ARTEMIS-1372 ARTEMIS-1373 documentation updates
This commit is contained in:
gtully
parent
c8982d775b
commit
125bd41f9d
|
|
@ -78,7 +78,7 @@ public class LDAPLoginModule implements LoginModule {
|
|||
private static final String USER_ROLE_NAME = "userRoleName";
|
||||
private static final String EXPAND_ROLES = "expandRoles";
|
||||
private static final String EXPAND_ROLES_MATCHING = "expandRolesMatching";
|
||||
private static final String LOGIN_CONFIG_SCOPE = "loginConfigScope";
|
||||
private static final String SASL_LOGIN_CONFIG_SCOPE = "saslLoginConfigScope";
|
||||
private static final String AUTHENTICATE_USER = "authenticateUser";
|
||||
|
||||
protected DirContext context;
|
||||
|
|
@ -100,7 +100,7 @@ public class LDAPLoginModule implements LoginModule {
|
|||
this.subject = subject;
|
||||
this.handler = callbackHandler;
|
||||
|
||||
config = new LDAPLoginProperty[]{new LDAPLoginProperty(INITIAL_CONTEXT_FACTORY, (String) options.get(INITIAL_CONTEXT_FACTORY)), new LDAPLoginProperty(CONNECTION_URL, (String) options.get(CONNECTION_URL)), new LDAPLoginProperty(CONNECTION_USERNAME, (String) options.get(CONNECTION_USERNAME)), new LDAPLoginProperty(CONNECTION_PASSWORD, (String) options.get(CONNECTION_PASSWORD)), new LDAPLoginProperty(CONNECTION_PROTOCOL, (String) options.get(CONNECTION_PROTOCOL)), new LDAPLoginProperty(AUTHENTICATION, (String) options.get(AUTHENTICATION)), new LDAPLoginProperty(USER_BASE, (String) options.get(USER_BASE)), new LDAPLoginProperty(USER_SEARCH_MATCHING, (String) options.get(USER_SEARCH_MATCHING)), new LDAPLoginProperty(USER_SEARCH_SUBTREE, (String) options.get(USER_SEARCH_SUBTREE)), new LDAPLoginProperty(ROLE_BASE, (String) options.get(ROLE_BASE)), new LDAPLoginProperty(ROLE_NAME, (String) options.get(ROLE_NAME)), new LDAPLoginProperty(ROLE_SEARCH_MATCHING, (String) options.get(ROLE_SEARCH_MATCHING)), new LDAPLoginProperty(ROLE_SEARCH_SUBTREE, (String) options.get(ROLE_SEARCH_SUBTREE)), new LDAPLoginProperty(USER_ROLE_NAME, (String) options.get(USER_ROLE_NAME)), new LDAPLoginProperty(EXPAND_ROLES, (String) options.get(EXPAND_ROLES)), new LDAPLoginProperty(EXPAND_ROLES_MATCHING, (String) options.get(EXPAND_ROLES_MATCHING)), new LDAPLoginProperty(LOGIN_CONFIG_SCOPE, (String) options.get(LOGIN_CONFIG_SCOPE)), new LDAPLoginProperty(AUTHENTICATE_USER, (String) options.get(AUTHENTICATE_USER))};
|
||||
config = new LDAPLoginProperty[]{new LDAPLoginProperty(INITIAL_CONTEXT_FACTORY, (String) options.get(INITIAL_CONTEXT_FACTORY)), new LDAPLoginProperty(CONNECTION_URL, (String) options.get(CONNECTION_URL)), new LDAPLoginProperty(CONNECTION_USERNAME, (String) options.get(CONNECTION_USERNAME)), new LDAPLoginProperty(CONNECTION_PASSWORD, (String) options.get(CONNECTION_PASSWORD)), new LDAPLoginProperty(CONNECTION_PROTOCOL, (String) options.get(CONNECTION_PROTOCOL)), new LDAPLoginProperty(AUTHENTICATION, (String) options.get(AUTHENTICATION)), new LDAPLoginProperty(USER_BASE, (String) options.get(USER_BASE)), new LDAPLoginProperty(USER_SEARCH_MATCHING, (String) options.get(USER_SEARCH_MATCHING)), new LDAPLoginProperty(USER_SEARCH_SUBTREE, (String) options.get(USER_SEARCH_SUBTREE)), new LDAPLoginProperty(ROLE_BASE, (String) options.get(ROLE_BASE)), new LDAPLoginProperty(ROLE_NAME, (String) options.get(ROLE_NAME)), new LDAPLoginProperty(ROLE_SEARCH_MATCHING, (String) options.get(ROLE_SEARCH_MATCHING)), new LDAPLoginProperty(ROLE_SEARCH_SUBTREE, (String) options.get(ROLE_SEARCH_SUBTREE)), new LDAPLoginProperty(USER_ROLE_NAME, (String) options.get(USER_ROLE_NAME)), new LDAPLoginProperty(EXPAND_ROLES, (String) options.get(EXPAND_ROLES)), new LDAPLoginProperty(EXPAND_ROLES_MATCHING, (String) options.get(EXPAND_ROLES_MATCHING)), new LDAPLoginProperty(SASL_LOGIN_CONFIG_SCOPE, (String) options.get(SASL_LOGIN_CONFIG_SCOPE)), new LDAPLoginProperty(AUTHENTICATE_USER, (String) options.get(AUTHENTICATE_USER))};
|
||||
if (isLoginPropertySet(AUTHENTICATE_USER)) {
|
||||
authenticateUser = Boolean.valueOf(getLDAPPropertyValue(AUTHENTICATE_USER));
|
||||
}
|
||||
|
|
@ -526,7 +526,7 @@ public class LDAPLoginModule implements LoginModule {
|
|||
|
||||
if ("GSSAPI".equalsIgnoreCase(getLDAPPropertyValue(AUTHENTICATION))) {
|
||||
|
||||
final String configScope = isLoginPropertySet(LOGIN_CONFIG_SCOPE) ? getLDAPPropertyValue(LOGIN_CONFIG_SCOPE) : "broker-sasl-gssapi";
|
||||
final String configScope = isLoginPropertySet(SASL_LOGIN_CONFIG_SCOPE) ? getLDAPPropertyValue(SASL_LOGIN_CONFIG_SCOPE) : "broker-sasl-gssapi";
|
||||
try {
|
||||
LoginContext loginContext = new LoginContext(configScope);
|
||||
loginContext.login();
|
||||
|
|
|
|||
|
|
@ -459,7 +459,7 @@ managed using the X.500 system. It is implemented by `org.apache.activemq.artemi
|
|||
tree. For example, ldap://ldapserver:10389/ou=system.
|
||||
|
||||
- `authentication` - specifies the authentication method used when binding to the LDAP server. Can take either of
|
||||
the values, `simple` (username and password) or `none` (anonymous).
|
||||
the values, `simple` (username and password), `GSSAPI` (Kerberos SASL) or `none` (anonymous).
|
||||
|
||||
- `connectionUsername` - the DN of the user that opens the connection to the directory server. For example,
|
||||
`uid=admin,ou=system`. Directory servers generally require clients to present username/password credentials in order
|
||||
|
|
@ -468,6 +468,9 @@ managed using the X.500 system. It is implemented by `org.apache.activemq.artemi
|
|||
- `connectionPassword` - the password that matches the DN from `connectionUsername`. In the directory server,
|
||||
in the DIT, the password is normally stored as a `userPassword` attribute in the corresponding directory entry.
|
||||
|
||||
- `saslLoginConfigScope` - the scope in JAAS configuration (login.config) to use to obtain Kerberos initiator credentials
|
||||
when the `authentication` method is SASL `GSSAPI`. The default value is `broker-sasl-gssapi`.
|
||||
|
||||
- `connectionProtocol` - currently, the only supported value is a blank string. In future, this option will allow
|
||||
you to select the Secure Socket Layer (SSL) for the connection to the directory server. This option must be set
|
||||
explicitly to an empty string, because it has no default value.
|
||||
|
|
@ -536,6 +539,9 @@ managed using the X.500 system. It is implemented by `org.apache.activemq.artemi
|
|||
- `true` — try to match any entry belonging to the subtree of the roleBase node (maps to
|
||||
`javax.naming.directory.SearchControls.SUBTREE_SCOPE`).
|
||||
|
||||
- `authenticateUser` - boolean flag to disable authentication. Useful as an optimisation when this module is used just for
|
||||
role mapping of a Subject's existing authenticated principals; default is `false`.
|
||||
|
||||
- `debug` - boolean flag; if `true`, enable debugging; this is used only for testing or debugging; normally, it
|
||||
should be set to `false`, or omitted; default is `false`
|
||||
|
||||
|
|
@ -694,8 +700,9 @@ An example configuration scope for `login.config` that will pick up a Kerberos k
|
|||
#### Role Mapping
|
||||
|
||||
On the server, the Kerberos authenticated Peer Principal can be added to the Subject's principal set as an Apache ActiveMQ Artemis UserPrincipal
|
||||
using the Apache ActiveMQ Artemis `Krb5LoginModule` login module. The [PropertiesLoginModule](#propertiesloginmodule) can then be used to map
|
||||
the authenticated Kerberos Peer Principal to a [Role](#role-based-security-for-addresses).
|
||||
using the Apache ActiveMQ Artemis `Krb5LoginModule` login module. The [PropertiesLoginModule](#propertiesloginmodule) or
|
||||
[LDAPLoginModule](#ldaploginmodule) can then be used to map
|
||||
the authenticated Kerberos Peer Principal to an Apache ActiveMQ Artemis [Role](#role-based-security-for-addresses).
|
||||
|
||||
Note: the Kerberos Peer Principal does not exist as an Apache ActiveMQ Artemis user.
|
||||
|
||||
|
|
|
|||
|
|
@ -17,6 +17,7 @@
|
|||
package org.apache.activemq.artemis.tests.integration.amqp;
|
||||
|
||||
import javax.jms.Connection;
|
||||
import javax.jms.JMSSecurityException;
|
||||
import javax.jms.MessageConsumer;
|
||||
import javax.jms.MessageProducer;
|
||||
import javax.jms.Session;
|
||||
|
|
@ -33,6 +34,7 @@ import org.apache.activemq.artemis.core.server.ActiveMQServer;
|
|||
import org.apache.activemq.artemis.spi.core.security.ActiveMQJAASSecurityManager;
|
||||
import org.apache.activemq.artemis.utils.RandomUtil;
|
||||
import org.apache.hadoop.minikdc.MiniKdc;
|
||||
import org.apache.qpid.jms.JmsConnectionFactory;
|
||||
import org.junit.After;
|
||||
import org.junit.Before;
|
||||
import org.junit.Test;
|
||||
|
|
@ -150,4 +152,16 @@ public class JMSSaslGssapiTest extends JMSClientTestSupport {
|
|||
connection.close();
|
||||
}
|
||||
}
|
||||
|
||||
@Test(timeout = 600000)
|
||||
public void testSaslPlainConnectionDenied() throws Exception {
|
||||
|
||||
JmsConnectionFactory factory = new JmsConnectionFactory(new URI("amqp://localhost:" + AMQP_PORT + "?amqp.saslMechanisms=PLAIN"));
|
||||
try {
|
||||
factory.createConnection("plain", "secret");
|
||||
fail("Expect sasl failure");
|
||||
} catch (JMSSecurityException expected) {
|
||||
assertTrue(expected.getMessage().contains("SASL"));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -159,7 +159,7 @@ Krb5PlusLdap {
|
|||
initialContextFactory=com.sun.jndi.ldap.LdapCtxFactory
|
||||
connectionURL="ldap://localhost:1024"
|
||||
authentication=GSSAPI
|
||||
loginConfigScope=broker-sasl-gssapi
|
||||
saslLoginConfigScope=broker-sasl-gssapi
|
||||
connectionProtocol=s
|
||||
userBase="ou=users,dc=example,dc=com"
|
||||
userSearchMatching="(krb5PrincipalName={0})"
|
||||
|
|
|
|||
Loading…
Reference in New Issue