Uploaded image for project: 'AMQ Broker'
  1. AMQ Broker
  2. ENTMQBR-8379

RBAC doesn't work with FQQN.

XMLWordPrintable

    • False
    • None
    • False
    • Hide
      import org.apache.activemq.artemis.core.config.impl.ConfigurationImpl;
      import org.apache.activemq.artemis.core.config.impl.RoleSet;
      import org.apache.activemq.artemis.core.config.impl.SecurityConfiguration;
      import org.apache.activemq.artemis.core.security.Role;
      import org.apache.activemq.artemis.core.server.embedded.EmbeddedActiveMQ;
      import org.apache.activemq.artemis.jms.client.ActiveMQConnectionFactory;
      import org.apache.activemq.artemis.spi.core.security.ActiveMQJAASSecurityManager;
      import org.apache.activemq.artemis.spi.core.security.jaas.InVMLoginModule;
      import org.junit.jupiter.api.BeforeAll;
      import org.junit.jupiter.api.Test;
      import javax.jms.Connection;
      import javax.jms.Destination;
      import javax.jms.MessageProducer;
      import javax.jms.Session;
      
      public class AMQUnitTest {
          @BeforeAll
          public static void setup() throws Exception {
              EmbeddedActiveMQ embeddedActiveMQ = new EmbeddedActiveMQ();
              ConfigurationImpl configuration = new ConfigurationImpl();
              RoleSet roles1 = new RoleSet();
              roles1.add(new Role("test",true,true,true,true,true,true,true,true,true,true));
              RoleSet roles2 = new RoleSet();
              roles2.add(new Role("test",false,false,true,true,true,true,true,true,true,true));
              configuration.addSecurityRole("foo::q1", roles1);
              configuration.addSecurityRole("foo", roles2);
              configuration.setSecurityEnabled(true);
              configuration.addAcceptorConfiguration("artemis","tcp://localhost:61616");
              configuration.setMaxDiskUsage(100);
              embeddedActiveMQ.setConfiguration(configuration);
              ActiveMQJAASSecurityManager securityManager = new ActiveMQJAASSecurityManager(InVMLoginModule.class.getName());
              SecurityConfiguration securityConfiguration = new SecurityConfiguration();
      
              securityConfiguration.addUser("test","test");
              securityConfiguration.addRole("test","test");
              securityConfiguration.getAppConfigurationEntry("activemq");
              securityManager.setConfiguration(securityConfiguration);
              embeddedActiveMQ.setSecurityManager(securityManager);
              embeddedActiveMQ.start();
          }
      
          @Test
          public void sendMessage() throws Exception {
              ActiveMQConnectionFactory connectionFactory = new ActiveMQConnectionFactory();
              connectionFactory.setBrokerURL("tcp://localhost:61616");
              connectionFactory.setUser("test");
              connectionFactory.setPassword("test");
              Connection connection = connectionFactory.createConnection();
              Session session = connection.createSession(false,Session.AUTO_ACKNOWLEDGE);
              Destination destination = session.createQueue("foo::q1");
              MessageProducer messageProducer = session.createProducer(destination);
              messageProducer.send(session.createTextMessage("hi"));
          }
      }
      
      Show
      import org.apache.activemq.artemis.core.config.impl.ConfigurationImpl; import org.apache.activemq.artemis.core.config.impl.RoleSet; import org.apache.activemq.artemis.core.config.impl.SecurityConfiguration; import org.apache.activemq.artemis.core.security.Role; import org.apache.activemq.artemis.core.server.embedded.EmbeddedActiveMQ; import org.apache.activemq.artemis.jms.client.ActiveMQConnectionFactory; import org.apache.activemq.artemis.spi.core.security.ActiveMQJAASSecurityManager; import org.apache.activemq.artemis.spi.core.security.jaas.InVMLoginModule; import org.junit.jupiter.api.BeforeAll; import org.junit.jupiter.api.Test; import javax.jms.Connection; import javax.jms.Destination; import javax.jms.MessageProducer; import javax.jms.Session; public class AMQUnitTest { @BeforeAll public static void setup() throws Exception { EmbeddedActiveMQ embeddedActiveMQ = new EmbeddedActiveMQ(); ConfigurationImpl configuration = new ConfigurationImpl(); RoleSet roles1 = new RoleSet(); roles1.add( new Role( "test" , true , true , true , true , true , true , true , true , true , true )); RoleSet roles2 = new RoleSet(); roles2.add( new Role( "test" , false , false , true , true , true , true , true , true , true , true )); configuration.addSecurityRole( "foo::q1" , roles1); configuration.addSecurityRole( "foo" , roles2); configuration.setSecurityEnabled( true ); configuration.addAcceptorConfiguration( "artemis" , "tcp: //localhost:61616" ); configuration.setMaxDiskUsage(100); embeddedActiveMQ.setConfiguration(configuration); ActiveMQJAASSecurityManager securityManager = new ActiveMQJAASSecurityManager(InVMLoginModule. class. getName()); SecurityConfiguration securityConfiguration = new SecurityConfiguration(); securityConfiguration.addUser( "test" , "test" ); securityConfiguration.addRole( "test" , "test" ); securityConfiguration.getAppConfigurationEntry( "activemq" ); securityManager.setConfiguration(securityConfiguration); embeddedActiveMQ.setSecurityManager(securityManager); embeddedActiveMQ.start(); } @Test public void sendMessage() throws Exception { ActiveMQConnectionFactory connectionFactory = new ActiveMQConnectionFactory(); connectionFactory.setBrokerURL( "tcp: //localhost:61616" ); connectionFactory.setUser( "test" ); connectionFactory.setPassword( "test" ); Connection connection = connectionFactory.createConnection(); Session session = connection.createSession( false ,Session.AUTO_ACKNOWLEDGE); Destination destination = session.createQueue( "foo::q1" ); MessageProducer messageProducer = session.createProducer(destination); messageProducer.send(session.createTextMessage( "hi" )); } }

      Security settings that are configured for a combination of the address::queue don't work.

      <security-setting match="foo::q1"> <permission type="send" roles="test"/> </security-setting>

      If a user with role test tries to send to the fqqn queue (foo:q1), it throws the following error:

      javax.jms.JMSSecurityException: AMQ229032: User: test does not have permission='SEND' on address foo

      Though there is a check in the code, the queue will always be null here:

      https://github.com/apache/activemq-artemis/blob/main/artemis-server/src/main/java/org/apache/activemq/artemis/core/security/impl/SecurityStoreImpl.java#L265

      https://github.com/apache/activemq-artemis/blob/main/artemis-server/src/main/java/org/apache/activemq/artemis/core/security/impl/SecurityStoreImpl.java#L237-L247

              rhn-support-jbertram Justin Bertram
              rhn-support-adongre Avinash Dongre
              Roman Vais Roman Vais (Inactive)
              Votes:
              10 Vote for this issue
              Watchers:
              14 Start watching this issue

                Created:
                Updated:
                Resolved: