[
https://issues.apache.org/jira/browse/ARTEMIS-4420?focusedWorklogId=920342&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-920342
]
ASF GitHub Bot logged work on ARTEMIS-4420:
-------------------------------------------
Author: ASF GitHub Bot
Created on: 22/May/24 04:19
Start Date: 22/May/24 04:19
Worklog Time Spent: 10m
Work Description: jbertram commented on PR #4897:
URL:
https://github.com/apache/activemq-artemis/pull/4897#issuecomment-2123837290
@gtully, point taken. I've updated the PR with what I believe will address
the `ThreadLocal` issue. I wasn't able to come up with a way to test it
automatically, but manual tests (e.g. the use-case outlined in the Jira) is
working fine now.
Issue Time Tracking
-------------------
Worklog Id: (was: 920342)
Time Spent: 40m (was: 0.5h)
> User authentication leaks into non-Artemis servlets
> ---------------------------------------------------
>
> Key: ARTEMIS-4420
> URL: https://issues.apache.org/jira/browse/ARTEMIS-4420
> Project: ActiveMQ Artemis
> Issue Type: Bug
> Affects Versions: 2.30.0
> Reporter: Dries Harnie
> Priority: Minor
> Time Spent: 40m
> Remaining Estimate: 0h
>
> ActiveMQ Artemis supports audit logs, which log all administrative actions
> that happen on the broker.
> These logs identify the "current user" for an administrative access [by one
> of two
> methods|https://github.com/apache/activemq-artemis/blob/main/artemis-commons/src/main/java/org/apache/activemq/artemis/logs/AuditLogger.java#L67-L73]:
> # The {{Subject}} associated with the current security manager context, or
> # A {{{}ThreadLocal<Subject>{}}}, which is set by JolokiaFilter as part of
> interaction with the admin console.
> For a non-Artemis servlet such as [the metrics
> plugin|https://github.com/rh-messaging/artemis-prometheus-metrics-plugin],
> this {{ThreadLocal}} is set to whatever {{Subject}} made the previous request
> on this thread. This leads to situations where metric accesses are logged as
> being done by ghost users.
> To reproduce the issue:
> # Set up Artemis with the default admin/admin user and [the metrics
> plugin|https://github.com/rh-messaging/artemis-prometheus-metrics-plugin].
> # Enable audit logging ({{{}logger.audit_base{}}} should be at {{INFO}}
> level)
> # Tail -f the audit log and start the server
> # Log in to the admin console
> # Observe that a lot of audit logs fly by for {*}admin(amq)@127.0.0.1{*}.
> # Access the metrics with eg {{{}curl http://localhost:8161/metrics/{}}}.
> # Observe that a lot of audit logs fly by for {*}admin(amq)@127.0.0.1{*},
> even though these requests are completely anonymous.
>
> I think the solution involves a modification to
> {{org.apache.activemq.artemis.component.JolokiaFilter}} but I do not
> understand the purpose of the code after the {{doFilter}} invocation.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
