QPID-5562 : [Java Broker] make all failed ACL checks throw AccessControlException

git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1569552 13f79535-47bb-0310-9956-ffa450edef68

24 files changed, 139 insertions, 170 deletions

diff --git a/qpid/java/broker-plugins/amqp-0-10-protocol/src/main/java/org/apache/qpid/server/protocol/v0_10/ServerConnectionDelegate.java b/qpid/java/broker-plugins/amqp-0-10-protocol/src/main/java/org/apache/qpid/server/protocol/v0_10/ServerConnectionDelegate.java
index dc26249c61..13c7e7bcd3 100644
--- a/qpid/java/broker-plugins/amqp-0-10-protocol/src/main/java/org/apache/qpid/server/protocol/v0_10/ServerConnectionDelegate.java
+++ b/qpid/java/broker-plugins/amqp-0-10-protocol/src/main/java/org/apache/qpid/server/protocol/v0_10/ServerConnectionDelegate.java
@@ -20,6 +20,7 @@
  */
 package org.apache.qpid.server.protocol.v0_10;
 
+import java.security.AccessControlException;
 import java.security.Principal;
 import java.util.ArrayList;
 import java.util.Collection;
@@ -195,12 +196,18 @@ public class ServerConnectionDelegate extends ServerDelegate
         {
             sconn.setVirtualHost(vhost);
 
-            if (!vhost.getSecurityManager().accessVirtualhost(vhostName, sconn.getRemoteAddress()))
+            try
+            {
+                vhost.getSecurityManager().accessVirtualhost(vhostName, sconn.getRemoteAddress());
+            }
+            catch (AccessControlException e)
             {
                 sconn.setState(Connection.State.CLOSING);
-                sconn.invoke(new ConnectionClose(ConnectionCloseCode.CONNECTION_FORCED, "Permission denied '"+vhostName+"'"));
+                sconn.invoke(new ConnectionClose(ConnectionCloseCode.CONNECTION_FORCED, e.getMessage()));
+                return;
             }
-            else if (vhost.getState() != State.ACTIVE)
+
+            if (vhost.getState() != State.ACTIVE)
             {
                 sconn.setState(Connection.State.CLOSING);
                 sconn.invoke(new ConnectionClose(ConnectionCloseCode.CONNECTION_FORCED, "Virtual host '"+vhostName+"' is not active"));
diff --git a/qpid/java/broker-plugins/amqp-0-10-protocol/src/main/java/org/apache/qpid/server/protocol/v0_10/ServerSessionDelegate.java b/qpid/java/broker-plugins/amqp-0-10-protocol/src/main/java/org/apache/qpid/server/protocol/v0_10/ServerSessionDelegate.java
index b0a60beaf5..d39ca73136 100644
--- a/qpid/java/broker-plugins/amqp-0-10-protocol/src/main/java/org/apache/qpid/server/protocol/v0_10/ServerSessionDelegate.java
+++ b/qpid/java/broker-plugins/amqp-0-10-protocol/src/main/java/org/apache/qpid/server/protocol/v0_10/ServerSessionDelegate.java
@@ -20,6 +20,7 @@
  */
 package org.apache.qpid.server.protocol.v0_10;
 
+import java.security.AccessControlException;
 import java.util.EnumSet;
 import java.util.LinkedHashMap;
 import java.util.UUID;
@@ -44,7 +45,6 @@ import org.apache.qpid.server.model.UUIDGenerator;
 import org.apache.qpid.server.plugin.ExchangeType;
 import org.apache.qpid.server.queue.AMQQueue;
 import org.apache.qpid.server.queue.QueueArgumentsConverter;
-import org.apache.qpid.server.security.QpidSecurityException;
 import org.apache.qpid.server.security.SecurityManager;
 import org.apache.qpid.server.store.DurableConfigurationStore;
 import org.apache.qpid.server.store.MessageStore;
@@ -61,7 +61,6 @@ import org.apache.qpid.server.txn.ServerTransaction;
 import org.apache.qpid.server.txn.SuspendAndFailDtxException;
 import org.apache.qpid.server.txn.TimeoutDtxException;
 import org.apache.qpid.server.txn.UnknownDtxBranchException;
-import org.apache.qpid.server.util.Action;
 import org.apache.qpid.server.virtualhost.ExchangeExistsException;
 import org.apache.qpid.server.virtualhost.ExchangeIsAlternateException;
 import org.apache.qpid.server.virtualhost.RequiredExchangeException;
@@ -265,7 +264,7 @@ public class ServerSessionDelegate extends SessionDelegate
                     {
                         exception(session, method, ExecutionErrorCode.RESOURCE_LOCKED, "Queue has an existing consumer - can't subscribe exclusively");
                     }
-                    catch (QpidSecurityException e)
+                    catch (AccessControlException e)
                     {
                         exception(session, method, ExecutionErrorCode.UNAUTHORIZED_ACCESS, e.getMessage());
                     }
@@ -291,11 +290,14 @@ public class ServerSessionDelegate extends SessionDelegate
 
         final MessageMetaData_0_10 messageMetaData = new MessageMetaData_0_10(xfr);
 
-        if (!getVirtualHost(ssn).getSecurityManager().authorisePublish(messageMetaData.isImmediate(), messageMetaData.getRoutingKey(), exchange.getName()))
+        try
+        {
+            getVirtualHost(ssn).getSecurityManager().authorisePublish(messageMetaData.isImmediate(), messageMetaData.getRoutingKey(), exchange.getName());
+        }
+        catch (AccessControlException e)
         {
             ExecutionErrorCode errorCode = ExecutionErrorCode.UNAUTHORIZED_ACCESS;
-            String description = "Permission denied: exchange-name '" + exchange.getName() + "'";
-            exception(ssn, xfr, errorCode, description);
+            exception(ssn, xfr, errorCode, e.getMessage());
 
             return;
         }
@@ -749,7 +751,7 @@ public class ServerSessionDelegate extends SessionDelegate
                                     + " to " + method.getAlternateExchange() +".");
                 }
             }
-            catch (QpidSecurityException e)
+            catch (AccessControlException e)
             {
                 exception(session, method, ExecutionErrorCode.UNAUTHORIZED_ACCESS, e.getMessage());
             }
@@ -841,7 +843,7 @@ public class ServerSessionDelegate extends SessionDelegate
         {
             exception(session, method, ExecutionErrorCode.NOT_ALLOWED, "Exchange '"+method.getExchange()+"' cannot be deleted");
         }
-        catch (QpidSecurityException e)
+        catch (AccessControlException e)
         {
             exception(session, method, ExecutionErrorCode.UNAUTHORIZED_ACCESS, e.getMessage());
         }
@@ -935,7 +937,7 @@ public class ServerSessionDelegate extends SessionDelegate
                     {
                         exchange.addBinding(method.getBindingKey(), queue, method.getArguments());
                     }
-                    catch (QpidSecurityException e)
+                    catch (AccessControlException e)
                     {
                         exception(session, method, ExecutionErrorCode.UNAUTHORIZED_ACCESS, e.getMessage());
                     }
@@ -988,7 +990,7 @@ public class ServerSessionDelegate extends SessionDelegate
                 {
                     exchange.removeBinding(method.getBindingKey(), queue, null);
                 }
-                catch (QpidSecurityException e)
+                catch (AccessControlException e)
                 {
                     exception(session, method, ExecutionErrorCode.UNAUTHORIZED_ACCESS, e.getMessage());
                 }
@@ -1236,7 +1238,7 @@ public class ServerSessionDelegate extends SessionDelegate
                     exception(session, method, errorCode, description);
                 }
             }
-            catch (QpidSecurityException e)
+            catch (AccessControlException e)
             {
                 exception(session, method, ExecutionErrorCode.UNAUTHORIZED_ACCESS, e.getMessage());
             }
@@ -1309,7 +1311,7 @@ public class ServerSessionDelegate extends SessionDelegate
                     {
                         virtualHost.removeQueue(queue);
                     }
-                    catch (QpidSecurityException e)
+                    catch (AccessControlException e)
                     {
                         exception(session, method, ExecutionErrorCode.UNAUTHORIZED_ACCESS, e.getMessage());
                     }
@@ -1340,7 +1342,7 @@ public class ServerSessionDelegate extends SessionDelegate
                 {
                     queue.clearQueue();
                 }
-                catch (QpidSecurityException e)
+                catch (AccessControlException e)
                 {
                     exception(session, method, ExecutionErrorCode.UNAUTHORIZED_ACCESS, e.getMessage());
                 }
diff --git a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/AMQChannel.java b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/AMQChannel.java
index fe1cb624e5..0146d066f1 100644
--- a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/AMQChannel.java
+++ b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/AMQChannel.java
@@ -21,6 +21,7 @@
 package org.apache.qpid.server.protocol.v0_8;
 
 import java.nio.ByteBuffer;
+import java.security.AccessControlException;
 import java.util.*;
 import java.util.concurrent.CopyOnWriteArrayList;
 import java.util.concurrent.atomic.AtomicBoolean;
@@ -33,7 +34,6 @@ import org.apache.qpid.AMQException;
 import org.apache.qpid.server.filter.AMQInvalidArgumentException;
 import org.apache.qpid.server.filter.Filterable;
 import org.apache.qpid.server.filter.MessageFilter;
-import org.apache.qpid.server.security.QpidSecurityException;
 import org.apache.qpid.common.AMQPFilterTypes;
 import org.apache.qpid.framing.AMQMethodBody;
 import org.apache.qpid.framing.AMQShortString;
@@ -50,7 +50,6 @@ import org.apache.qpid.server.configuration.BrokerProperties;
 import org.apache.qpid.server.exchange.Exchange;
 import org.apache.qpid.server.filter.FilterManager;
 import org.apache.qpid.server.filter.FilterManagerFactory;
-import org.apache.qpid.server.filter.FilterSupport;
 import org.apache.qpid.server.filter.SimpleFilterManager;
 import org.apache.qpid.server.flow.FlowCreditManager;
 import org.apache.qpid.server.flow.Pre0_10CreditManager;
@@ -70,7 +69,6 @@ import org.apache.qpid.server.message.MessageSource;
 import org.apache.qpid.server.message.ServerMessage;
 import org.apache.qpid.server.protocol.CapacityChecker;
 import org.apache.qpid.server.protocol.v0_8.output.ProtocolOutputConverter;
-import org.apache.qpid.server.protocol.AMQConnectionModel;
 import org.apache.qpid.server.protocol.AMQSessionModel;
 import org.apache.qpid.server.queue.AMQQueue;
 import org.apache.qpid.server.queue.QueueEntry;
@@ -279,14 +277,13 @@ public class AMQChannel<T extends AMQProtocolSession<T>>
         return _channelId;
     }
 
-    public void setPublishFrame(MessagePublishInfo info, final MessageDestination e) throws QpidSecurityException
+    public void setPublishFrame(MessagePublishInfo info, final MessageDestination e)
     {
         String routingKey = info.getRoutingKey() == null ? null : info.getRoutingKey().asString();
         SecurityManager securityManager = getVirtualHost().getSecurityManager();
-        if (!securityManager.authorisePublish(info.isImmediate(), routingKey, e.getName()))
-        {
-            throw new QpidSecurityException("Permission denied: " + e.getName());
-        }
+
+        securityManager.authorisePublish(info.isImmediate(), routingKey, e.getName());
+
         _currentMessage = new IncomingMessage(info);
         _currentMessage.setMessageDestination(e);
     }
@@ -533,7 +530,7 @@ public class AMQChannel<T extends AMQProtocolSession<T>>
      */
     public AMQShortString consumeFromSource(AMQShortString tag, MessageSource source, boolean acks,
                                             FieldTable filters, boolean exclusive, boolean noLocal)
-            throws AMQException, QpidSecurityException, MessageSource.ExistingConsumerPreventsExclusive,
+            throws AMQException, MessageSource.ExistingConsumerPreventsExclusive,
                    MessageSource.ExistingExclusiveConsumer, AMQInvalidArgumentException,
                    MessageSource.ConsumerAccessRefused
     {
@@ -606,7 +603,7 @@ public class AMQChannel<T extends AMQProtocolSession<T>>
                                       AMQShortString.toString(tag),
                                       options);
         }
-        catch (QpidSecurityException e)
+        catch (AccessControlException e)
         {
             _tag2SubscriptionTargetMap.remove(tag);
             throw e;
diff --git a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/BasicConsumeMethodHandler.java b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/BasicConsumeMethodHandler.java
index c93c164978..aeb5f2d2b1 100644
--- a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/BasicConsumeMethodHandler.java
+++ b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/BasicConsumeMethodHandler.java
@@ -32,13 +32,13 @@ import org.apache.qpid.server.filter.AMQInvalidArgumentException;
 import org.apache.qpid.server.message.MessageSource;
 import org.apache.qpid.server.protocol.v0_8.AMQChannel;
 import org.apache.qpid.server.protocol.v0_8.AMQProtocolSession;
-import org.apache.qpid.server.protocol.AMQSessionModel;
 import org.apache.qpid.server.queue.AMQQueue;
 import org.apache.qpid.server.protocol.v0_8.state.AMQStateManager;
 import org.apache.qpid.server.protocol.v0_8.state.StateAwareMethodListener;
-import org.apache.qpid.server.security.QpidSecurityException;
 import org.apache.qpid.server.virtualhost.VirtualHost;
 
+import java.security.AccessControlException;
+
 public class BasicConsumeMethodHandler implements StateAwareMethodListener<BasicConsumeBody>
 {
     private static final Logger _logger = Logger.getLogger(BasicConsumeMethodHandler.class);
@@ -167,7 +167,7 @@ public class BasicConsumeMethodHandler implements StateAwareMethodListener<Basic
                                                    + queue.getName()
                                                    + " exclusively as it already has a consumer");
                 }
-                catch (QpidSecurityException e)
+                catch (AccessControlException e)
                 {
                     throw body.getChannelException(AMQConstant.ACCESS_REFUSED,
                                                    "Cannot subscribe to queue "
diff --git a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/BasicGetMethodHandler.java b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/BasicGetMethodHandler.java
index 43700049e1..611999d8c6 100644
--- a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/BasicGetMethodHandler.java
+++ b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/BasicGetMethodHandler.java
@@ -38,7 +38,6 @@ import org.apache.qpid.server.flow.FlowCreditManager;
 import org.apache.qpid.server.flow.MessageOnlyCreditManager;
 import org.apache.qpid.server.protocol.v0_8.AMQMessage;
 import org.apache.qpid.server.protocol.v0_8.AMQProtocolSession;
-import org.apache.qpid.server.protocol.AMQSessionModel;
 import org.apache.qpid.server.protocol.v0_8.ConsumerTarget_0_8;
 import org.apache.qpid.server.queue.AMQQueue;
 import org.apache.qpid.server.protocol.v0_8.state.AMQStateManager;
@@ -46,9 +45,9 @@ import org.apache.qpid.server.protocol.v0_8.state.StateAwareMethodListener;
 import org.apache.qpid.server.protocol.v0_8.ClientDeliveryMethod;
 import org.apache.qpid.server.protocol.v0_8.RecordDeliveryMethod;
 import org.apache.qpid.server.consumer.Consumer;
-import org.apache.qpid.server.security.QpidSecurityException;
 import org.apache.qpid.server.virtualhost.VirtualHost;
 
+import java.security.AccessControlException;
 import java.util.EnumSet;
 
 public class BasicGetMethodHandler implements StateAwareMethodListener<BasicGetBody>
@@ -111,7 +110,7 @@ public class BasicGetMethodHandler implements StateAwareMethodListener<BasicGetB
                         protocolConnection.writeFrame(responseBody.generateFrame(channelId));
                     }
                 }
-                catch (QpidSecurityException e)
+                catch (AccessControlException e)
                 {
                     throw body.getConnectionException(AMQConstant.ACCESS_REFUSED,
                                                       e.getMessage());
@@ -140,7 +139,7 @@ public class BasicGetMethodHandler implements StateAwareMethodListener<BasicGetB
                                      final AMQProtocolSession session,
                                      final AMQChannel channel,
                                      final boolean acks)
-            throws AMQException, QpidSecurityException, MessageSource.ExistingConsumerPreventsExclusive,
+            throws AMQException, MessageSource.ExistingConsumerPreventsExclusive,
                    MessageSource.ExistingExclusiveConsumer, MessageSource.ConsumerAccessRefused
     {
 
diff --git a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/BasicPublishMethodHandler.java b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/BasicPublishMethodHandler.java
index 318efdd125..101a92242f 100644
--- a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/BasicPublishMethodHandler.java
+++ b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/BasicPublishMethodHandler.java
@@ -30,13 +30,13 @@ import org.apache.qpid.framing.abstraction.MessagePublishInfo;
 import org.apache.qpid.protocol.AMQConstant;
 import org.apache.qpid.server.message.MessageDestination;
 import org.apache.qpid.server.protocol.v0_8.AMQChannel;
-import org.apache.qpid.server.exchange.Exchange;
 import org.apache.qpid.server.protocol.v0_8.AMQProtocolSession;
 import org.apache.qpid.server.protocol.v0_8.state.AMQStateManager;
 import org.apache.qpid.server.protocol.v0_8.state.StateAwareMethodListener;
-import org.apache.qpid.server.security.QpidSecurityException;
 import org.apache.qpid.server.virtualhost.VirtualHost;
 
+import java.security.AccessControlException;
+
 public class BasicPublishMethodHandler implements StateAwareMethodListener<BasicPublishBody>
 {
     private static final Logger _logger = Logger.getLogger(BasicPublishMethodHandler.class);
@@ -93,7 +93,7 @@ public class BasicPublishMethodHandler implements StateAwareMethodListener<Basic
             {
                 channel.setPublishFrame(info, exch);
             }
-            catch (QpidSecurityException e)
+            catch (AccessControlException e)
             {
                 throw body.getConnectionException(AMQConstant.ACCESS_REFUSED, e.getMessage());
             }
diff --git a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/ConnectionOpenMethodHandler.java b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/ConnectionOpenMethodHandler.java
index 62b13baac2..1c992012da 100644
--- a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/ConnectionOpenMethodHandler.java
+++ b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/ConnectionOpenMethodHandler.java
@@ -35,6 +35,8 @@ import org.apache.qpid.server.protocol.v0_8.state.StateAwareMethodListener;
 import org.apache.qpid.server.virtualhost.State;
 import org.apache.qpid.server.virtualhost.VirtualHost;
 
+import java.security.AccessControlException;
+
 public class ConnectionOpenMethodHandler implements StateAwareMethodListener<ConnectionOpenBody>
 {
     private static final Logger _logger = Logger.getLogger(ConnectionOpenMethodHandler.class);
@@ -79,11 +81,16 @@ public class ConnectionOpenMethodHandler implements StateAwareMethodListener<Con
         else
         {
             // Check virtualhost access
-            if (!virtualHost.getSecurityManager().accessVirtualhost(virtualHostName, session.getRemoteAddress()))
+            try
+            {
+                virtualHost.getSecurityManager().accessVirtualhost(virtualHostName, session.getRemoteAddress());
+            }
+            catch (AccessControlException e)
             {
-                throw body.getConnectionException(AMQConstant.ACCESS_REFUSED, "Permission denied: '" + virtualHost.getName() + "'");
+                throw body.getConnectionException(AMQConstant.ACCESS_REFUSED, e.getMessage());
             }
-            else if (virtualHost.getState() != State.ACTIVE)
+
+             if (virtualHost.getState() != State.ACTIVE)
             {
                 throw body.getConnectionException(AMQConstant.CONNECTION_FORCED, "Virtual host '" + virtualHost.getName() + "' is not active");
             }
diff --git a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/ExchangeDeclareHandler.java b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/ExchangeDeclareHandler.java
index 5c5b1f141b..87622b88e7 100644
--- a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/ExchangeDeclareHandler.java
+++ b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/ExchangeDeclareHandler.java
@@ -35,12 +35,13 @@ import org.apache.qpid.server.exchange.Exchange;
 import org.apache.qpid.server.protocol.v0_8.AMQProtocolSession;
 import org.apache.qpid.server.protocol.v0_8.state.AMQStateManager;
 import org.apache.qpid.server.protocol.v0_8.state.StateAwareMethodListener;
-import org.apache.qpid.server.security.QpidSecurityException;
 import org.apache.qpid.server.virtualhost.ExchangeExistsException;
 import org.apache.qpid.server.virtualhost.ReservedExchangeNameException;
 import org.apache.qpid.server.virtualhost.UnknownExchangeException;
 import org.apache.qpid.server.virtualhost.VirtualHost;
 
+import java.security.AccessControlException;
+
 public class ExchangeDeclareHandler implements StateAwareMethodListener<ExchangeDeclareBody>
 {
     private static final Logger _logger = Logger.getLogger(ExchangeDeclareHandler.class);
@@ -126,7 +127,7 @@ public class ExchangeDeclareHandler implements StateAwareMethodListener<Exchange
             {
                 throw body.getConnectionException(AMQConstant.COMMAND_INVALID, "Unknown exchange: " + exchangeName,e);
             }
-            catch (QpidSecurityException e)
+            catch (AccessControlException e)
             {
                 throw body.getConnectionException(AMQConstant.ACCESS_REFUSED, e.getMessage());
             }
diff --git a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/ExchangeDeleteHandler.java b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/ExchangeDeleteHandler.java
index ea3d7ded4d..bbe6028a63 100644
--- a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/ExchangeDeleteHandler.java
+++ b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/ExchangeDeleteHandler.java
@@ -29,11 +29,12 @@ import org.apache.qpid.server.exchange.Exchange;
 import org.apache.qpid.server.protocol.v0_8.AMQProtocolSession;
 import org.apache.qpid.server.protocol.v0_8.state.AMQStateManager;
 import org.apache.qpid.server.protocol.v0_8.state.StateAwareMethodListener;
-import org.apache.qpid.server.security.QpidSecurityException;
 import org.apache.qpid.server.virtualhost.ExchangeIsAlternateException;
 import org.apache.qpid.server.virtualhost.RequiredExchangeException;
 import org.apache.qpid.server.virtualhost.VirtualHost;
 
+import java.security.AccessControlException;
+
 public class ExchangeDeleteHandler implements StateAwareMethodListener<ExchangeDeleteBody>
 {
     private static final ExchangeDeleteHandler _instance = new ExchangeDeleteHandler();
@@ -83,7 +84,7 @@ public class ExchangeDeleteHandler implements StateAwareMethodListener<ExchangeD
         {
             throw body.getChannelException(AMQConstant.NOT_ALLOWED, "Exchange '"+body.getExchange()+"' cannot be deleted");
         }
-        catch (QpidSecurityException e)
+        catch (AccessControlException e)
         {
             throw body.getConnectionException(AMQConstant.ACCESS_REFUSED, e.getMessage());
         }
diff --git a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueueBindHandler.java b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueueBindHandler.java
index 9b875ccf39..8eb6c63542 100644
--- a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueueBindHandler.java
+++ b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueueBindHandler.java
@@ -23,7 +23,6 @@ package org.apache.qpid.server.protocol.v0_8.handler;
 import org.apache.log4j.Logger;
 
 import org.apache.qpid.AMQException;
-import org.apache.qpid.exchange.ExchangeDefaults;
 import org.apache.qpid.framing.AMQMethodBody;
 import org.apache.qpid.framing.AMQShortString;
 import org.apache.qpid.framing.FieldTable;
@@ -31,19 +30,16 @@ import org.apache.qpid.framing.MethodRegistry;
 import org.apache.qpid.framing.QueueBindBody;
 import org.apache.qpid.protocol.AMQConstant;
 import org.apache.qpid.server.exchange.TopicExchange;
-import org.apache.qpid.server.plugin.ExchangeType;
 import org.apache.qpid.server.protocol.v0_8.AMQChannel;
 import org.apache.qpid.server.binding.Binding;
 import org.apache.qpid.server.exchange.Exchange;
 import org.apache.qpid.server.protocol.v0_8.AMQProtocolSession;
-import org.apache.qpid.server.protocol.AMQSessionModel;
 import org.apache.qpid.server.queue.AMQQueue;
-import org.apache.qpid.server.queue.QueueRegistry;
 import org.apache.qpid.server.protocol.v0_8.state.AMQStateManager;
 import org.apache.qpid.server.protocol.v0_8.state.StateAwareMethodListener;
-import org.apache.qpid.server.security.QpidSecurityException;
 import org.apache.qpid.server.virtualhost.VirtualHost;
 
+import java.security.AccessControlException;
 import java.util.Map;
 
 public class QueueBindHandler implements StateAwareMethodListener<QueueBindBody>
@@ -135,7 +131,7 @@ public class QueueBindHandler implements StateAwareMethodListener<QueueBindBody>
                 }
             }
         }
-        catch (QpidSecurityException e)
+        catch (AccessControlException e)
         {
             throw body.getConnectionException(AMQConstant.ACCESS_REFUSED, e.getMessage());
         }
diff --git a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueueDeclareHandler.java b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueueDeclareHandler.java
index 215e3f2f23..26302dbd72 100644
--- a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueueDeclareHandler.java
+++ b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueueDeclareHandler.java
@@ -40,10 +40,9 @@ import org.apache.qpid.server.queue.AMQQueue;
 import org.apache.qpid.server.queue.QueueArgumentsConverter;
 import org.apache.qpid.server.protocol.v0_8.state.AMQStateManager;
 import org.apache.qpid.server.protocol.v0_8.state.StateAwareMethodListener;
-import org.apache.qpid.server.security.QpidSecurityException;
-import org.apache.qpid.server.util.Action;
 import org.apache.qpid.server.virtualhost.VirtualHost;
 
+import java.security.AccessControlException;
 import java.util.Map;
 import java.util.UUID;
 import org.apache.qpid.server.virtualhost.QueueExistsException;
@@ -149,7 +148,7 @@ public class QueueDeclareHandler implements StateAwareMethodListener<QueueDeclar
                 }
 
             }
-            catch (QpidSecurityException e)
+            catch (AccessControlException e)
             {
                 throw body.getConnectionException(AMQConstant.ACCESS_REFUSED, e.getMessage());
             }
@@ -181,7 +180,7 @@ public class QueueDeclareHandler implements StateAwareMethodListener<QueueDeclar
                                    QueueDeclareBody body,
                                    final VirtualHost virtualHost,
                                    final AMQProtocolSession session)
-            throws AMQException, QpidSecurityException, QueueExistsException
+            throws AMQException, QueueExistsException
     {
 
         final boolean durable = body.getDurable();
diff --git a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueueDeleteHandler.java b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueueDeleteHandler.java
index c939e49aab..d7545c844a 100644
--- a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueueDeleteHandler.java
+++ b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueueDeleteHandler.java
@@ -27,16 +27,14 @@ import org.apache.qpid.framing.QueueDeleteOkBody;
 import org.apache.qpid.protocol.AMQConstant;
 import org.apache.qpid.server.protocol.v0_8.AMQChannel;
 import org.apache.qpid.server.protocol.v0_8.AMQProtocolSession;
-import org.apache.qpid.server.protocol.AMQSessionModel;
 import org.apache.qpid.server.queue.AMQQueue;
-import org.apache.qpid.server.queue.QueueRegistry;
 import org.apache.qpid.server.protocol.v0_8.state.AMQStateManager;
 import org.apache.qpid.server.protocol.v0_8.state.StateAwareMethodListener;
-import org.apache.qpid.server.security.QpidSecurityException;
 import org.apache.qpid.server.store.DurableConfigurationStore;
-import org.apache.qpid.server.store.DurableConfigurationStoreHelper;
 import org.apache.qpid.server.virtualhost.VirtualHost;
 
+import java.security.AccessControlException;
+
 public class QueueDeleteHandler implements StateAwareMethodListener<QueueDeleteBody>
 {
     private static final QueueDeleteHandler _instance = new QueueDeleteHandler();
@@ -116,7 +114,7 @@ public class QueueDeleteHandler implements StateAwareMethodListener<QueueDeleteB
                 {
                     purged = virtualHost.removeQueue(queue);
                 }
-                catch (QpidSecurityException e)
+                catch (AccessControlException e)
                 {
                     throw body.getConnectionException(AMQConstant.ACCESS_REFUSED, e.getMessage());
                 }
diff --git a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueuePurgeHandler.java b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueuePurgeHandler.java
index 9d035a3f57..569654c64d 100644
--- a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueuePurgeHandler.java
+++ b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueuePurgeHandler.java
@@ -28,14 +28,13 @@ import org.apache.qpid.framing.QueuePurgeBody;
 import org.apache.qpid.protocol.AMQConstant;
 import org.apache.qpid.server.protocol.v0_8.AMQChannel;
 import org.apache.qpid.server.protocol.v0_8.AMQProtocolSession;
-import org.apache.qpid.server.protocol.AMQSessionModel;
 import org.apache.qpid.server.queue.AMQQueue;
-import org.apache.qpid.server.queue.QueueRegistry;
 import org.apache.qpid.server.protocol.v0_8.state.AMQStateManager;
 import org.apache.qpid.server.protocol.v0_8.state.StateAwareMethodListener;
-import org.apache.qpid.server.security.QpidSecurityException;
 import org.apache.qpid.server.virtualhost.VirtualHost;
 
+import java.security.AccessControlException;
+
 public class QueuePurgeHandler implements StateAwareMethodListener<QueuePurgeBody>
 {
     private static final QueuePurgeHandler _instance = new QueuePurgeHandler();
@@ -107,7 +106,7 @@ public class QueuePurgeHandler implements StateAwareMethodListener<QueuePurgeBod
             {
                 purged = queue.clearQueue();
             }
-            catch (QpidSecurityException e)
+            catch (AccessControlException e)
             {
                 throw body.getConnectionException(AMQConstant.ACCESS_REFUSED, e.getMessage());
             }
diff --git a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueueUnbindHandler.java b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueueUnbindHandler.java
index 91025dacf2..f44f831f68 100644
--- a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueueUnbindHandler.java
+++ b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/QueueUnbindHandler.java
@@ -35,12 +35,12 @@ import org.apache.qpid.server.protocol.v0_8.AMQChannel;
 import org.apache.qpid.server.exchange.Exchange;
 import org.apache.qpid.server.protocol.v0_8.AMQProtocolSession;
 import org.apache.qpid.server.queue.AMQQueue;
-import org.apache.qpid.server.queue.QueueRegistry;
 import org.apache.qpid.server.protocol.v0_8.state.AMQStateManager;
 import org.apache.qpid.server.protocol.v0_8.state.StateAwareMethodListener;
-import org.apache.qpid.server.security.QpidSecurityException;
 import org.apache.qpid.server.virtualhost.VirtualHost;
 
+import java.security.AccessControlException;
+
 public class QueueUnbindHandler implements StateAwareMethodListener<QueueUnbindBody>
 {
     private static final Logger _log = Logger.getLogger(QueueUnbindHandler.class);
@@ -110,7 +110,7 @@ public class QueueUnbindHandler implements StateAwareMethodListener<QueueUnbindB
             {
                 exch.removeBinding(String.valueOf(routingKey), queue, FieldTable.convertToMap(body.getArguments()));
             }
-            catch (QpidSecurityException e)
+            catch (AccessControlException e)
             {
                 throw body.getConnectionException(AMQConstant.ACCESS_REFUSED, e.getMessage());
             }
diff --git a/qpid/java/broker-plugins/amqp-0-8-protocol/src/test/java/org/apache/qpid/server/protocol/v0_8/BrokerTestHelper_0_8.java b/qpid/java/broker-plugins/amqp-0-8-protocol/src/test/java/org/apache/qpid/server/protocol/v0_8/BrokerTestHelper_0_8.java
index 845c1d55b4..e5a3475feb 100644
--- a/qpid/java/broker-plugins/amqp-0-8-protocol/src/test/java/org/apache/qpid/server/protocol/v0_8/BrokerTestHelper_0_8.java
+++ b/qpid/java/broker-plugins/amqp-0-8-protocol/src/test/java/org/apache/qpid/server/protocol/v0_8/BrokerTestHelper_0_8.java
@@ -26,7 +26,6 @@ import org.apache.qpid.framing.BasicContentHeaderProperties;
 import org.apache.qpid.framing.ContentHeaderBody;
 import org.apache.qpid.framing.abstraction.MessagePublishInfo;
 import org.apache.qpid.server.exchange.Exchange;
-import org.apache.qpid.server.security.QpidSecurityException;
 import org.apache.qpid.server.util.BrokerTestHelper;
 import org.apache.qpid.server.virtualhost.VirtualHost;
 
@@ -66,7 +65,7 @@ public class BrokerTestHelper_0_8 extends BrokerTestHelper
     }
 
     public static void publishMessages(AMQChannel channel, int numberOfMessages, String queueName, String exchangeName)
-            throws AMQException, QpidSecurityException
+            throws AMQException
     {
         AMQShortString routingKey = new AMQShortString(queueName);
         AMQShortString exchangeNameAsShortString = new AMQShortString(exchangeName);
diff --git a/qpid/java/broker-plugins/amqp-1-0-protocol/src/main/java/org/apache/qpid/server/protocol/v1_0/SendingLink_1_0.java b/qpid/java/broker-plugins/amqp-1-0-protocol/src/main/java/org/apache/qpid/server/protocol/v1_0/SendingLink_1_0.java
index f7e2d2df50..d0e77b4878 100644
--- a/qpid/java/broker-plugins/amqp-1-0-protocol/src/main/java/org/apache/qpid/server/protocol/v1_0/SendingLink_1_0.java
+++ b/qpid/java/broker-plugins/amqp-1-0-protocol/src/main/java/org/apache/qpid/server/protocol/v1_0/SendingLink_1_0.java
@@ -20,6 +20,7 @@
  */
 package org.apache.qpid.server.protocol.v1_0;
 
+import java.security.AccessControlException;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.EnumSet;
@@ -33,7 +34,6 @@ import org.apache.log4j.Logger;
 import org.apache.qpid.server.model.ExclusivityPolicy;
 import org.apache.qpid.server.model.LifetimePolicy;
 import org.apache.qpid.server.model.Queue;
-import org.apache.qpid.server.security.QpidSecurityException;
 import org.apache.qpid.amqp_1_0.transport.DeliveryStateHandler;
 import org.apache.qpid.amqp_1_0.transport.LinkEndpoint;
 import org.apache.qpid.amqp_1_0.transport.SendingLinkEndpoint;
@@ -64,7 +64,6 @@ import org.apache.qpid.server.queue.AMQQueue;
 import org.apache.qpid.server.consumer.Consumer;
 import org.apache.qpid.server.txn.AutoCommitTransaction;
 import org.apache.qpid.server.txn.ServerTransaction;
-import org.apache.qpid.server.util.Action;
 import org.apache.qpid.server.util.ConnectionScopedRuntimeException;
 import org.apache.qpid.server.virtualhost.VirtualHost;
 import org.apache.qpid.server.virtualhost.QueueExistsException;
@@ -312,11 +311,6 @@ public class SendingLink_1_0 implements SendingLinkListener, Link_1_0, DeliveryS
 
                 qd = new QueueDestination(queue);
             }
-            catch (QpidSecurityException e)
-            {
-                _logger.error("Security error", e);
-                throw new ConnectionScopedRuntimeException(e);
-            }
             catch (QueueExistsException e)
             {
                 _logger.error("A randomly generated temporary queue name collided with an existing queue",e);
@@ -357,12 +351,6 @@ public class SendingLink_1_0 implements SendingLinkListener, Link_1_0, DeliveryS
                                                messageFilter == null ? null : new SimpleFilterManager(messageFilter),
                                                Message_1_0.class, name, options);
             }
-            catch (QpidSecurityException e)
-            {
-                //TODO
-                _logger.info("Error registering subscription", e);
-                throw new ConnectionScopedRuntimeException(e);
-            }
             catch (MessageSource.ExistingExclusiveConsumer e)
             {
                 _logger.info("Cannot add a consumer to the destination as there is already an exclusive consumer");
@@ -416,7 +404,7 @@ public class SendingLink_1_0 implements SendingLinkListener, Link_1_0, DeliveryS
                 {
                     _vhost.removeQueue((AMQQueue)_queue);
                 }
-                catch (QpidSecurityException e)
+                catch (AccessControlException e)
                 {
                     //TODO
                     _logger.error("Error registering subscription", e);
diff --git a/qpid/java/broker-plugins/amqp-1-0-protocol/src/main/java/org/apache/qpid/server/protocol/v1_0/Session_1_0.java b/qpid/java/broker-plugins/amqp-1-0-protocol/src/main/java/org/apache/qpid/server/protocol/v1_0/Session_1_0.java
index 6840c7344a..b96738e0f6 100644
--- a/qpid/java/broker-plugins/amqp-1-0-protocol/src/main/java/org/apache/qpid/server/protocol/v1_0/Session_1_0.java
+++ b/qpid/java/broker-plugins/amqp-1-0-protocol/src/main/java/org/apache/qpid/server/protocol/v1_0/Session_1_0.java
@@ -20,6 +20,7 @@
  */
 package org.apache.qpid.server.protocol.v1_0;
 
+import java.security.AccessControlException;
 import java.text.MessageFormat;
 
 import org.apache.log4j.Logger;
@@ -39,13 +40,11 @@ import org.apache.qpid.amqp_1_0.type.transport.*;
 
 import org.apache.qpid.amqp_1_0.type.transport.Error;
 import org.apache.qpid.server.model.*;
-import org.apache.qpid.server.security.QpidSecurityException;
 import org.apache.qpid.protocol.AMQConstant;
 import org.apache.qpid.server.exchange.Exchange;
 import org.apache.qpid.server.logging.LogSubject;
 import org.apache.qpid.server.message.MessageDestination;
 import org.apache.qpid.server.message.MessageSource;
-import org.apache.qpid.server.protocol.AMQConnectionModel;
 import org.apache.qpid.server.protocol.AMQSessionModel;
 import org.apache.qpid.server.protocol.LinkRegistry;
 import org.apache.qpid.server.queue.AMQQueue;
@@ -380,7 +379,7 @@ public class Session_1_0 implements SessionEventListener, AMQSessionModel<Sessio
 
             final AMQQueue tempQueue = queue = _vhost.createQueue(this, attributes );
         }
-        catch (QpidSecurityException e)
+        catch (AccessControlException e)
         {
             //TODO
             _logger.info("Security error", e);
diff --git a/qpid/java/broker-plugins/management-amqp/src/main/java/org/apache/qpid/server/management/amqp/ManagementNode.java b/qpid/java/broker-plugins/management-amqp/src/main/java/org/apache/qpid/server/management/amqp/ManagementNode.java
index 6f083012e7..7fe280649f 100644
--- a/qpid/java/broker-plugins/management-amqp/src/main/java/org/apache/qpid/server/management/amqp/ManagementNode.java
+++ b/qpid/java/broker-plugins/management-amqp/src/main/java/org/apache/qpid/server/management/amqp/ManagementNode.java
@@ -20,7 +20,6 @@
  */
 package org.apache.qpid.server.management.amqp;
 
-import org.apache.qpid.server.security.QpidSecurityException;
 import org.apache.qpid.server.consumer.Consumer;
 import org.apache.qpid.server.consumer.ConsumerTarget;
 import org.apache.qpid.server.filter.FilterManager;
@@ -369,16 +368,9 @@ class ManagementNode implements MessageSource<ManagementNodeConsumer,ManagementN
                             }
                             response = performReadOperation(message, child);
                         }
-                        catch(RuntimeException e)
+                        catch(AccessControlException e)
                         {
-                            if (e instanceof AccessControlException || e.getCause() instanceof QpidSecurityException)
-                            {
-                                response = createFailureResponse(message, STATUS_CODE_FORBIDDEN, e.getMessage());
-                            }
-                            else
-                            {
-                                throw e;
-                            }
+                            response = createFailureResponse(message, STATUS_CODE_FORBIDDEN, e.getMessage());
                         }
                     }
                     catch (ClassNotFoundException e)
@@ -474,17 +466,9 @@ class ManagementNode implements MessageSource<ManagementNodeConsumer,ManagementN
             entity.setDesiredState(entity.getActualState(),State.DELETED);
             responseHeader.setHeader(STATUS_CODE_HEADER, STATUS_CODE_NO_CONTENT);
         }
-        catch(RuntimeException e)
+        catch(AccessControlException e)
         {
-            if (e instanceof AccessControlException || e.getCause() instanceof QpidSecurityException)
-            {
-                responseHeader.setHeader(STATUS_CODE_HEADER, STATUS_CODE_FORBIDDEN);
-            }
-            else
-            {
-                throw e;
-            }
-
+            responseHeader.setHeader(STATUS_CODE_HEADER, STATUS_CODE_FORBIDDEN);
         }
 
         return InternalMessage.createMapMessage(_virtualHost.getMessageStore(),responseHeader, Collections.emptyMap());
@@ -512,16 +496,9 @@ class ManagementNode implements MessageSource<ManagementNodeConsumer,ManagementN
                 entity.setAttributes((Map)messageBody);
                 return performReadOperation(requestMessage, entity);
             }
-            catch(RuntimeException e)
+            catch(AccessControlException e)
             {
-                if (e instanceof AccessControlException || e.getCause() instanceof QpidSecurityException)
-                {
-                    return createFailureResponse(requestMessage, STATUS_CODE_FORBIDDEN, e.getMessage());
-                }
-                else
-                {
-                    throw e;
-                }
+                return createFailureResponse(requestMessage, STATUS_CODE_FORBIDDEN, e.getMessage());
             }
         }
         else
@@ -615,8 +592,8 @@ class ManagementNode implements MessageSource<ManagementNodeConsumer,ManagementN
         final InternalMessageHeader requestHeader = msg.getMessageHeader();
         final MutableMessageHeader responseHeader = new MutableMessageHeader();
         responseHeader.setCorrelationId(requestHeader.getCorrelationId() == null
-                                            ? requestHeader.getMessageId()
-                                            : requestHeader.getCorrelationId());
+                                                ? requestHeader.getMessageId()
+                                                : requestHeader.getCorrelationId());
         responseHeader.setMessageId(UUID.randomUUID().toString());
 
 
diff --git a/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/HttpManagementUtil.java b/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/HttpManagementUtil.java
index 9a2f0dd1f6..674ff71232 100644
--- a/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/HttpManagementUtil.java
+++ b/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/HttpManagementUtil.java
@@ -48,7 +48,6 @@ import org.apache.qpid.server.security.auth.AuthenticatedPrincipal;
 import org.apache.qpid.server.security.auth.AuthenticationResult.AuthenticationStatus;
 import org.apache.qpid.server.security.auth.SubjectAuthenticationResult;
 import org.apache.qpid.server.security.auth.UsernamePrincipal;
-import org.apache.qpid.server.security.auth.manager.ExternalAuthenticationManager;
 import org.apache.qpid.server.security.auth.manager.ExternalAuthenticationManagerFactory;
 import org.apache.qpid.server.util.ServerScopedRuntimeException;
 import org.apache.qpid.transport.network.security.ssl.SSLUtil;
@@ -108,18 +107,16 @@ public class HttpManagementUtil
                 throw new SecurityException("Only authenticated users can access the management interface");
             }
             LogActor actor = createHttpManagementActor(broker, request);
-            if (hasAccessToManagement(broker.getSecurityManager(), subject, actor))
-            {
-                saveAuthorisedSubject(session, subject, actor);
-            }
-            else
-            {
-                throw new AccessControlException("Access to the management interface denied");
-            }
+
+            assertManagementAccess(broker.getSecurityManager(), subject, actor);
+
+            saveAuthorisedSubject(session, subject, actor);
+
+
         }
     }
 
-    public static boolean hasAccessToManagement(final SecurityManager securityManager, Subject subject, LogActor actor)
+    public static void assertManagementAccess(final SecurityManager securityManager, Subject subject, LogActor actor)
     {
         // TODO: We should eliminate SecurityManager.setThreadSubject in favour of Subject.doAs
         SecurityManager.setThreadSubject(subject); // Required for accessManagement check
@@ -128,12 +125,13 @@ public class HttpManagementUtil
         {
             try
             {
-                return Subject.doAs(subject, new PrivilegedExceptionAction<Boolean>()
+                Subject.doAs(subject, new PrivilegedExceptionAction<Void>()
                 {
                     @Override
-                    public Boolean run() throws Exception
+                    public Void run()
                     {
-                        return securityManager.accessManagement();
+                        securityManager.accessManagement();
+                        return null;
                     }
                 });
             }
diff --git a/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/MessageServlet.java b/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/MessageServlet.java
index 9ca23ce1ce..3eafa7c294 100644
--- a/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/MessageServlet.java
+++ b/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/MessageServlet.java
@@ -19,6 +19,7 @@ package org.apache.qpid.server.management.plugin.servlet.rest;
 
 import java.io.IOException;
 import java.io.PrintWriter;
+import java.security.AccessControlException;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
@@ -426,21 +427,22 @@ public class MessageServlet extends AbstractServlet
             // FIXME: added temporary authorization check until we introduce management layer
             // and review current ACL rules to have common rules for all management interfaces
             String methodName = isMoveTransaction? "moveMessages":"copyMessages";
-            if (isQueueUpdateMethodAuthorized(methodName, vhost))
-            {
-                final Queue destinationQueue = getQueueFromVirtualHost(destQueueName, vhost);
-                final List messageIds = new ArrayList((List) providedObject.get("messages"));
-                QueueEntryTransaction txn =
-                        isMoveTransaction
-                                ? new MoveTransaction(sourceQueue, messageIds, destinationQueue)
-                                : new CopyTransaction(sourceQueue, messageIds, destinationQueue);
-                vhost.executeTransaction(txn);
-                response.setStatus(HttpServletResponse.SC_OK);
-            }
-            else
-            {
-                response.setStatus(HttpServletResponse.SC_FORBIDDEN);
-            }
+            authorizeMethod(methodName, vhost);
+
+
+            final Queue destinationQueue = getQueueFromVirtualHost(destQueueName, vhost);
+            final List messageIds = new ArrayList((List) providedObject.get("messages"));
+            QueueEntryTransaction txn =
+                    isMoveTransaction
+                            ? new MoveTransaction(sourceQueue, messageIds, destinationQueue)
+                            : new CopyTransaction(sourceQueue, messageIds, destinationQueue);
+            vhost.executeTransaction(txn);
+            response.setStatus(HttpServletResponse.SC_OK);
+
+        }
+        catch(AccessControlException e)
+        {
+            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
         }
         catch(RuntimeException e)
         {
@@ -470,22 +472,23 @@ public class MessageServlet extends AbstractServlet
 
         // FIXME: added temporary authorization check until we introduce management layer
         // and review current ACL rules to have common rules for all management interfaces
-        if (isQueueUpdateMethodAuthorized("deleteMessages", vhost))
+        try
         {
+            authorizeMethod("deleteMessages", vhost);
             vhost.executeTransaction(new DeleteTransaction(sourceQueue, messageIds));
             response.setStatus(HttpServletResponse.SC_OK);
         }
-        else
+        catch (AccessControlException e)
         {
             response.setStatus(HttpServletResponse.SC_FORBIDDEN);
         }
 
     }
 
-    private boolean isQueueUpdateMethodAuthorized(String methodName, VirtualHost host)
+    private void authorizeMethod(String methodName, VirtualHost host)
     {
         SecurityManager securityManager = host.getSecurityManager();
-        return securityManager.authoriseMethod(Operation.UPDATE, "VirtualHost.Queue", methodName);
+        securityManager.authoriseMethod(Operation.UPDATE, "VirtualHost.Queue", methodName);
     }
 
 }
diff --git a/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/RestServlet.java b/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/RestServlet.java
index 45e0c2dab8..e6bc46aa77 100644
--- a/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/RestServlet.java
+++ b/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/RestServlet.java
@@ -27,7 +27,6 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import org.apache.log4j.Logger;
-import org.apache.qpid.server.security.QpidSecurityException;
 import org.apache.qpid.server.model.*;
 import org.codehaus.jackson.map.ObjectMapper;
 import org.codehaus.jackson.map.SerializationConfig;
@@ -498,7 +497,7 @@ public class RestServlet extends AbstractServlet
 
     private void setResponseStatus(HttpServletResponse response, RuntimeException e) throws IOException
     {
-        if (e instanceof AccessControlException || e.getCause() instanceof QpidSecurityException)
+        if (e instanceof AccessControlException)
         {
             if (LOGGER.isDebugEnabled())
             {
diff --git a/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/SaslServlet.java b/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/SaslServlet.java
index a29a875071..5441dc95c4 100644
--- a/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/SaslServlet.java
+++ b/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/SaslServlet.java
@@ -241,7 +241,11 @@ public class SaslServlet extends AbstractServlet
 
             Broker broker = getBroker();
             LogActor actor = HttpManagementUtil.getOrCreateAndCacheLogActor(request, broker);
-            if (!HttpManagementUtil.hasAccessToManagement(broker.getSecurityManager(), subject, actor))
+            try
+            {
+                HttpManagementUtil.assertManagementAccess(broker.getSecurityManager(), subject, actor);
+            }
+            catch(SecurityException e)
             {
                 sendError(response, HttpServletResponse.SC_FORBIDDEN);
                 return;
diff --git a/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/UserPreferencesServlet.java b/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/UserPreferencesServlet.java
index 355b5df177..01657b131d 100644
--- a/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/UserPreferencesServlet.java
+++ b/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/UserPreferencesServlet.java
@@ -64,11 +64,16 @@ public class UserPreferencesServlet extends AbstractServlet
     private void getUserPreferences(String authenticationProviderName, String userId, HttpServletResponse response)
             throws IOException
     {
-        if (!userPreferencesOperationAuthorized(userId))
+        try
+        {
+            assertUserPreferencesOperationAuthorized(userId);
+        }
+        catch (SecurityException e)
         {
             response.sendError(HttpServletResponse.SC_FORBIDDEN, "Viewing of preferences is not allowed");
             return;
         }
+
         Map<String, Object> preferences = null;
         PreferencesProvider preferencesProvider = getPreferencesProvider(authenticationProviderName);
         if (preferencesProvider == null)
@@ -171,11 +176,16 @@ public class UserPreferencesServlet extends AbstractServlet
 
             String userId = elements[1];
 
-            if (!userPreferencesOperationAuthorized(userId))
+            try
+            {
+                assertUserPreferencesOperationAuthorized(userId);
+            }
+            catch (SecurityException e)
             {
                 response.sendError(HttpServletResponse.SC_FORBIDDEN, "Deletion of preferences is not allowed");
                 return;
             }
+
             String providerName =  elements[0];
             Set<String> users = providerUsers.get(providerName);
 
@@ -226,8 +236,8 @@ public class UserPreferencesServlet extends AbstractServlet
         return provider;
     }
 
-    private boolean userPreferencesOperationAuthorized(String userId)
+    private void assertUserPreferencesOperationAuthorized(String userId)
     {
-        return getBroker().getSecurityManager().authoriseUserOperation(Operation.UPDATE, userId);
+        getBroker().getSecurityManager().authoriseUserOperation(Operation.UPDATE, userId);
     }
 }
diff --git a/qpid/java/broker-plugins/management-jmx/src/main/java/org/apache/qpid/server/jmx/MBeanInvocationHandlerImpl.java b/qpid/java/broker-plugins/management-jmx/src/main/java/org/apache/qpid/server/jmx/MBeanInvocationHandlerImpl.java
index 0f963df66f..e9716ab775 100644
--- a/qpid/java/broker-plugins/management-jmx/src/main/java/org/apache/qpid/server/jmx/MBeanInvocationHandlerImpl.java
+++ b/qpid/java/broker-plugins/management-jmx/src/main/java/org/apache/qpid/server/jmx/MBeanInvocationHandlerImpl.java
@@ -227,22 +227,8 @@ public class MBeanInvocationHandlerImpl implements InvocationHandler
         }
 
         methodName = getMethodName(method, args);
-        if (isAccessMethod(methodName) || impact == MBeanOperationInfo.INFO)
-        {
-            // Check for read-only method invocation permission
-            if (!security.authoriseMethod(Operation.ACCESS, type, methodName))
-            {
-                throw new SecurityException("Permission denied: Access " + methodName);
-            }
-        }
-        else
-        {
-            // Check for setting properties permission
-            if (!security.authoriseMethod(Operation.UPDATE, type, methodName))
-            {
-                throw new SecurityException("Permission denied: Update " + methodName);
-            }
-        }
+        Operation operation = (isAccessMethod(methodName) || impact == MBeanOperationInfo.INFO) ? Operation.ACCESS : Operation.UPDATE;
+        security.authoriseMethod(operation, type, methodName);
 
         boolean oldAccessChecksDisabled = false;
         if(_managementRightsInferAllAccess)