[
https://issues.apache.org/jira/browse/DISPATCH-330?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Charles E. Rolke closed DISPATCH-330.
-------------------------------------
Fix Version/s: 0.8.0
Resolution: Fixed
Fixed in 0.8 at commit 6e094945 by Jakub Scholz
> Access control policy should return more suitable errors
> --------------------------------------------------------
>
> Key: DISPATCH-330
> URL: https://issues.apache.org/jira/browse/DISPATCH-330
> Project: Qpid Dispatch
> Issue Type: Bug
> Components: Policy Engine
> Affects Versions: 0.6.0
> Reporter: Jakub Scholz
> Assignee: Charles E. Rolke
> Priority: Major
> Fix For: Backlog, 0.8.0
>
>
> Currently, if some action is denied by the access control policy, it always
> returns amqp:resource-limit-exceeded error. This is fine when the deny was
> issues because of a limit (e.g.number of connections, sessions etc.).
> But when the action is denied for different reasons - e.g. because of
> unallowed target / source, amqp:unauthorized-access would be much more
> suitable than amqp:resource-limit-exceeded. As an example, see the situation
> below.
> Mon May 9 09:12:47 2016 SERVER (trace) [4]:0 <- @attach(18)
> [name="request.ABCFR_ABCFRALMMACC1_113876ee-c7a3-4760-8e97-32d66e8ff0f1",
> handle=0, role=false, snd-settle-mode=2, rcv-settle-mode=0,
> source=@source(40) [address="request.ABCFR_ABCFRALMMACC1", durable=0,
> timeout=0, dynamic=false], target=@target(41)
> [address="request.ABCFR_ABCFRALMMACC1", durable=0, timeout=0, dynamic=false,
> capabili
> ties=:topic], initial-delivery-count=0]
> Mon May 9 09:12:47 2016 POLICY (info) DENY AMQP Attach sender link
> 'request.ABCFR_ABCFRALMMACC1' for user 'admin@QPID', host '127.0.0.1', app
> '(null)' based on link target name
> Mon May 9 09:12:47 2016 SERVER (trace) [4]:0 -> @attach(18)
> [name="request.ABCFR_ABCFRALMMACC1_113876ee-c7a3-4760-8e97-32d66e8ff0f1",
> handle=0, role=true, snd-settle-mode=2, rcv-settle-mode=0, source=@source(40)
> [durable=0, timeout=0, dynamic=false], target=@target(41) [durable=0,
> timeout=0, dynamic=false], initial-delivery-count=0]
> Mon May 9 09:12:47 2016 SERVER (trace) [4]:RAW:
> "\x00\x00\x00\x8f\x02\x00\x00\x00\x00S\x12\xd0\x00\x00\x00\x7f\x00\x00\x00\x0a\xa1@request.ABCFR_ABCFRALMMACC1_113876ee-c7a3-4760-8e97-32d66e8ff0f1R\x00AP\x02P\x00\x00S(\xd0\x00\x00\x00\x11\x00\x00\x00\x0b@R\x00@R\x00B@@@@@@\x00S)\xd0\x00\x00\x00\x0d\x00\x00\x00\x07@R\x00@R\x00B@@@@R\x00"
> Mon May 9 09:12:47 2016 SERVER (trace) [4]:0 -> @detach(22) [handle=0,
> closed=true, error=@error(29) [condition=:"amqp:resource-limit-exceeded",
> description="link disallowed by local policy"]]
> Mon May 9 09:12:47 2016 SERVER (trace) [4]:RAW:
> "\x00\x00\x00c\x02\x00\x00\x00\x00S\x16\xd0\x00\x00\x00S\x00\x00\x00\x03R\x00A\x00S\x1d\xd0\x00\x00\x00D\x00\x00\x00\x03\xa3\x1camqp:resource-limit-exceeded\xa1\x1flink
> disallowed by local policy@"
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@qpid.apache.org
For additional commands, e-mail: dev-h...@qpid.apache.org
