Description of problem: ManagementPermissionAuthorizer.authorizeJmxOperation uses hard coded decision making based on the standard 7 roles. This is inflexible and specifically doesn't allow scoped roles to function properly. Steps to Reproduce: 1. Create a server-group-scoped-role and assign a user ("testuser") to that role: <management> <access-control provider="rbac"> <server-group-scoped-roles> <role name="test_main_server_grp" base-role="SuperUser"> <server-group name="main-server-group"/> </role> </server-group-scoped-roles> <role-mapping> <role name="SuperUser"> <include> <user name="$local"/> <user alias="jconsole" realm="ApplicationRealm" name="jconsole"/> </include> </role> <role name="test_main_server_grp"> <include> <user alias="testuser" realm="ApplicationRealm" name="testuser"/> </include> </role> </role-mapping> </access-control> </management> 2. Deploy an mbean 3. Use bin/jconsole.sh to connect as the "testuser" 4. Try to modify the mbean. "testuser" should have access to modify the mbean.
Created attachment 1037416 [details] ee6-singleton-mbean.jar
More reproducer notes: - deploy the attached ee6-singleton-mbean.jar - try to modify attribute of "com.jboss.examples.ee6.ejb:type=EE6ExampleSingleton"
Retroactively bulk-closing issues from released EAP 6.4 cumulative patches.