QPID-3641: ACLV2 Simplifications and Improvements for Java Broker

Improvements and simplifications to ACL V2 for the Java Broker:
1) Removed 'EXECUTE' operation (we now just have ACCESS and UPDATE like C++ broker)
2) Enable users with management rights for a procedure to complete that procedure without matching AMQP rights (configurable)
3) Fix up system tests (make clearer, remove need for lots of support files)
4) Fix disparity in DENY_LOG and DENY-LOG values between brokers.
5) Get rid of transitive/expand permission rules

Work from Robbie Gemmell and myself.

git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1205782 13f79535-47bb-0310-9956-ffa450edef68

12 files changed, 0 insertions, 395 deletions

diff --git a/qpid/java/systests/etc/config-systests-aclv2-settings.xml b/qpid/java/systests/etc/config-systests-aclv2-settings.xml
deleted file mode 100644
index fbf218fdfa..0000000000
--- a/qpid/java/systests/etc/config-systests-aclv2-settings.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!--
- -
- - Licensed to the Apache Software Foundation (ASF) under one
- - or more contributor license agreements.  See the NOTICE file
- - distributed with this work for additional information
- - regarding copyright ownership.  The ASF licenses this file
- - to you under the Apache License, Version 2.0 (the
- - "License"); you may not use this file except in compliance
- - with the License.  You may obtain a copy of the License at
- -
- -   http://www.apache.org/licenses/LICENSE-2.0
- -
- - Unless required by applicable law or agreed to in writing,
- - software distributed under the License is distributed on an
- - "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- - KIND, either express or implied.  See the License for the
- - specific language governing permissions and limitations
- - under the License.
- -
- -->
-<broker>
-	<security>
-		<aclv2>${QPID_HOME}/etc/global-default.txt</aclv2>
-	</security>
-
-	<virtualhosts>${QPID_HOME}/etc/virtualhosts-systests-aclv2.xml</virtualhosts>
-</broker>
-
-
diff --git a/qpid/java/systests/etc/config-systests-aclv2.xml b/qpid/java/systests/etc/config-systests-aclv2.xml
deleted file mode 100644
index e8b971a2a0..0000000000
--- a/qpid/java/systests/etc/config-systests-aclv2.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!--
- -
- - Licensed to the Apache Software Foundation (ASF) under one
- - or more contributor license agreements.  See the NOTICE file
- - distributed with this work for additional information
- - regarding copyright ownership.  The ASF licenses this file
- - to you under the Apache License, Version 2.0 (the
- - "License"); you may not use this file except in compliance
- - with the License.  You may obtain a copy of the License at
- -
- -   http://www.apache.org/licenses/LICENSE-2.0
- -
- - Unless required by applicable law or agreed to in writing,
- - software distributed under the License is distributed on an
- - "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- - KIND, either express or implied.  See the License for the
- - specific language governing permissions and limitations
- - under the License.
- -
- -->
-<configuration>
-    <system/>
-    <override>
-        <xml fileName="${QPID_HOME}/${test.config}" optional="true"/>
-        <xml fileName="${QPID_HOME}/etc/config-systests-aclv2-settings.xml"/>
-        <xml fileName="${QPID_HOME}/etc/config-systests-settings.xml"/>
-        <xml fileName="${QPID_HOME}/etc/config.xml"/>
-    </override>
-</configuration>
diff --git a/qpid/java/systests/etc/global-default.txt b/qpid/java/systests/etc/global-default.txt
deleted file mode 100644
index 01b2c41809..0000000000
--- a/qpid/java/systests/etc/global-default.txt
+++ /dev/null
@@ -1,31 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-CONFIG expand=true
-
-# This section grants the admin user access to all management methods
-ACL ALLOW admin ALL METHOD
-
-# This section grants the client user access to all management methods except logging
-ACL DENY client ALL METHOD component="LoggingManagement"
-ACL ALLOW client ALL METHOD
-
-# This section grants the server user access to all management methods except configuration
-ACL DENY server ALL METHOD component="ConfigurationManagement"
-ACL ALLOW server ALL METHOD
diff --git a/qpid/java/systests/etc/global-externaladminacl-changeloggerleveldenied.txt b/qpid/java/systests/etc/global-externaladminacl-changeloggerleveldenied.txt
deleted file mode 100644
index a59b3176cb..0000000000
--- a/qpid/java/systests/etc/global-externaladminacl-changeloggerleveldenied.txt
+++ /dev/null
@@ -1,24 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-# This section denies the admin user access to logging
-ACL DENY admin UPDATE METHOD component="LoggingManagement" name="setRuntimeRootLoggerLevel"
-
-# This section grants the admin user access to management methods
-ACL ALLOW admin ALL METHOD
diff --git a/qpid/java/systests/etc/global-externaladminacl-getallloggerlevelsdenied.txt b/qpid/java/systests/etc/global-externaladminacl-getallloggerlevelsdenied.txt
deleted file mode 100644
index ff024b5ee8..0000000000
--- a/qpid/java/systests/etc/global-externaladminacl-getallloggerlevelsdenied.txt
+++ /dev/null
@@ -1,25 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-# This section denies the admin user access to logging methods
-ACL DENY admin ACCESS METHOD component="LoggingManagement" name="getAvailableLoggerLevels"
-
-# This section grants the admin user access to all management methods
-ACL ALLOW admin ALL METHOD
-
diff --git a/qpid/java/systests/etc/test-default.txt b/qpid/java/systests/etc/test-default.txt
deleted file mode 100644
index 95e733d077..0000000000
--- a/qpid/java/systests/etc/test-default.txt
+++ /dev/null
@@ -1,73 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-# This section grants virtualhost access rights
-ACL ALLOW client ACCESS VIRTUALHOST
-ACL ALLOW server ACCESS VIRTUALHOST
-
-# This section grants publish rights to an exchange + routing key pair
-
-# Allow clients to publish requests
-ACL ALLOW client PUBLISH EXCHANGE name="amq.direct" routingKey="example.RequestQueue"
-
-# Allow the processor to respond to a client on their Temporary Topic
-ACL ALLOW server PUBLISH EXCHANGE name="amq.direct" routingKey="tmp_*"
-ACL ALLOW server PUBLISH EXCHANGE name="amq.direct" routingKey="TempQueue*"
-
-# This section grants users the ability to consume from the broker
-
-# Allow client to consume from temporary queues
-ACL ALLOW client CONSUME QUEUE temporary=true
-
-# Only allow the server to consume from the Request Queue
-ACL ALLOW server CONSUME QUEUE name="example.RequestQueue"
-
-# Allow client and server to consume from kipper queues
-ACL ALLOW client CONSUME QUEUE name="clientid:kipper"
-ACL ALLOW server CONSUME QUEUE name="clientid:kipper"
-
-# This section grants users the ability to create/delete queues and exchanges
-
-# Allow clients to create and delete temporary and kipper queue on this exchange
-ACL ALLOW client CREATE QUEUE temporary=true
-ACL ALLOW client DELETE QUEUE temporary=true
-ACL ALLOW client CREATE QUEUE durable="true"
-ACL ALLOW client DELETE QUEUE durable="true"
-
-# Allow the server to create the Request Queue and kipper queue
-ACL ALLOW server CREATE QUEUE name="example.RequestQueue"
-ACL ALLOW server CREATE QUEUE name="clientid:kipper"
-
-## Allow client and server exchange access for the relevant queues
-ACL ALLOW client BIND EXCHANGE name="amq.direct" temporary=true
-ACL ALLOW client UNBIND EXCHANGE name="amq.direct" temporary=true
-ACL ALLOW client BIND EXCHANGE name="amq.direct" durable=true
-ACL ALLOW client UNBIND EXCHANGE name="amq.direct" durable=true
-ACL ALLOW server BIND EXCHANGE name="amq.direct" queueName="example.RequestQueue"
-
-## Allow client and server exchange access for the relevant topics
-ACL ALLOW client BIND EXCHANGE name="amq.topic" durable=true routingKey=kipper
-ACL ALLOW client UNBIND EXCHANGE name="amq.topic" durable=true routingKey=kipper
-ACL ALLOW server BIND EXCHANGE name="amq.topic" durable=true routingKey=kipper
-
-# Action[operation=BIND,objectType=EXCHANGE,properties={OWNER=client, DURABLE=true, QUEUE_NAME=IllegalQueue, AUTO_DELETE=false, ROUTING_KEY=IllegalQueue, NAME=amq.direct, TEMPORARY=false, EXCLUSIVE=false}]
-
-
-ACL ALLOW client CREATE EXCHANGE
-ACL ALLOW server CREATE EXCHANGE
diff --git a/qpid/java/systests/etc/test-externalacljmx-deleteexchangefailure.txt b/qpid/java/systests/etc/test-externalacljmx-deleteexchangefailure.txt
deleted file mode 100644
index 197fe9dabe..0000000000
--- a/qpid/java/systests/etc/test-externalacljmx-deleteexchangefailure.txt
+++ /dev/null
@@ -1,26 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-# This section grants virtualhost management rights
-ACL ALLOW admin ALL METHOD
-
-# testDeleteExchangeFailure()
-ACL ALLOW admin CREATE EXCHANGE name="amq.kipper.delete"
-ACL DENY admin DELETE EXCHANGE name="amq.kipper.delete"
-
diff --git a/qpid/java/systests/etc/test-externalacljmx.txt b/qpid/java/systests/etc/test-externalacljmx.txt
deleted file mode 100644
index f8a94bd44a..0000000000
--- a/qpid/java/systests/etc/test-externalacljmx.txt
+++ /dev/null
@@ -1,35 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-# This section grants management access to the virtualhost
-ACL ALLOW admin ALL METHOD
-ACL ALLOW client ALL METHOD
-ACL ALLOW server ALL METHOD
-
-# Allow create kipper queue
-ACL ALLOW admin CREATE QUEUE name="kipper" owner = client # kipper
-ACL ALLOW admin BIND EXCHANGE name="amq.direct"
-
-# testCreateExchangeSuccess(), testDeleteExchangeSuccess()
-ACL ALLOW admin CREATE EXCHANGE name="amq.kipper.success"
-ACL ALLOW admin DELETE EXCHANGE name="amq.kipper.success"
-
-# testCreateExchangeFailure()
-ACL DENY admin CREATE EXCHANGE name="amq.kipper.failure"
-
diff --git a/qpid/java/systests/etc/test-logging.txt b/qpid/java/systests/etc/test-logging.txt
deleted file mode 100644
index 76c6e442e0..0000000000
--- a/qpid/java/systests/etc/test-logging.txt
+++ /dev/null
@@ -1,23 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-ACL ALLOW client CREATE QUEUE name="allow"
-ACL ALLOW-LOG client CREATE QUEUE name="allow-log"
-ACL DENY client CREATE QUEUE name="deny"
-ACL DENY-LOG client CREATE QUEUE name="deny-log"
diff --git a/qpid/java/systests/etc/test2-default.txt b/qpid/java/systests/etc/test2-default.txt
deleted file mode 100644
index 0855e631d7..0000000000
--- a/qpid/java/systests/etc/test2-default.txt
+++ /dev/null
@@ -1,21 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-# This section grants all access rights
-ACL ALLOW guest ALL ALL
\ No newline at end of file
diff --git a/qpid/java/systests/etc/virtualhosts-systests-aclv2-settings.xml b/qpid/java/systests/etc/virtualhosts-systests-aclv2-settings.xml
deleted file mode 100644
index db1ad33a39..0000000000
--- a/qpid/java/systests/etc/virtualhosts-systests-aclv2-settings.xml
+++ /dev/null
@@ -1,48 +0,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!--
- -
- - Licensed to the Apache Software Foundation (ASF) under one
- - or more contributor license agreements.  See the NOTICE file
- - distributed with this work for additional information
- - regarding copyright ownership.  The ASF licenses this file
- - to you under the Apache License, Version 2.0 (the
- - "License"); you may not use this file except in compliance
- - with the License.  You may obtain a copy of the License at
- -
- -   http://www.apache.org/licenses/LICENSE-2.0
- -
- - Unless required by applicable law or agreed to in writing,
- - software distributed under the License is distributed on an
- - "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- - KIND, either express or implied.  See the License for the
- - specific language governing permissions and limitations
- - under the License.
- -
- -->
-<virtualhosts>
-    <virtualhost>
-        <name>test</name>
-        <test>
-            <queues>
-                <exchange>amq.direct</exchange>
-                <!-- 4Mb -->
-                <maximumQueueDepth>4235264</maximumQueueDepth>
-                <!-- 2Mb -->
-                <maximumMessageSize>2117632</maximumMessageSize>
-                <!-- 10 mins -->
-                <maximumMessageAge>600000</maximumMessageAge>
-            </queues>
-
-            <security>
-                <aclv2>${QPID_HOME}/etc/test-default.txt</aclv2>
-            </security>
-        </test>
-    </virtualhost>
-
-    <virtualhost>
-        <name>test2</name>
-        <test2 />
-    </virtualhost>
-</virtualhosts>
-
-
diff --git a/qpid/java/systests/etc/virtualhosts-systests-aclv2.xml b/qpid/java/systests/etc/virtualhosts-systests-aclv2.xml
deleted file mode 100644
index db396d7ab1..0000000000
--- a/qpid/java/systests/etc/virtualhosts-systests-aclv2.xml
+++ /dev/null
@@ -1,29 +0,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<!--
- -
- - Licensed to the Apache Software Foundation (ASF) under one
- - or more contributor license agreements.  See the NOTICE file
- - distributed with this work for additional information
- - regarding copyright ownership.  The ASF licenses this file
- - to you under the Apache License, Version 2.0 (the
- - "License"); you may not use this file except in compliance
- - with the License.  You may obtain a copy of the License at
- -
- -   http://www.apache.org/licenses/LICENSE-2.0
- -
- - Unless required by applicable law or agreed to in writing,
- - software distributed under the License is distributed on an
- - "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- - KIND, either express or implied.  See the License for the
- - specific language governing permissions and limitations
- - under the License.
- -
- -->
-<configuration>
-    <system/>
-    <override>
-        <xml fileName="${QPID_HOME}/${test.virtualhosts}" optional="true"/>
-        <xml fileName="${QPID_HOME}/etc/virtualhosts-systests-aclv2-settings.xml"/>
-        <xml fileName="${QPID_HOME}/etc/virtualhosts.xml"/>
-    </override>
-</configuration>