[AMQ-4567] JMX operations on broker bypass authorization plugin

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.8.0
• Fix Version/s: 5.9.0
• Component/s: Broker
• Labels: authorization
• Assignee: Dejan Bosanac
• Reporter: Torsten Mielke
• Created: 03/Jun/13 10:23
• Updated: 04/Nov/13 10:49
• Resolved: 04/Nov/13 10:49

Description

When securing the broker using authentication and authorization, any JMX operations on the broker completely bypass the authorization plugin.
So anyone can modify the broker bypassing the security checks. Also, because of this its not possible to define a read only user for the web console.