[QPID-3844] Management ACL lacks the ability to perform queryMBean operation for non-admin users

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.15
• Fix Version/s: 0.15
• Component/s: Broker-J
• Assignee: Robbie Gemmell
• Reporter: Alex Rudyy
• Created: 15/Feb/12 14:44
• Updated: 11/Feb/15 20:06
• Resolved: 16/Feb/12 12:01

Description

Existing user accounts with limited rights (non admin uses) cannot login into management console due to error: "Permission denied: Access queryMBeans".

For example, ACL for the guest account can be configured like following

#Allow 'guest' to perform read operations on the Serverinformation mbean and view logger levels
ACL ALLOW-LOG guest ACCESS METHOD component="ServerInformation"
ACL ALLOW-LOG guest ACCESS METHOD component="LoggingManagement" name="viewEffectiveRuntimeLoggerLevels"

but "guest" user still is not be able to login because current implementation does not allow invocation of queryMBeans operation for non-admin accounts.