Examples with ActiveMQSecurityManager2 org.apache.activemq.artemis.spi.core.security.ActiveMQSecurityManager2 used on opensource projects

Example 1 with ActiveMQSecurityManager2

use of org.apache.activemq.artemis.spi.core.security.ActiveMQSecurityManager2 in project activemq-artemis by apache.

the class SecurityStoreImpl method authenticate.

@Override
public String authenticate(final String user, final String password, RemotingConnection connection) throws Exception {
    if (securityEnabled) {
        if (managementClusterUser.equals(user)) {
            if (logger.isTraceEnabled()) {
                logger.trace("Authenticating cluster admin user");
            }
            /*
             * The special user cluster user is used for creating sessions that replicate management
             * operation between nodes
             */
            if (!managementClusterPassword.equals(password)) {
                throw ActiveMQMessageBundle.BUNDLE.unableToValidateClusterUser(user);
            } else {
                return managementClusterUser;
            }
        }
        String validatedUser = null;
        boolean userIsValid = false;
        if (securityManager instanceof ActiveMQSecurityManager3) {
            validatedUser = ((ActiveMQSecurityManager3) securityManager).validateUser(user, password, connection);
        } else if (securityManager instanceof ActiveMQSecurityManager2) {
            userIsValid = ((ActiveMQSecurityManager2) securityManager).validateUser(user, password, CertificateUtil.getCertsFromConnection(connection));
        } else {
            userIsValid = securityManager.validateUser(user, password);
        }
        if (!userIsValid && validatedUser == null) {
            if (notificationService != null) {
                TypedProperties props = new TypedProperties();
                Notification notification = new Notification(null, CoreNotificationType.SECURITY_AUTHENTICATION_VIOLATION, props);
                notificationService.sendNotification(notification);
            }
            String certSubjectDN = "unavailable";
            X509Certificate[] certs = CertificateUtil.getCertsFromConnection(connection);
            if (certs != null && certs.length > 0 && certs[0] != null) {
                certSubjectDN = certs[0].getSubjectDN().getName();
            }
            throw ActiveMQMessageBundle.BUNDLE.unableToValidateUser(connection.getRemoteAddress(), user, certSubjectDN);
        }
        return validatedUser;
    }
    return null;
}

Example 2 with ActiveMQSecurityManager2

use of org.apache.activemq.artemis.spi.core.security.ActiveMQSecurityManager2 in project activemq-artemis by apache.

the class StompProtocolManager method validateUser.

public boolean validateUser(String login, String passcode, RemotingConnection remotingConnection) {
    boolean validated = true;
    ActiveMQSecurityManager sm = server.getSecurityManager();
    if (sm != null && server.getConfiguration().isSecurityEnabled()) {
        if (sm instanceof ActiveMQSecurityManager3) {
            validated = ((ActiveMQSecurityManager3) sm).validateUser(login, passcode, remotingConnection) != null;
        } else if (sm instanceof ActiveMQSecurityManager2) {
            validated = ((ActiveMQSecurityManager2) sm).validateUser(login, passcode, CertificateUtil.getCertsFromConnection(remotingConnection));
        } else {
            validated = sm.validateUser(login, passcode);
        }
    }
    return validated;
}

Example 3 with ActiveMQSecurityManager2

use of org.apache.activemq.artemis.spi.core.security.ActiveMQSecurityManager2 in project activemq-artemis by apache.

the class SecurityTest method testCustomSecurityManager2.

@Test
public void testCustomSecurityManager2() throws Exception {
    final Configuration configuration = createDefaultInVMConfig().setSecurityEnabled(true);
    final ActiveMQSecurityManager customSecurityManager = new ActiveMQSecurityManager2() {

        @Override
        public boolean validateUser(final String username, final String password) {
            fail("Unexpected call to overridden method");
            return false;
        }

        @Override
        public boolean validateUser(final String username, final String password, final X509Certificate[] certificates) {
            return (username.equals("foo") || username.equals("bar") || username.equals("all")) && password.equals("frobnicate");
        }

        @Override
        public boolean validateUserAndRole(final String username, final String password, final Set<Role> requiredRoles, final CheckType checkType) {
            fail("Unexpected call to overridden method");
            return false;
        }

        @Override
        public boolean validateUserAndRole(final String username, final String password, final Set<Role> requiredRoles, final CheckType checkType, final String address, final RemotingConnection connection) {
            if (!(connection.getTransportConnection() instanceof InVMConnection)) {
                return false;
            }
            if ((username.equals("foo") || username.equals("bar") || username.equals("all")) && password.equals("frobnicate")) {
                if (username.equals("all")) {
                    return true;
                } else if (username.equals("foo")) {
                    return address.equals("test.queue") && checkType == CheckType.CONSUME;
                } else if (username.equals("bar")) {
                    return address.equals("test.queue") && checkType == CheckType.SEND;
                } else {
                    return false;
                }
            } else {
                return false;
            }
        }
    };
    final ActiveMQServer server = addServer(new ActiveMQServerImpl(configuration, customSecurityManager));
    server.start();
    final ServerLocator locator = createInVMNonHALocator();
    locator.setBlockOnNonDurableSend(true).setBlockOnDurableSend(true);
    final ClientSessionFactory factory = createSessionFactory(locator);
    ClientSession adminSession = factory.createSession("all", "frobnicate", false, true, true, false, -1);
    final String queueName = "test.queue";
    adminSession.createQueue(queueName, queueName, false);
    final String otherQueueName = "other.queue";
    adminSession.createQueue(otherQueueName, otherQueueName, false);
    // Wrong user name
    try {
        factory.createSession("baz", "frobnicate", false, true, true, false, -1);
        Assert.fail("should throw exception");
    } catch (ActiveMQSecurityException se) {
    // ok
    } catch (ActiveMQException e) {
        fail("Invalid Exception type:" + e.getType());
    }
    // Wrong password
    try {
        factory.createSession("foo", "xxx", false, true, true, false, -1);
        Assert.fail("should throw exception");
    } catch (ActiveMQSecurityException se) {
    // ok
    } catch (ActiveMQException e) {
        fail("Invalid Exception type:" + e.getType());
    }
    // Correct user and password, wrong queue for sending
    try {
        final ClientSession session = factory.createSession("foo", "frobnicate", false, true, true, false, -1);
        checkUserReceiveNoSend(otherQueueName, session, adminSession);
        Assert.fail("should throw exception");
    } catch (ActiveMQSecurityException se) {
    // ok
    } catch (ActiveMQException e) {
        fail("Invalid Exception type:" + e.getType());
    }
    // Correct user and password, wrong queue for receiving
    try {
        final ClientSession session = factory.createSession("foo", "frobnicate", false, true, true, false, -1);
        checkUserReceiveNoSend(otherQueueName, session, adminSession);
        Assert.fail("should throw exception");
    } catch (ActiveMQSecurityException se) {
    // ok
    } catch (ActiveMQException e) {
        fail("Invalid Exception type:" + e.getType());
    }
    // Correct user and password, allowed to send but not receive
    {
        final ClientSession session = factory.createSession("foo", "frobnicate", false, true, true, false, -1);
        checkUserReceiveNoSend(queueName, session, adminSession);
    }
    // Correct user and password, allowed to receive but not send
    {
        final ClientSession session = factory.createSession("bar", "frobnicate", false, true, true, false, -1);
        checkUserSendNoReceive(queueName, session);
    }
}

Example 4 with ActiveMQSecurityManager2

use of org.apache.activemq.artemis.spi.core.security.ActiveMQSecurityManager2 in project activemq-artemis by apache.

the class SecurityStoreImpl method check.

@Override
public void check(final SimpleString address, final SimpleString queue, final CheckType checkType, final SecurityAuth session) throws Exception {
    if (securityEnabled) {
        if (logger.isTraceEnabled()) {
            logger.trace("checking access permissions to " + address);
        }
        String user = session.getUsername();
        if (checkCached(address, user, checkType)) {
            // OK
            return;
        }
        String saddress = address.toString();
        Set<Role> roles = securityRepository.getMatch(saddress);
        // bypass permission checks for management cluster user
        if (managementClusterUser.equals(user) && session.getPassword().equals(managementClusterPassword)) {
            return;
        }
        final boolean validated;
        if (securityManager instanceof ActiveMQSecurityManager3) {
            final ActiveMQSecurityManager3 securityManager3 = (ActiveMQSecurityManager3) securityManager;
            validated = securityManager3.validateUserAndRole(user, session.getPassword(), roles, checkType, saddress, session.getRemotingConnection()) != null;
        } else if (securityManager instanceof ActiveMQSecurityManager2) {
            final ActiveMQSecurityManager2 securityManager2 = (ActiveMQSecurityManager2) securityManager;
            validated = securityManager2.validateUserAndRole(user, session.getPassword(), roles, checkType, saddress, session.getRemotingConnection());
        } else {
            validated = securityManager.validateUserAndRole(user, session.getPassword(), roles, checkType);
        }
        if (!validated) {
            if (notificationService != null) {
                TypedProperties props = new TypedProperties();
                props.putSimpleStringProperty(ManagementHelper.HDR_ADDRESS, address);
                props.putSimpleStringProperty(ManagementHelper.HDR_CHECK_TYPE, new SimpleString(checkType.toString()));
                props.putSimpleStringProperty(ManagementHelper.HDR_USER, SimpleString.toSimpleString(user));
                Notification notification = new Notification(null, CoreNotificationType.SECURITY_PERMISSION_VIOLATION, props);
                notificationService.sendNotification(notification);
            }
            if (queue == null) {
                throw ActiveMQMessageBundle.BUNDLE.userNoPermissions(session.getUsername(), checkType, saddress);
            } else {
                throw ActiveMQMessageBundle.BUNDLE.userNoPermissionsQueue(session.getUsername(), checkType, queue.toString(), saddress);
            }
        }
        // if we get here we're granted, add to the cache
        ConcurrentHashSet<SimpleString> set = new ConcurrentHashSet<>();
        ConcurrentHashSet<SimpleString> act = cache.putIfAbsent(user + "." + checkType.name(), set);
        if (act != null) {
            set = act;
        }
        set.add(address);
    }
}