Dries Harnie created ARTEMIS-4420:
-------------------------------------
Summary: User authentication leaks into non-Artemis servlets
Key: ARTEMIS-4420
URL: https://issues.apache.org/jira/browse/ARTEMIS-4420
Project: ActiveMQ Artemis
Issue Type: Bug
Affects Versions: 2.30.0
Reporter: Dries Harnie
ActiveMQ Artemis supports audit logs, which log all administrative actions that
happen on the broker.
These logs identify the "current user" for an administrative access [by one of
two
methods|https://github.com/apache/activemq-artemis/blob/main/artemis-commons/src/main/java/org/apache/activemq/artemis/logs/AuditLogger.java#L67-L73]:
# The {{Subject}} associated with the current security manager context, or
# A {{{}ThreadLocal<Subject>{}}}, which is set by JolokiaFilter as part of
interaction with the admin console.
For a non-Artemis servlet such as [the metrics
plugin|https://github.com/rh-messaging/artemis-prometheus-metrics-plugin], this
{{ThreadLocal}} is set to whatever {{Subject}} made the previous request on
this thread. This leads to situations where metric accesses are logged as being
done by ghost users.
To reproduce the issue:
# Set up Artemis with the default admin/admin user and [the metrics
plugin|https://github.com/rh-messaging/artemis-prometheus-metrics-plugin].
# Enable audit logging ({{{}logger.audit_base{}}} should be at {{INFO}} level)
# Tail -f the audit log and start the server
# Log in to the admin console
# Observe that a lot of audit logs fly by for {*}admin(amq)@127.0.0.1{*}.
# Access the metrics with eg {{{}curl http://localhost:8161/metrics/{}}}.
# Observe that a lot of audit logs fly by for {*}admin(amq)@127.0.0.1{*}, even
though these requests are completely anonymous.
I think the solution involves a modification to
{{org.apache.activemq.artemis.component.JolokiaFilter}} but I do not understand
the purpose of the code after the {{doFilter}} invocation.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
