Uploaded image for project: 'AMQ Broker'
  1. AMQ Broker
  2. ENTMQBR-3409

JMX/Jolokia addSecuritySettings - permissions are not processed until broker restart

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Major Major
    • AMQ 7.7.0.CR2
    • AMQ 7.4.1.GA, AMQ 7.6.0.GA
    • broker-core, security
    • None
    • +
    • Previously, if you used Jolokia to dynamically set security settings for an address, the broker did not detect the update. Instead, you needed to restart the broker for the changes to take effect. This issue is now resolved.
    • Documented as Resolved Issue
    • Verified in a release
    • Hide

      restart broker

      Show
      restart broker
    • Hide

      Example for creating a user, where role/permissions are not picked up until after restarting broker:

      # test before adding user
$ bin/artemis producer --user myuser --password mypassword --url tcp://localhost:61616 --message-count 1 --message-size 1024 --destination queue://FOO
Connection failed::AMQ229031: Unable to validate user from /127.0.0.1:40966. Username: myuser; SSL certificate subject DN: unavailable

# create anycast address FOO
curl -k --user admin:admin -H "Origin: http://localhost:8161" "http://localhost:8161/console/jolokia/exec/org.apache.activemq.artemis:broker=%220.0.0.0%22/createAddress(java.lang.String,java.lang.String)/FOO/ANYCAST"

# create security settings for address FOO
curl -k --user admin:admin -H "Origin: http://localhost:8161" "http://localhost:8161/console/jolokia/exec/org.apache.activemq.artemis:broker=%220.0.0.0%22/addSecuritySettings(java.lang.String,java.lang.String,java.lang.String,java.lang.String,java.lang.String,java.lang.String,java.lang.String,java.lang.String)/FOO/myrole/myrole/myrole/myrole/myrole/myrole/myrole"

# create user 'myuser' with password 'mypassword'
curl -k --user admin:admin -H "Origin: http://localhost:8161" "http://localhost:8161/console/jolokia/exec/org.apache.activemq.artemis:broker=%220.0.0.0%22/addUser(java.lang.String,java.lang.String,java.lang.String,boolean)/myuser/mypassword//false"

# add role 'myrole' to 'myuser'
curl -k --user admin:admin --user admin:admin -H "Origin: http://localhost:8161" "http://localhost:8161/console/jolokia/exec/org.apache.activemq.artemis:broker=%220.0.0.0%22/resetUser(java.lang.String,java.lang.String,java.lang.String)/myuser/mypassword/myrole"

# check roles
curl -k --user admin:admin --user admin:admin -H "Origin: http://localhost:8161" "http://localhost:8161/console/jolokia/exec/org.apache.activemq.artemis:broker=%220.0.0.0%22/getRoles(java.lang.String)/FOO"

# re-test
$ bin/artemis producer --user myuser --password mypassword --url tcp://localhost:61616 --message-count 1 --message-size 1024 --destination queue://FOO
//User: myuser does not have permission='CREATE_DURABLE_QUEUE' for queue FOO on address FOO]

# restart broker
# re-test
$ bin/artemis producer --user myuser --password mypassword --url tcp://localhost:61616 --message-count 1 --message-size 1024 --destination queue://FOO
//Works!
      Show
      Example for creating a user, where role/permissions are not picked up until after restarting broker: # test before adding user $ bin/artemis producer --user myuser --password mypassword --url tcp: //localhost:61616 --message-count 1 --message-size 1024 --destination queue://FOO Connection failed::AMQ229031: Unable to validate user from /127.0.0.1:40966. Username: myuser; SSL certificate subject DN: unavailable # create anycast address FOO curl -k --user admin:admin -H "Origin: http: //localhost:8161" "http://localhost:8161/console/jolokia/exec/org.apache.activemq.artemis:broker=%220.0.0.0%22/createAddress(java.lang. String ,java.lang. String )/FOO/ANYCAST" # create security settings for address FOO curl -k --user admin:admin -H "Origin: http: //localhost:8161" "http://localhost:8161/console/jolokia/exec/org.apache.activemq.artemis:broker=%220.0.0.0%22/addSecuritySettings(java.lang. String ,java.lang. String ,java.lang. String ,java.lang. String ,java.lang. String ,java.lang. String ,java.lang. String ,java.lang. String )/FOO/myrole/myrole/myrole/myrole/myrole/myrole/myrole" # create user 'myuser' with password 'mypassword' curl -k --user admin:admin -H "Origin: http: //localhost:8161" "http://localhost:8161/console/jolokia/exec/org.apache.activemq.artemis:broker=%220.0.0.0%22/addUser(java.lang. String ,java.lang. String ,java.lang. String , boolean )/myuser/mypassword// false " # add role 'myrole' to 'myuser' curl -k --user admin:admin --user admin:admin -H "Origin: http: //localhost:8161" "http://localhost:8161/console/jolokia/exec/org.apache.activemq.artemis:broker=%220.0.0.0%22/resetUser(java.lang. String ,java.lang. String ,java.lang. String )/myuser/mypassword/myrole" # check roles curl -k --user admin:admin --user admin:admin -H "Origin: http: //localhost:8161" "http://localhost:8161/console/jolokia/exec/org.apache.activemq.artemis:broker=%220.0.0.0%22/getRoles(java.lang. String )/FOO" # re-test $ bin/artemis producer --user myuser --password mypassword --url tcp: //localhost:61616 --message-count 1 --message-size 1024 --destination queue://FOO //User: myuser does not have permission= 'CREATE_DURABLE_QUEUE' for queue FOO on address FOO] # restart broker # re-test $ bin/artemis producer --user myuser --password mypassword --url tcp: //localhost:61616 --message-count 1 --message-size 1024 --destination queue://FOO //Works!

      While users can dynamically set security settings for an address via jolokia, the security settings do not appear to be used until after broker restart.

              rhn-support-jbertram Justin Bertram
              rhn-support-shiggs Stephen Higgs
              Tiago Bueno Tiago Bueno
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: