[ https://issues.apache.org/jira/browse/KARAF-4600?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15356365#comment-15356365 ]
ASF subversion and git services commented on KARAF-4600: -------------------------------------------------------- Commit 5bf2185c2397753417072a5bdcf0b4c6a1ef6d13 in karaf's branch refs/heads/karaf-3.0.x from [~tadayosi] [ https://git-wip-us.apache.org/repos/asf?p=karaf.git;h=5bf2185 ] [KARAF-4600] RBAC - MBean fails to resolve ACL if the order of properties in object name differs (cherry picked from commit ce1b778138d4eee7992b25386aa19c6a7edaf384) (cherry picked from commit 1fe22425f9e0d3e0e6e2b40ebb02b9cfcbdbcae1) > RBAC - MBean fails to resolve ACL if the order of properties in object name > differs > ----------------------------------------------------------------------------------- > > Key: KARAF-4600 > URL: https://issues.apache.org/jira/browse/KARAF-4600 > Project: Karaf > Issue Type: Bug > Components: karaf-security > Affects Versions: 4.0.5 > Reporter: Tadayoshi Sato > Assignee: Freeman Fang > > An MBean: > {code} > org.apache.activemq:type=Broker,brokerName=amq-broker,destinationType=Queue,destinationName=TEST > {code} > has an ACL file with the following configuration: > {{etc/jmx.acl.org.apache.activemq.Broker._.Queue.cfg}} > {code} > browse* = viewer > {code} > While {{JMXSecurityMBean#canInvoke(String, String)}} returns {{true}} for the > viewer role on this object name: > {code} > org.apache.activemq:type=Broker,brokerName=amq-broker,destinationType=Queue,destinationName=TEST > {code} > and operation {{"browse"}}, it returns {{false}} on the canonical form of the > same object name and operation, i.e.: > {code} > org.apache.activemq:brokerName=amq-broker,destinationName=TEST,destinationType=Queue,type=Broker > {code} > and RBAC doesn't work correctly. > The root cause is that the resolution of ACL configuration is affected by the > order of properties in an object name. In the original form of the object > name, ACL resolves as: > {code} > org.apache.activemq.Broker.amq-broker.Queue.TEST > {code} > whereas in the canonical form it resolves as: > {code} > org.apache.activemq.Broker.amq-broker.TEST.Queue > {code} > and thus cannot find the correct ACL file (note the {{"type"}} property > precedes others due to KARAF-3020). -- This message was sent by Atlassian JIRA (v6.3.4#6332)