/berkeleydb/replication/BDBHAVirtualHostNodeRestTest.java b/qpid/java/bdbstore/systests/src/test/java/org/apache/qpid/server/store/berkeleydb/replication/BDBHAVirtualHostNodeRestTest.java index 45cf9a483c..6d3bacc286 100644 --- a/qpid/java/bdbstore/systests/src/test/java/org/apache/qpid/server/store/berkeleydb/replication/BDBHAVirtualHostNodeRestTest.java +++ b/qpid/java/bdbstore/systests/src/test/java/org/apache/qpid/server/store/berkeleydb/replication/BDBHAVirtualHostNodeRestTest.java @@ -398,9 +398,9 @@ public class BDBHAVirtualHostNodeRestTest extends QpidRestTestCase assertNotNull("Node " + name + " has unexpected lastKnownReplicationId", lastKnownTransactionId); assertTrue("Node " + name + " has unexpected lastKnownReplicationId " + lastKnownTransactionId, lastKnownTransactionId > 0); - Long joinTime = (Long) nodeData.get(BDBHAVirtualHostNode.JOIN_TIME); + Number joinTime = (Number) nodeData.get(BDBHAVirtualHostNode.JOIN_TIME); assertNotNull("Node " + name + " has unexpected joinTime", joinTime); - assertTrue("Node " + name + " has unexpected joinTime " + joinTime, joinTime > 0); + assertTrue("Node " + name + " has unexpected joinTime " + joinTime, joinTime.longValue() > 0); } private void assertActualAndDesiredStates(final String restUrl, diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/binding/BindingImpl.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/binding/BindingImpl.java index 6012e2e8db..c2c0cc77fa 100644 --- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/binding/BindingImpl.java +++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/binding/BindingImpl.java @@ -45,6 +45,7 @@ import org.apache.qpid.server.model.Queue; import org.apache.qpid.server.model.State; import org.apache.qpid.server.model.StateTransition; import org.apache.qpid.server.queue.AMQQueue; +import org.apache.qpid.server.security.SecurityManager; import org.apache.qpid.server.util.StateChangeListener; public class BindingImpl @@ -249,7 +250,7 @@ public class BindingImpl @Override public void validateOnCreate() { - _queue.getVirtualHost().getSecurityManager().authoriseCreateBinding(this); + authoriseCreate(this); AMQQueue queue = getAMQQueue(); Map arguments = getArguments(); @@ -266,4 +267,10 @@ public class BindingImpl } } + @Override + protected SecurityManager getSecurityManager() + { + return _queue.getVirtualHost().getSecurityManager(); + } + } diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/exchange/AbstractExchange.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/exchange/AbstractExchange.java index 0be73a828e..cb026e175b 100644 --- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/exchange/AbstractExchange.java +++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/exchange/AbstractExchange.java @@ -20,7 +20,6 @@ */ package org.apache.qpid.server.exchange; -import java.security.AccessControlException; import java.util.ArrayList; import java.util.Collection; import java.util.Collections; @@ -135,12 +134,6 @@ public abstract class AbstractExchange> }; } - @Override - public void validateOnCreate() - { - _virtualHost.getSecurityManager().authoriseCreateExchange(this); - } - @Override public void onValidate() { @@ -190,8 +183,6 @@ public abstract class AbstractExchange> @Override public void deleteWithChecks() { - _virtualHost.getSecurityManager().authoriseDelete(this); - if(hasReferrers()) { throw new ExchangeIsAlternateException(getName()); @@ -634,7 +625,7 @@ public abstract class AbstractExchange> } // Check access - _virtualHost.getSecurityManager().authoriseUnbind(binding); + authoriseDelete(binding); BindingImpl b = _bindingsMap.remove(new BindingIdentifier(bindingKey,queue)); @@ -755,7 +746,7 @@ public abstract class AbstractExchange> preSetAlternateExchange(); setState(State.DELETED); } - catch (ExchangeIsAlternateException | RequiredExchangeException e) + catch (ExchangeIsAlternateException e) { return; } @@ -869,10 +860,4 @@ public abstract class AbstractExchange> return binding; } - @Override - protected void authoriseSetAttributes(ConfiguredObject modified, Set attributes) throws AccessControlException - { - _virtualHost.getSecurityManager().authoriseUpdate(this); - } - } diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/AbstractConfiguredObject.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/AbstractConfiguredObject.java index 0056f37b9a..e63638213e 100644 --- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/AbstractConfiguredObject.java +++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/AbstractConfiguredObject.java @@ -1036,8 +1036,6 @@ public abstract class AbstractConfiguredObject> im } else { - authoriseSetDesiredState(desiredState); - setAttributes(Collections.singletonMap(DESIRED_STATE, desiredState)); @@ -1544,12 +1542,6 @@ public abstract class AbstractConfiguredObject> im }); } - protected void authoriseSetAttributes(final ConfiguredObject proxyForValidation, - final Set modifiedAttributes) - { - - } - protected void changeAttributes(final Map attributes) { validateChange(createProxyForValidation(attributes), attributes.keySet()); @@ -1608,17 +1600,61 @@ public abstract class AbstractConfiguredObject> im { return (ConfiguredObject) Proxy.newProxyInstance(getClass().getClassLoader(), new Class[]{_bestFitInterface}, - new AttributeGettingHandler(attributes)); + new AttributeGettingHandler(attributes, _attributeTypes, this)); + } + + private ConfiguredObject createProxyForAuthorisation(final Class category, + final Map attributes, + final ConfiguredObject parent, + final ConfiguredObject... otherParents) + { + return (ConfiguredObject) Proxy.newProxyInstance(getClass().getClassLoader(), + new Class[]{category}, + new AuthorisationProxyInvocationHandler(attributes, + getModel().getTypeRegistry().getAttributeTypes(category), + category, parent, otherParents)); + } + + protected final > void authoriseCreateChild(Class childClass, Map attributes, ConfiguredObject... otherParents) throws AccessControlException + { + ConfiguredObject configuredObject = createProxyForAuthorisation(childClass, attributes, this, otherParents); + getSecurityManager().authoriseCreate(configuredObject); + } + + protected final void authoriseCreate(ConfiguredObject object) throws AccessControlException + { + getSecurityManager().authoriseCreate(object); + } + + protected final void authoriseSetAttributes(final ConfiguredObject proxyForValidation, + final Set modifiedAttributes) + { + if (modifiedAttributes.contains(DESIRED_STATE) && State.DELETED.equals(proxyForValidation.getDesiredState())) + { + authoriseDelete(this); + if (modifiedAttributes.size() == 1) + { + // nothing left to authorize + return; + } + } + getSecurityManager().authoriseUpdate(this); } - protected void authoriseSetDesiredState(State desiredState) throws AccessControlException + protected final void authoriseDelete(ConfiguredObject object) { - // allowed by default + getSecurityManager().authoriseDelete(object); } - protected void authoriseCreateChild(Class childClass, Map attributes, ConfiguredObject... otherParents) throws AccessControlException + protected SecurityManager getSecurityManager() { - // allowed by default + Broker broker = getModel().getAncestor(Broker.class, getCategoryClass(), this); + if (broker != null ) + { + return broker.getSecurityManager(); + } + LOGGER.warn("Broker parent is not found for " + getName() + " of type " + getClass()); + return null; } @Override @@ -1903,15 +1939,23 @@ public abstract class AbstractConfiguredObject> im } - private class AttributeGettingHandler implements InvocationHandler + private static class AttributeGettingHandler implements InvocationHandler { - private Map _attributes; + private final Map _attributes; + private final Map> _attributeTypes; + private final ConfiguredObject _configuredObject; - AttributeGettingHandler(final Map modifiedAttributes) + AttributeGettingHandler(final Map modifiedAttributes, Map> attributeTypes, ConfiguredObject configuredObject) { - Map combinedAttributes = new HashMap(getActualAttributes()); + Map combinedAttributes = new HashMap<>(); + if (configuredObject != null) + { + combinedAttributes.putAll(configuredObject.getActualAttributes()); + } combinedAttributes.putAll(modifiedAttributes); _attributes = combinedAttributes; + _attributeTypes = attributeTypes; + _configuredObject = configuredObject; } @Override @@ -1940,16 +1984,26 @@ public abstract class AbstractConfiguredObject> im protected Object getValue(final ConfiguredObjectAttribute attribute) { + Object value; if(attribute.isAutomated()) { - ConfiguredAutomatedAttribute autoAttr = (ConfiguredAutomatedAttribute)attribute; - Object value = _attributes.get(attribute.getName()); - return attribute.convert(value == null && !"".equals(autoAttr.defaultValue()) ? autoAttr.defaultValue() : value , AbstractConfiguredObject.this); + ConfiguredAutomatedAttribute autoAttr = (ConfiguredAutomatedAttribute) attribute; + value = _attributes.get(attribute.getName()); + if (value == null && !"".equals(autoAttr.defaultValue())) + { + value = autoAttr.defaultValue(); + } } else { - return _attributes.get(attribute.getName()); + value = _attributes.get(attribute.getName()); } + return convert(attribute, value); + } + + protected Object convert(ConfiguredObjectAttribute attribute, Object value) + { + return attribute.convert(value, _configuredObject); } private ConfiguredObjectAttribute getAttributeFromMethod(final Method method) @@ -1966,6 +2020,54 @@ public abstract class AbstractConfiguredObject> im } } + private static class AuthorisationProxyInvocationHandler extends AttributeGettingHandler + { + private final Class _category; + private final Map, ConfiguredObject> _parents; + private final ConfiguredObject _parent ; + + AuthorisationProxyInvocationHandler(Map attributes, + Map> attributeTypes, + Class categoryClass, + ConfiguredObject parent, + ConfiguredObject... parents) + { + super(attributes, attributeTypes, null); + _parent = parent; + _category = categoryClass; + _parents = new HashMap<>(); + if (parents != null) + { + for (ConfiguredObject parentObject : parents) + { + _parents.put(parentObject.getCategoryClass(), parentObject); + } + } + _parents.put(parent.getCategoryClass(), parent); + } + + @Override + public Object invoke(final Object proxy, final Method method, final Object[] args) throws Throwable + { + if(method.getName().equals("getParent") && args != null && args.length == 1 && args[0] instanceof Class) + { + Class parentClass = (Class )args[0]; + return _parents.get(parentClass); + } + else if(method.getName().equals("getCategoryClass")) + { + return _category; + } + return super.invoke(proxy, method, args); + } + + @Override + protected Object convert(ConfiguredObjectAttribute attribute, Object value) + { + return attribute.convert(value, _parent); + } + } + protected final static class DuplicateIdException extends IllegalArgumentException { public DuplicateIdException(final ConfiguredObject child) diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/AbstractPluginAdapter.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/AbstractPluginAdapter.java index 3e662fac32..9008705de1 100644 --- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/AbstractPluginAdapter.java +++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/AbstractPluginAdapter.java @@ -20,7 +20,6 @@ */ package org.apache.qpid.server.model.adapter; -import java.security.AccessControlException; import java.util.Collection; import java.util.Collections; import java.util.Map; @@ -30,8 +29,6 @@ import org.apache.qpid.server.model.AbstractConfiguredObject; import org.apache.qpid.server.model.Broker; import org.apache.qpid.server.model.ConfiguredObject; import org.apache.qpid.server.model.Plugin; -import org.apache.qpid.server.model.State; -import org.apache.qpid.server.security.access.Operation; public abstract class AbstractPluginAdapter> extends AbstractConfiguredObject implements Plugin { @@ -70,27 +67,6 @@ public abstract class AbstractPluginAdapter> extends Abstrac return Collections.emptyList(); } - @Override - protected void authoriseSetDesiredState(State desiredState) throws AccessControlException - { - if(desiredState == State.DELETED) - { - if (!_broker.getSecurityManager().authoriseConfiguringBroker(getName(), Plugin.class, Operation.DELETE)) - { - throw new AccessControlException("Deletion of plugin is denied"); - } - } - } - - @Override - protected void authoriseSetAttributes(ConfiguredObject modified, Set attributes) throws AccessControlException - { - if (!_broker.getSecurityManager().authoriseConfiguringBroker(getName(), Plugin.class, Operation.UPDATE)) - { - throw new AccessControlException("Setting of plugin attributes is denied"); - } - } - protected Broker getBroker() { return _broker; diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/BrokerAdapter.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/BrokerAdapter.java index 28eea21093..be1d6ebf59 100644 --- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/BrokerAdapter.java +++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/BrokerAdapter.java @@ -51,7 +51,6 @@ import org.apache.qpid.server.plugin.ConfigurationSecretEncrypterFactory; import org.apache.qpid.server.plugin.PluggableFactoryLoader; import org.apache.qpid.server.security.SecurityManager; import org.apache.qpid.server.security.SubjectCreator; -import org.apache.qpid.server.security.access.Operation; import org.apache.qpid.server.security.auth.manager.SimpleAuthenticationManager; import org.apache.qpid.server.stats.StatisticsCounter; import org.apache.qpid.server.stats.StatisticsGatherer; @@ -877,35 +876,6 @@ public class BrokerAdapter extends AbstractConfiguredObject imple return children; } - @Override - protected void authoriseCreateChild(Class childClass, Map attributes, - ConfiguredObject... otherParents) throws AccessControlException - { - if (childClass == VirtualHostNode.class) - { - _securityManager.authoriseVirtualHostNode(String.valueOf(attributes.get(NAME)), Operation.CREATE); - - } - else - { - if (!_securityManager.authoriseConfiguringBroker(String.valueOf(attributes.get(NAME)), - childClass, - Operation.CREATE)) - { - throw new AccessControlException("Creation of new broker level entity is denied"); - } - } - } - - @Override - protected void authoriseSetAttributes(ConfiguredObject modified, Set attributes) throws AccessControlException - { - if (!_securityManager.authoriseConfiguringBroker(getName(), Broker.class, Operation.UPDATE)) - { - throw new AccessControlException("Setting of broker attributes is denied"); - } - } - @Override public boolean isManagementMode() { diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/FileBasedGroupProviderImpl.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/FileBasedGroupProviderImpl.java index 327b7ddfe9..fda8a6f2e9 100644 --- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/FileBasedGroupProviderImpl.java +++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/FileBasedGroupProviderImpl.java @@ -21,7 +21,6 @@ package org.apache.qpid.server.model.adapter; import java.io.File; import java.io.IOException; -import java.security.AccessControlException; import java.security.Principal; import java.util.ArrayList; import java.util.Collection; @@ -47,7 +46,6 @@ import org.apache.qpid.server.model.ManagedObjectFactoryConstructor; import org.apache.qpid.server.model.State; import org.apache.qpid.server.model.StateTransition; import org.apache.qpid.server.security.SecurityManager; -import org.apache.qpid.server.security.access.Operation; import org.apache.qpid.server.security.auth.UsernamePrincipal; import org.apache.qpid.server.security.group.FileGroupDatabase; import org.apache.qpid.server.security.group.GroupPrincipal; @@ -215,8 +213,6 @@ public class FileBasedGroupProviderImpl { String groupName = (String) attributes.get(Group.NAME); - getSecurityManager().authoriseGroupOperation(Operation.CREATE, groupName); - if (getState() != State.ACTIVE) { throw new IllegalConfigurationException(String.format("Group provider '%s' is not activated. Cannot create a group.", getName())); @@ -258,8 +254,8 @@ public class FileBasedGroupProviderImpl } } - - private SecurityManager getSecurityManager() + @Override + protected SecurityManager getSecurityManager() { return _broker.getSecurityManager(); } @@ -337,27 +333,6 @@ public class FileBasedGroupProviderImpl // no-op, as per above, groups are not in the store } - @Override - protected void authoriseSetDesiredState(State desiredState) throws AccessControlException - { - if(desiredState == State.DELETED) - { - if (!_broker.getSecurityManager().authoriseConfiguringBroker(getName(), GroupProvider.class, Operation.DELETE)) - { - throw new AccessControlException("Deletion of groups provider is denied"); - } - } - } - - @Override - protected void authoriseSetAttributes(ConfiguredObject modified, Set attributes) throws AccessControlException - { - if (!_broker.getSecurityManager().authoriseConfiguringBroker(getName(), GroupProvider.class, Operation.UPDATE)) - { - throw new AccessControlException("Setting of group provider attributes is denied"); - } - } - private class GroupAdapter extends AbstractConfiguredObject implements Group { private GroupPrincipal _groupPrincipal; @@ -440,8 +415,6 @@ public class FileBasedGroupProviderImpl { String memberName = (String) attributes.get(GroupMember.NAME); - getSecurityManager().authoriseGroupOperation(Operation.UPDATE, getName()); - _groupDatabase.addUserToGroup(memberName, getName()); UUID id = UUID.randomUUID(); Map attrMap = new HashMap(); @@ -461,7 +434,6 @@ public class FileBasedGroupProviderImpl @StateTransition( currentState = State.ACTIVE, desiredState = State.DELETED ) private void doDelete() { - getSecurityManager().authoriseGroupOperation(Operation.DELETE, getName()); _groupDatabase.removeGroup(getName()); deleted(); setState(State.DELETED); @@ -530,8 +502,6 @@ public class FileBasedGroupProviderImpl @StateTransition(currentState = State.ACTIVE, desiredState = State.DELETED) private void doDelete() { - getSecurityManager().authoriseGroupOperation(Operation.UPDATE, GroupAdapter.this.getName()); - _groupDatabase.removeUserFromGroup(getName(), GroupAdapter.this.getName()); deleted(); setState(State.DELETED); diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/FileSystemPreferencesProviderImpl.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/FileSystemPreferencesProviderImpl.java index 7046f2973e..2b77b0d2a9 100644 --- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/FileSystemPreferencesProviderImpl.java +++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/FileSystemPreferencesProviderImpl.java @@ -211,6 +211,7 @@ public class FileSystemPreferencesProviderImpl @Override public Map getPreferences(String userId) { + getSecurityManager().authoriseUserUpdate(userId); return _store == null? Collections.emptyMap() : _store.getPreferences(userId); } @@ -233,6 +234,10 @@ public class FileSystemPreferencesProviderImpl throw new IllegalStateException("Cannot delete preferences with preferences provider " + getName() + " in state " + getState() ); } + for (String userId: userIDs) + { + getSecurityManager().authoriseUserUpdate(userId); + } return _store.deletePreferences(userIDs); } diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/port/AbstractPort.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/port/AbstractPort.java index 21827ffe58..791bbe4dd3 100644 --- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/port/AbstractPort.java +++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/port/AbstractPort.java @@ -21,7 +21,6 @@ package org.apache.qpid.server.model.port; -import java.security.AccessControlException; import java.util.ArrayList; import java.util.Collection; import java.util.HashSet; @@ -43,7 +42,6 @@ import org.apache.qpid.server.model.State; import org.apache.qpid.server.model.StateTransition; import org.apache.qpid.server.model.Transport; import org.apache.qpid.server.model.TrustStore; -import org.apache.qpid.server.security.access.Operation; abstract public class AbstractPort> extends AbstractConfiguredObject implements Port { @@ -261,28 +259,6 @@ abstract public class AbstractPort> extends AbstractCo return State.ACTIVE; } - - @Override - protected void authoriseSetDesiredState(State desiredState) throws AccessControlException - { - if(desiredState == State.DELETED) - { - if (!_broker.getSecurityManager().authoriseConfiguringBroker(getName(), Port.class, Operation.DELETE)) - { - throw new AccessControlException("Deletion of port is denied"); - } - } - } - - @Override - protected void authoriseSetAttributes(ConfiguredObject modified, Set attributes) throws AccessControlException - { - if (!_broker.getSecurityManager().authoriseConfiguringBroker(getName(), Port.class, Operation.UPDATE)) - { - throw new AccessControlException("Setting of port attributes is denied"); - } - } - @Override public Collection getEnabledCipherSuites() { diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/queue/AbstractQueue.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/queue/AbstractQueue.java index b85377e2a7..04d5fef462 100644 --- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/queue/AbstractQueue.java +++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/queue/AbstractQueue.java @@ -267,12 +267,6 @@ public abstract class AbstractQueue> } - @Override - protected void validateOnCreate() - { - _virtualHost.getSecurityManager().authoriseCreateQueue(this); - } - @Override protected void onCreate() { @@ -3006,12 +3000,6 @@ public abstract class AbstractQueue> } } - @Override - protected void authoriseSetAttributes(ConfiguredObject modified, Set attributes) throws AccessControlException - { - _virtualHost.getSecurityManager().authoriseUpdate(this); - } - int getMaxAsyncDeliveries() { return _maxAsyncDeliveries; diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/queue/QueueConsumerImpl.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/queue/QueueConsumerImpl.java index 6b02a84e83..12ab353c8a 100644 --- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/queue/QueueConsumerImpl.java +++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/queue/QueueConsumerImpl.java @@ -51,6 +51,7 @@ import org.apache.qpid.server.model.ManagedAttributeField; import org.apache.qpid.server.model.State; import org.apache.qpid.server.protocol.AMQSessionModel; import org.apache.qpid.server.protocol.MessageConverterRegistry; +import org.apache.qpid.server.security.SecurityManager; import org.apache.qpid.server.util.StateChangeListener; class QueueConsumerImpl @@ -126,7 +127,7 @@ class QueueConsumerImpl _queue = queue; // Access control - _queue.getVirtualHost().getSecurityManager().authoriseCreateConsumer(this); + authoriseCreate(this); open(); @@ -145,6 +146,12 @@ class QueueConsumerImpl _target.addStateListener(_listener); } + @Override + protected SecurityManager getSecurityManager() + { + return _queue.getVirtualHost().getSecurityManager(); + } + private static Map createAttributeMap(String name, FilterManager filters, EnumSet