Bug 649822
| Summary: | Need mechanism to limit access to QMF Agent methods | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise MRG | Reporter: | Matthew Farrellee <matt> | |
| Component: | qpid-qmf | Assignee: | Ted Ross <tross> | |
| Status: | CLOSED ERRATA | QA Contact: | Frantisek Reznicek <freznice> | |
| Severity: | high | Docs Contact: | ||
| Priority: | high | |||
| Version: | 1.3 | CC: | esammons, freznice, gsim, iboverma, jneedle, jsarenik | |
| Target Milestone: | 1.3.0.1 | Keywords: | FutureFeature, Reopened | |
| Target Release: | --- | |||
| Hardware: | All | |||
| OS: | All | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Enhancement | ||
| Doc Text: |
Prior to this update, no mechanism to limit access to QMFv2 Agent methods was available. With this update, an API hook was provided so that agent applications can perform their own access control based on an authentic identity.
|
Story Points: | --- | |
| Clone Of: | ||||
| : | 654422 (view as bug list) | Environment: | ||
| Last Closed: | 2010-11-30 17:51:04 UTC | Type: | --- | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 644041, 649919, 654422 | |||
|
Description
Matthew Farrellee
2010-11-04 16:02:09 UTC
The proper solution to this is to enforce the policy at the agent, not the broker. To this end, a new method call shall be added to the C++ agent API:
Manageable::AuthorizeMethod
The writer of the agent may, optionally, implement this method alongside Manageable::ManagementMethod to provide authorization. AuthorizeMethod is called immediately prior to ManagementMethod, with the method-id, method-arguments, and the authenticated user-id associated with the requestor.
The qmf-agent example shall be updated to illustrate this feature.
To test:
1) Build the example in cpp/examples/qmf-agent
2) Set the environment variable QPID_LOG_ENABLE to trace:CoreClass
3) Ensure that a broker is running on the local host
4) Run the example
5) Start qpid-tool
6) Look for an object of class "parent"
7) Call the "auth_fail" method on the object
qpid: call 101 auth_fail
8) Observe that the method call failed with "forbidden"
9) View the log on the agent, observe that it logged an AuthorizeMethod with a user name
If the user-id is blank, try running qpid-tool with a url including a username. This username should appear in the user-id argument to AuthorizeMethod.
Related upstream issue (with patch): https://issues.apache.org/jira/browse/QPID-2934 Implemented upstream at rev 1033232. I've pulled this BZ out of the errata for now because I am concerned that the scope of this change is too big for a bug-fix errata. This commit breaks ABI and may require some dependent modules to be rebuilt. This feature is probably more appropriate for the next rebase release. Development Management has reviewed and declined this request. You may appeal this decision by reopening this request. The feature has been implemented, tested on RHEL4.8 / 5.5 i386 / x86_64 on packages: python-qmf-0.7.946106-14.el5 python-qpid-0.7.946106-14.el5 qmf-0.7.946106-22.el5 qmf-devel-0.7.946106-22.el5 qpid-cpp-client-0.7.946106-22.el5 qpid-cpp-client-devel-0.7.946106-22.el5 qpid-cpp-client-devel-docs-0.7.946106-22.el5 qpid-cpp-client-rdma-0.7.946106-22.el5 qpid-cpp-client-ssl-0.7.946106-22.el5 qpid-cpp-mrg-debuginfo-0.7.946106-21.el5 qpid-cpp-server-0.7.946106-22.el5 qpid-cpp-server-cluster-0.7.946106-22.el5 qpid-cpp-server-devel-0.7.946106-22.el5 qpid-cpp-server-rdma-0.7.946106-22.el5 qpid-cpp-server-ssl-0.7.946106-22.el5 qpid-cpp-server-store-0.7.946106-22.el5 qpid-cpp-server-xml-0.7.946106-22.el5 qpid-dotnet-0.4.738274-2.el5 qpid-java-client-0.7.946106-12.el5 qpid-java-common-0.7.946106-12.el5 qpid-java-example-0.7.946106-12.el5 qpid-tools-0.7.946106-11.el5 rh-qpid-cpp-tests-0.7.946106-22.el5 ruby-qmf-0.7.946106-22.el5 ruby-qpid-0.7.946106-2.el5 -> VERIFIED An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2010-0921.html
Technical note added. If any revisions are required, please edit the "Technical Notes" field
accordingly. All revisions will be proofread by the Engineering Content Services team.
New Contents:
Prior to this update, no mechanism to limit access to QMFv2 Agent methods was available. With this update, an API hook was provided so that agent applications can perform their own access control based on an authentic identity.
|