[AMQ-3749] Composite destinations break simple authorisation through role aggregation

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 5.5.1
• Fix Version/s: 5.6.0
• Component/s: Broker
• Labels: authorization composite security
• Assignee: Gary Tully
• Reporter: Gary Tully
• Created: 01/Mar/12 13:03
• Updated: 01/Mar/12 16:36
• Resolved: 01/Mar/12 13:08

Description

Given authorisation where there is overlap in roles, using a composite destination can gain access in error. eg:

  <authorizationMap>
    <authorizationEntries>
      <authorizationEntry queue=">" read="admins" write="admins" admin="admins" />
      <authorizationEntry queue="USER.>" read="users" write="users" admin="users" />
      ...

The correct expectation is that a 'user' can only access queues that match 'USER.>' but a user can bypass this and access a private queue using a composite destination q(PRIVATE,USER.A) because the permissions are aggregated in error and we look for a single match.