[AMQ-6867] Multiple permissions of shiro in AMQ do not work

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 5.14.5
• Fix Version/s: WAITING_FOR_TEST
• Component/s: Security/JAAS
• Labels: authorization-plugin security shiro,

Environment

Linux x86/ jdk1.7/

• Assignee: Unassigned
• Reporter: Bowie HU
• Created: 23/Nov/17 01:58
• Updated: 27/Nov/17 06:33

Description

I changed the default authorization plugin to "shiro" authrization plugin and started testing it. Firstly I give all permissions to a role and it works. But when I set two permissions actions(write,admin) to a "role", producer cannot run and throw the exception("subject(user) is not authorized to create destination : ..."). After it, I changed permissions to "admin,write" and the exception became to "subject(user) is not authorized to write destination : ..." .
It seems that only the permission action which is in the first place is been set to the effective permission to a "role".
Anyone have any idea of it? THX

Here is my config file("shiro.ini"):
[main]

[users]
dmqs=dmqs,advisory,queue

[roles]
advisory = topic:ActiveMQ.Advisory*
queue = queue:queue.*:read,admin