[QPID-2476] Complete ACL implementation for 0-10 code path

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.7, 0.9
• Component/s: Broker-J
• Labels: qpid security
• Assignee: Unassigned
• Reporter: Andrew Kennedy
• Created: 31/Mar/10 08:37
• Updated: 29/Feb/12 10:29
• Resolved: 29/Feb/12 10:29

Description

Complete ACL implementation for 0-10 code path, providing an ACLv2 implementation that covers the following features/requirements:

• Best practice security design
• Support for roles/groups
• Appropriate for standard stores for authorisation credentials (e.g. LDAP, Kerberos)
• Expressable as XML
• Easy to store/backup/extract ACL config
• Exception handling catching at point of ACL application and return to client via Connection ExceptionListener with correct error code, log failure in broker
• No significant performance cost on publish, permissions to be cached
• Security handled at correct level of abstraction internally
• Interoperability with existing ACLv2