@Override public void send(ProducerBrokerExchange producerExchange, Message messageSend) throws Exception { final SecurityContext securityContext = checkSecurityContext(producerExchange.getConnectionContext()); if (!securityContext.isBrokerContext() && !securityContext.getAuthorizedWriteDests().containsValue(messageSend.getDestination())) { Set<?> allowedACLs = null; if (!messageSend.getDestination().isTemporary()) { allowedACLs = authorizationMap.getWriteACLs(messageSend.getDestination()); } else { allowedACLs = authorizationMap.getTempDestinationWriteACLs(); } if (allowedACLs != null && !securityContext.isInOneOf(allowedACLs)) { throw new SecurityException("User " + securityContext.getUserName() + " is not authorized to write to: " + messageSend.getDestination()); } securityContext.getAuthorizedWriteDests().put(messageSend.getDestination(), messageSend.getDestination()); } super.send(producerExchange, messageSend); }
public boolean isInOneOf(Set<?> allowedPrincipals) { Iterator<?> allowedIter = allowedPrincipals.iterator(); HashSet<?> userPrincipals = new HashSet<Object>(getPrincipals()); while (allowedIter.hasNext()) { Iterator<?> userIter = userPrincipals.iterator(); Object allowedPrincipal = allowedIter.next(); while (userIter.hasNext()) { if (allowedPrincipal.equals(userIter.next())) return true; } } return false; }
@Override public void removeDestination(ConnectionContext context, ActiveMQDestination destination, long timeout) throws Exception { final SecurityContext securityContext = checkSecurityContext(context); if (!checkDestinationAdmin(securityContext, destination)) { throw new SecurityException("User " + securityContext.getUserName() + " is not authorized to remove: " + destination); } securityContext.getAuthorizedWriteDests().remove(destination); super.removeDestination(context, destination, timeout); }
protected boolean checkDestinationAdmin(SecurityContext securityContext, ActiveMQDestination destination) { Destination existing = this.getDestinationMap(destination).get(destination); if (existing != null) { return true; } if (!securityContext.isBrokerContext()) { Set<?> allowedACLs = null; if (!destination.isTemporary()) { allowedACLs = authorizationMap.getAdminACLs(destination); } else { allowedACLs = authorizationMap.getTempDestinationAdminACLs(); } if (allowedACLs != null && !securityContext.isInOneOf(allowedACLs)) { return false; } } return true; }
@Override public void addSubscription(ConnectionContext context, Subscription sub) throws Exception { // authorize subscription final SecurityContext securityContext = broker.checkSecurityContext(context); final AuthorizationMap authorizationMap = broker.getAuthorizationMap(); // use the destination being filtered, instead of the destination from the consumerinfo in the subscription // since that could be a wildcard destination final ActiveMQDestination destination = next.getActiveMQDestination(); Set<?> allowedACLs; if (!destination.isTemporary()) { allowedACLs = authorizationMap.getReadACLs(destination); } else { allowedACLs = authorizationMap.getTempDestinationReadACLs(); } if (!securityContext.isBrokerContext() && allowedACLs != null && !securityContext.isInOneOf(allowedACLs) ) { throw new SecurityException("User " + securityContext.getUserName() + " is not authorized to read from: " + destination); } super.addSubscription(context, sub); }
public boolean handleUserInRole(boolean addition, URI user, URI role) throws BocaException { for (SecurityContext sec : securityContexts) { if (sec.getUserName().equals(user)) { if (addition) { sec.getPrincipals().add(role.toString()); } else { sec.getPrincipals().remove(role.toString()); } sec.getAuthorizedReadDests().clear(); sec.getAuthorizedWriteDests().clear(); } } return true; }
private boolean isBrokerContext(ConnectionContext context) { return context.getSecurityContext() != null && context.getSecurityContext().isBrokerContext(); }
public String getUserName() { if (certs != null && certs.length > 0) { return certs[0].getSubjectDN().getName(); } return super.getUserName(); }
public void send(ConnectionContext context, Message messageSend) throws Exception { SecurityContext subject = context.getSecurityContext(); if (subject == null) throw new SecurityException("User is not authenticated."); if (!subject.getAuthorizedWriteDests().contains(messageSend.getDestination())) { if (messageSend.getDestination().getPhysicalName().equals(Constants.NOTIFICATION_UPDATES_QUEUE)) { if (!subject.getPrincipals().contains(Constants.defaultSystemRole)) { throw new SecurityException("User " + subject.getUserName() + " is not authorized to write to: " + messageSend.getDestination()); } } else if (messageSend.getDestination().getPhysicalName().equals(Constants.NOTIFICATION_CONTROL_QUEUE)) { } subject.getAuthorizedWriteDests().put(messageSend.getDestination(), messageSend.getDestination()); } super.send(context, messageSend); }
if (!subject.isBrokerContext() && allowedACLs != null && !subject.isInOneOf(allowedACLs)) { throw new SecurityException("User " + subject.getUserName() + " is not authorized to read from: " + info.getDestination()); subject.getAuthorizedReadDests().put(info.getDestination(), info.getDestination());
public boolean handleAci(boolean addition, URI namedGraph, URI acl, URI role, Boolean canRead, Boolean canUpdate, Boolean canDelete, Boolean canInsert, Boolean canRemove, Boolean canChangeAcl) throws BocaException { for (SecurityContext sec : securityContexts) { for (Iterator<String> iter = sec.getPrincipals().iterator(); iter.hasNext();) { String principal = iter.next(); if (principal.equals(role)) { if (canRead) { sec.getAuthorizedReadDests().clear(); sec.getAuthorizedWriteDests().clear(); } } } } return true; }
public boolean handleUser(boolean addition, URI user, URI defaultRole, URI defaultAclTemplate, String userId,String password) throws BocaException { SecurityContext sc = userSecurityContextMap.get(user.toString()); if (sc != null) { if (!addition) { Set<ConnectionContext> conns = userConnection.get(sc.getUserName()); if (conns != null) { for (Iterator<ConnectionContext> iter = conns.iterator(); iter.hasNext();) { ConnectionContext con = iter.next(); try { ConnectionError cmd = new ConnectionError(); cmd.setException(new Exception("user removed")); con.getConnection().dispatchSync(cmd); } catch (Exception e) { } if (securityContexts.remove(con.getSecurityContext())) { con.setSecurityContext(null); } } } } else { sc.getAuthorizedReadDests().clear(); sc.getAuthorizedWriteDests().clear(); } } return true; }
public void refresh() { for (SecurityContext sc : securityContexts) { sc.getAuthorizedWriteDests().clear(); } } }
public Destination addDestination(ConnectionContext context, ActiveMQDestination destination) throws Exception { final SecurityContext securityContext = context.getSecurityContext(); if (securityContext == null) throw new SecurityException("User is not authenticated."); // You don't need to be an admin to create temp destinations. if (!destination.isTemporary() || !((ActiveMQTempDestination) destination).getConnectionId().equals(context.getConnectionId().getValue())) { if (destination.getPhysicalName().equals(Constants.NOTIFICATION_UPDATES_QUEUE) || destination.getPhysicalName().equals(Constants.NOTIFICATION_CONTROL_QUEUE)) { if (!securityContext.getPrincipals().contains(Constants.defaultSystemRole)) { throw new SecurityException("User " + securityContext.getUserName() + " is not authorized to create: " + destination); } } } return super.addDestination(context, destination); }
public Subscription addConsumer(ConnectionContext context, ConsumerInfo info) throws Exception { final SecurityContext subject = context.getSecurityContext(); if (subject == null) throw new SecurityException("User is not authenticated."); if (info.getDestination().getPhysicalName().equals(Constants.NOTIFICATION_UPDATES_QUEUE)) { if (!subject.getPrincipals().contains(Constants.defaultSystemRole)) { throw new SecurityException("User " + subject.getUserName() + " is not authorized to read from: " + info.getDestination()); } } else if (info.getDestination().getPhysicalName().equals(Constants.NOTIFICATION_CONTROL_QUEUE)) { if (!subject.getPrincipals().contains(Constants.defaultSystemRole)) { throw new SecurityException("User " + subject.getUserName() + " is not authorized to read from: " + info.getDestination()); } } if (info.getDestination().isTemporary() && !((ActiveMQTempDestination) info.getDestination()).getConnectionId().equals(context.getConnectionId().getValue())) { throw new SecurityException("User " + subject.getUserName() + " is not authorized to read from: " + info.getDestination()); } subject.getAuthorizedReadDests().put(info.getDestination(), info.getDestination()); return super.addConsumer(context, info); }
/** * Previously logged in users may no longer have the same access anymore. Refresh all the logged into users. */ public void refresh() { for (Iterator iter = securityContexts.iterator(); iter.hasNext();) { SecurityContext sc = (SecurityContext) iter.next(); sc.getAuthorizedReadDests().clear(); sc.getAuthorizedWriteDests().clear(); } }
if (!securityContext.isBrokerContext() && allowedACLs != null && !securityContext.isInOneOf(allowedACLs) ) { throw new SecurityException("User " + securityContext.getUserName() + " is not authorized to read from: " + info.getDestination());
@Override public void removeDestinationInfo(ConnectionContext context, DestinationInfo info) throws Exception { final SecurityContext securityContext = checkSecurityContext(context); if (!checkDestinationAdmin(securityContext, info.getDestination())) { throw new SecurityException("User " + securityContext.getUserName() + " is not authorized to remove: " + info.getDestination()); } securityContext.getAuthorizedWriteDests().remove(info.getDestination()); super.removeDestinationInfo(context, info); }
if (context.getSecurityContext() == null || !context.getSecurityContext().isBrokerContext()) { adminContext = BrokerSupport.getConnectionContext(this);
protected boolean checkDestinationAdmin(SecurityContext securityContext, ActiveMQDestination destination) { Destination existing = this.getDestinationMap(destination).get(destination); if (existing != null) { return true; } if (!securityContext.isBrokerContext()) { Set<?> allowedACLs = null; if (!destination.isTemporary()) { allowedACLs = authorizationMap.getAdminACLs(destination); } else { allowedACLs = authorizationMap.getTempDestinationAdminACLs(); } if (allowedACLs != null && !securityContext.isInOneOf(allowedACLs)) { return false; } } return true; }