Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 649822

Summary: Need mechanism to limit access to QMF Agent methods
Product: Red Hat Enterprise MRG Reporter: Matthew Farrellee <matt>
Component: qpid-qmfAssignee: Ted Ross <tross>
Status: CLOSED ERRATA QA Contact: Frantisek Reznicek <freznice>
Severity: high Docs Contact:
Priority: high    
Version: 1.3CC: esammons, freznice, gsim, iboverma, jneedle, jsarenik
Target Milestone: 1.3.0.1Keywords: FutureFeature, Reopened
Target Release: ---   
Hardware: All   
OS: All   
Whiteboard:
Fixed In Version: Doc Type: Enhancement
Doc Text:
Prior to this update, no mechanism to limit access to QMFv2 Agent methods was available. With this update, an API hook was provided so that agent applications can perform their own access control based on an authentic identity.
Story Points: ---
Clone Of:
: 654422 (view as bug list) Environment:
Last Closed: 2010-11-30 17:51:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 644041, 649919, 654422    

Description Matthew Farrellee 2010-11-04 16:02:09 UTC
There is currently no mechanism to implement ACLs on QMFv2 Agent methods. QMFv1 had a means via the broker's ACL file.

This applies to at least qmf-0.7.946106-18.el5.

Comment 1 Ted Ross 2010-11-08 22:09:52 UTC
The proper solution to this is to enforce the policy at the agent, not the broker.  To this end, a new method call shall be added to the C++ agent API:

    Manageable::AuthorizeMethod

The writer of the agent may, optionally, implement this method alongside Manageable::ManagementMethod to provide authorization.  AuthorizeMethod is called immediately prior to ManagementMethod, with the method-id, method-arguments, and the authenticated user-id associated with the requestor.

The qmf-agent example shall be updated to illustrate this feature.

To test:

1) Build the example in cpp/examples/qmf-agent
2) Set the environment variable QPID_LOG_ENABLE to trace:CoreClass
3) Ensure that a broker is running on the local host
4) Run the example
5) Start qpid-tool
6) Look for an object of class "parent"
7) Call the "auth_fail" method on the object
   qpid: call 101 auth_fail
8) Observe that the method call failed with "forbidden"
9) View the log on the agent, observe that it logged an AuthorizeMethod with a user name

If the user-id is blank, try running qpid-tool with a url including a username.  This username should appear in the user-id argument to AuthorizeMethod.

Comment 2 Ted Ross 2010-11-08 22:22:07 UTC
Related upstream issue (with patch):

https://issues.apache.org/jira/browse/QPID-2934

Comment 4 Ted Ross 2010-11-09 21:19:31 UTC
Implemented upstream at rev 1033232.

Comment 6 Ted Ross 2010-11-10 01:29:20 UTC
I've pulled this BZ out of the errata for now because I am concerned that the scope of this change is too big for a bug-fix errata.  This commit breaks ABI and may require some dependent modules to be rebuilt.

This feature is probably more appropriate for the next rebase release.

Comment 7 RHEL Program Management 2010-11-10 01:34:55 UTC
Development Management has reviewed and declined this request.  You may appeal
this decision by reopening this request.

Comment 10 Frantisek Reznicek 2010-11-18 14:58:44 UTC
The feature has been implemented, tested on RHEL4.8 / 5.5 i386 / x86_64 on packages:
python-qmf-0.7.946106-14.el5
python-qpid-0.7.946106-14.el5
qmf-0.7.946106-22.el5
qmf-devel-0.7.946106-22.el5
qpid-cpp-client-0.7.946106-22.el5
qpid-cpp-client-devel-0.7.946106-22.el5
qpid-cpp-client-devel-docs-0.7.946106-22.el5
qpid-cpp-client-rdma-0.7.946106-22.el5
qpid-cpp-client-ssl-0.7.946106-22.el5
qpid-cpp-mrg-debuginfo-0.7.946106-21.el5
qpid-cpp-server-0.7.946106-22.el5
qpid-cpp-server-cluster-0.7.946106-22.el5
qpid-cpp-server-devel-0.7.946106-22.el5
qpid-cpp-server-rdma-0.7.946106-22.el5
qpid-cpp-server-ssl-0.7.946106-22.el5
qpid-cpp-server-store-0.7.946106-22.el5
qpid-cpp-server-xml-0.7.946106-22.el5
qpid-dotnet-0.4.738274-2.el5
qpid-java-client-0.7.946106-12.el5
qpid-java-common-0.7.946106-12.el5
qpid-java-example-0.7.946106-12.el5
qpid-tools-0.7.946106-11.el5
rh-qpid-cpp-tests-0.7.946106-22.el5
ruby-qmf-0.7.946106-22.el5
ruby-qpid-0.7.946106-2.el5

-> VERIFIED

Comment 12 errata-xmlrpc 2010-11-30 17:51:04 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2010-0921.html

Comment 13 Martin Prpič 2010-12-01 14:51:48 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Prior to this update, no mechanism to limit access to QMFv2 Agent methods was available. With this update, an API hook was provided so that agent applications can perform their own access control based on an authentic identity.