From 23de180dec4b523e67630d9215b6457459fc7020 Mon Sep 17 00:00:00 2001
From: Keith Wall <kwall@apache.org>
Date: Thu, 24 Nov 2011 10:43:24 +0000
Subject: QPID-3641: ACLV2 Simplifications and Improvements for Java Broker

Improvements and simplifications to ACL V2 for the Java Broker:
1) Removed 'EXECUTE' operation (we now just have ACCESS and UPDATE like C++ broker)
2) Enable users with management rights for a procedure to complete that procedure without matching AMQP rights (configurable)
3) Fix up system tests (make clearer, remove need for lots of support files)
4) Fix disparity in DENY_LOG and DENY-LOG values between brokers.
5) Get rid of transitive/expand permission rules

Work from Robbie Gemmell and myself.

git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1205782 13f79535-47bb-0310-9956-ffa450edef68
---
 qpid/java/broker/etc/broker_example.acl | 63 +++++++++++++++++++++++++++++++++
 qpid/java/broker/etc/config.xml         |  7 +++-
 2 files changed, 69 insertions(+), 1 deletion(-)
 create mode 100644 qpid/java/broker/etc/broker_example.acl

(limited to 'qpid/java/broker/etc')

diff --git a/qpid/java/broker/etc/broker_example.acl b/qpid/java/broker/etc/broker_example.acl
new file mode 100644
index 0000000000..93955bb7f9
--- /dev/null
+++ b/qpid/java/broker/etc/broker_example.acl
@@ -0,0 +1,63 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+### EXAMPLE ACL V2 FILE
+
+### DEFINE GROUPS ###
+
+#Define a 'messaging-users' group with users  'client' and  'server' in it
+GROUP messaging-users client server
+
+### MANAGEMENT ####
+
+#Allow 'guest' to perform read operations on the Serverinformation mbean and view logger levels
+ACL ALLOW-LOG guest ACCESS METHOD component="ServerInformation"
+ACL ALLOW-LOG guest ACCESS METHOD component="LoggingManagement" name="viewEffectiveRuntimeLoggerLevels"
+
+#Allow 'admin' all management operations
+ACL ALLOW-LOG admin ALL METHOD
+
+### MESSAGING ###
+
+#Example permissions for request-response based messaging.
+
+#Allow 'messaging-users' group to connect to the virtualhost
+ACL ALLOW-LOG messaging-users ACCESS VIRTUALHOST
+
+# Client side
+# Allow the 'client' user to publish requests to the request queue and create, consume from, and delete temporary reply queues.
+ACL ALLOW-LOG client CREATE QUEUE temporary="true"
+ACL ALLOW-LOG client CONSUME QUEUE temporary="true"
+ACL ALLOW-LOG client DELETE QUEUE temporary="true"
+ACL ALLOW-LOG client BIND EXCHANGE name="amq.direct" temporary="true"
+ACL ALLOW-LOG client UNBIND EXCHANGE name="amq.direct" temporary="true"
+ACL ALLOW-LOG client PUBLISH EXCHANGE name="amq.direct" routingKey="example.RequestQueue"
+
+# Server side
+# Allow the 'server' user to create and consume from the request queue and publish a response to the temporary response queue created by
+# client.
+ACL ALLOW-LOG server CREATE QUEUE name="example.RequestQueue"
+ACL ALLOW-LOG server CONSUME QUEUE name="example.RequestQueue"
+ACL ALLOW-LOG server BIND EXCHANGE
+ACL ALLOW-LOG server PUBLISH EXCHANGE name="amq.direct" routingKey="TempQueue*"
+
+### DEFAULT ###
+
+#Deny all users from performing all operations
+ACL DENY-LOG all all
diff --git a/qpid/java/broker/etc/config.xml b/qpid/java/broker/etc/config.xml
index d18e1392e6..389f380c31 100644
--- a/qpid/java/broker/etc/config.xml
+++ b/qpid/java/broker/etc/config.xml
@@ -80,7 +80,12 @@
             </principal-database>
         </pd-auth-manager>
 
-        <allow-all />
+        <!-- By default, all authenticated users have permissions to perform all actions -->
+
+        <!-- ACL V2 Example
+             This example illustrates securing the both Management (JMX) and Messaging.
+        <aclv2>${conf}/broker_example.acl</aclv2>
+        -->
         
         <msg-auth>false</msg-auth>
     </security>
-- 
cgit v1.2.1