Re: LDAP Authorization
On 7/21/06, ngcutura <[EMAIL PROTECTED]> wrote: (hyperlinked file below) http://www.nabble.com/user-files/72/LdapAuth.zip LdapAuth.zip This is the best I could come up with. Please take a look at LDAPAuthorizationMap.java and LDAPAuthorizationMap.xml. If they seem OK please tell em the next steps to actually use it in AMQ. I'll take a look I was not able to use JIRA to upload this archive. It says that more operations are available if I were logged in. How do I (should I) log in to JIRA? So you need to register and login to JIRA then you are able to report new issues, comment on issues or attach patches/files to issues etc -- James --- http://radio.weblogs.com/0112098/
Re: LDAP Authorization
Thanks! The patch is not coomplete yet. I still need help with integration into AMQ (Spring style properties) to be able to use it. (copied from previous post) I am not familiar with Spring and I was not able to deduce how to specify module properties in AMQ XML config file. I need help with this and I would very much appreciate the following: - given the LDAPAuthorizationMap.properties file produce XML file - given the LDAPAuthorizationMap.java add code changes to accept properties from XML file above Is there any documentation on this that I can read? Thanks and regards, NGC James.Strachan wrote: > > On 7/17/06, James Strachan <[EMAIL PROTECTED]> wrote: >> On 7/17/06, ngcutura <[EMAIL PROTECTED]> wrote: >> > > I saw an entry in JIRA "AMQ-376". Would this be appropriate or >> another one >> > > is required? >> > > Can I create entry in JIRA as unprivileged user? I didn't try, to be >> > > honest, I thought that someone from the development team is >> authorized to >> > > manage entries in JIRA. :-)Anyone who registers with JIRA can create >> new JIRA issues. >> >> Anyone can create JIRA issues... >> >> http://incubator.apache.org/activemq/support.html >> >> Though we need to assign karma to you if someone wants to assign an >> issue to themselves >> >> http://incubator.apache.org/activemq/contributing.html > > I've created a JIRA for you so we can track the patch's progress etc. > > http://issues.apache.org/activemq/browse/AMQ-826 > > -- > > James > --- > http://radio.weblogs.com/0112098/ > > -- View this message in context: http://www.nabble.com/LDAP-Authorization-tf1851705.html#a5367147 Sent from the ActiveMQ - Dev forum at Nabble.com.
Re: LDAP Authorization
On 7/17/06, ngcutura <[EMAIL PROTECTED]> wrote:
James.Strachan wrote:
>
>> Sounds great! I didn't see an attachment - I wonder it might be easier
>> if you raised a JIRA and attached your zip to the JIRA issue?
>
>
> Attachment is hyperlinked below sentnece "Attached is a zip archive with 4
> files:" in original post.
> ("LdapAuth.zip" is hyperlinked; clicking this link opens file download.)
Ah - it seems to have got stripped from the emails (or at least gmail
stripped it) but its visible on nabble.com.
> I saw an entry in JIRA "AMQ-376". Would this be appropriate or another one
> is required?
> Can I create entry in JIRA as unprivileged user? I didn't try, to be
> honest, I thought that someone from the development team is authorized to
> manage entries in JIRA. :-)Anyone who registers with JIRA can create new JIRA
issues.
Anyone can create JIRA issues...
http://incubator.apache.org/activemq/support.html
Though we need to assign karma to you if someone wants to assign an
issue to themselves
http://incubator.apache.org/activemq/contributing.html
--
James
---
http://radio.weblogs.com/0112098/
Re: LDAP Authorization
James.Strachan wrote:
>
>> Sounds great! I didn't see an attachment - I wonder it might be easier
>> if you raised a JIRA and attached your zip to the JIRA issue?
>
>
> Attachment is hyperlinked below sentnece "Attached is a zip archive with 4
> files:" in original post.
> ("LdapAuth.zip" is hyperlinked; clicking this link opens file download.)
>
> I saw an entry in JIRA "AMQ-376". Would this be appropriate or another one
> is required?
> Can I create entry in JIRA as unprivileged user? I didn't try, to be
> honest, I thought that someone from the development team is authorized to
> manage entries in JIRA. :-)
>
> Regards,
> NGC
>
> On 7/15/06, ngcutura <[EMAIL PROTECTED]> wrote:
>>
>> Hi all,
>>
>> I followed James' advice and created simple LDAPAuthorizationMap. It has
>> no
>> support for wildcards or composite destinations at the moment.
>>
>> Attached is a zip archive with 4 files:
>> LdapAuth.zip
>> - LDAPAuthorizationMap.java (module code)
>> - LDAPAuthorizationMapTest.java (module test)
>> - LDAPAuthorizationMap.properties (list of module properties)
>> - AMQAuth.ldif (sample directory used for testing)
>>
>> Module works through JUnit tests. To run the tests you need to setup a
>> directory. I used ApacheDS; export of my sample directory is in the file
>> AMQAuth.ldif. Contents of this file is also present in
>> LDAPAuthorizationMapTest.java.
>>
>> I am not familiar with Spring and I was not able to deduce how to specify
>> module properties in AMQ XML config file. I need help with this and I
>> would
>> very much appreciate the following:
>> - given the LDAPAuthorizationMap.properties file produce XML file
>> - given the LDAPAuthorizationMap.java add code changes to accept
>> properties
>> from XML file above
>>
>> I am pretty much sure that my choice of constructor taking Map as
>> argument
>> is inappropraite but having no knowledge of Spring one choice was as good
>> as
>> another for me.
>>
>> Regards,
>> NGC
>>
>> James.Strachan wrote:
>> >
>> > On 6/29/06, ngcutura <[EMAIL PROTECTED]> wrote:
>> >>
>> >> Thank you for reply.
>> >>
>> >> There is no in security example but
>> this
>> >> is
>> >> quite important.
>> >
>> > Thats just a way to instantiate some JavaBean using regular Spring
>> style
>> > syntax.
>> >
>> >> Is there some default class like DefaultAuthorizationMap?
>> >
>> > Yes - by all means derive from that if you want.
>> >
>> >> What would this declaration be exactly for the security example you
>> >> referred
>> >> to?
>> >>
>> >> I think I can manage AuthorizationEntry by subclassing it or adding
>> >> another
>> >> parse() method.
>> >
>> > You could ignore the DefaultAuthorizationMap/AuthorizationEntry
>> > entirely and just walk JNDI/LDAP and create a set of GroupPrincipal
>> > POJOs for each group for a given role & destination). It might be
>> > simpler than trying to understand how the DefaultAuthorizationMap.
>> >
>> > Note that DefaultAuthorizationMap is essentially an in-memory cache of
>> > the results; you probably want to look at JNDI/LDAP at runtime to
>> > ensure up to date values.
>> >
>> >> I'll be on vacation next week but I'll continue with the work after
>> the
>> >> WC
>> >> finals. ;-)
>> >
>> > Great! :)
>> >
>> > (Here's hoping England actually start playing football soon... :-)
>> >
>> >
>> > --
>> >
>> > James
>> > ---
>> > http://radio.weblogs.com/0112098/
>> >
>> >
>> --
>> View this message in context:
>> http://www.nabble.com/LDAP-Authorization-tf1851705.html#a5344494
>> Sent from the ActiveMQ - Dev forum at Nabble.com.
>>
>>
>
>
> --
>
> James
> ---
> http://radio.weblogs.com/0112098/
>
>
--
View this message in context:
http://www.nabble.com/LDAP-Authorization-tf1851705.html#a5359733
Sent from the ActiveMQ - Dev forum at Nabble.com.
Re: LDAP Authorization
On 6/29/06, ngcutura <[EMAIL PROTECTED]> wrote: Thank you for reply. There is no in security example but this is quite important. Thats just a way to instantiate some JavaBean using regular Spring style syntax. Is there some default class like DefaultAuthorizationMap? Yes - by all means derive from that if you want. What would this declaration be exactly for the security example you referred to? I think I can manage AuthorizationEntry by subclassing it or adding another parse() method. You could ignore the DefaultAuthorizationMap/AuthorizationEntry entirely and just walk JNDI/LDAP and create a set of GroupPrincipal POJOs for each group for a given role & destination). It might be simpler than trying to understand how the DefaultAuthorizationMap. Note that DefaultAuthorizationMap is essentially an in-memory cache of the results; you probably want to look at JNDI/LDAP at runtime to ensure up to date values. I'll be on vacation next week but I'll continue with the work after the WC finals. ;-) Great! :) (Here's hoping England actually start playing football soon... :-) -- James --- http://radio.weblogs.com/0112098/
Re: LDAP Authorization
Thank you for reply. There is no in security example but this is quite important. Is there some default class like DefaultAuthorizationMap? What would this declaration be exactly for the security example you referred to? I think I can manage AuthorizationEntry by subclassing it or adding another parse() method. I'll be on vacation next week but I'll continue with the work after the WC finals. ;-) Thanks and regards, NGC -- View this message in context: http://www.nabble.com/LDAP-Authorization-tf1851705.html#a5103210 Sent from the ActiveMQ - Dev forum at Nabble.com.
Re: LDAP Authorization
On 6/26/06, ngcutura <[EMAIL PROTECTED]> wrote: Hi, I am working on LDAPAuthorizationMap to enable use of LDAP for storing access privilege information. The project I am engaged in requires dynamic creation of destinations and users so external source of authentication and authorization information is crucial. I checked out code from SVN and managed to build it with Maven and Eclipse. Thanks to Hiram and James for instructions. :-) The idea of LDAPAuthorizationMap is simple: there is hierarchy like this one: destinations topic topicA read: role1 read: role2 write: role3 admin: role2 queue queue1 read: roleA write: roleB write: roleC admin: roleD It is quite easy to obtain read, write and admin ACLs from this hierarchy. However, looking at the code of DefaultAthorizationMap, AuthorizationEntry, DestinationMap and DestinationMapEntry I cannot clearly differentiate between default behaviour of AuthorizationMap (except for the interface) and implementation specifics of authorization map defined in AMQ config file. So the AuthorizationMap interface can be implemented however you wish. The DefaultAuthorizationMap derives from the DestinationMap to be able to associate wildcards with 'entries' where an entry is an AuthorizationEntry which defines the set of ACLs for read/write/admin roles. This allows you to associate a single entry (set of ACLs) with a destination or wildcard. Now if you want to go to LDAP each time and are not too worried about wildcard support, you could just implement the AuthorizationMap interface directory and for each of the methods, just walk JNDI/LDAP to find the set of ACLs for read, write, admin for the given destination. My questions (that I believe will clear something out for me): - how are authorization data from AMQ config file passed to the code? I believe it is DefaultAuthorizationMap or SimpleAuthorizationMap. Any implementation of AuthorizationMap is passed into the AuthorizationPlugin via its "map" property using introspection. See http://incubator.apache.org/activemq/security.html for an example. You could add your own using Spring stufff... http://activemq.org/config/1.0";> ... - how should I specify LDAP configuration in AMQ config? Via properties on your POJO then we can use Spring / XBean to wire them all up. e.g. can you specify properties on your POJO then we can use dependency injection to wire them in. These config information are similar to those of LDAPLoginModule which are specified in java VM login policy file. - AuthorizationMap is supposed to return Set of privileged Principals. DefaultAuthorizationMap relies on AuthorizationEntry that seems specific to AMQ config file (parseACLs(String) method parses String from config file). Am I supposed to create a subclass of AuthorizationEntry that will return information parsed from LDAP server? The AuthorizationEntry just makes a set of GroupPrincipal objects (a little helper class). Maybe you could just reuse it as the element inside the Set of groups - you just need to give it a String constructor? -- James --- http://radio.weblogs.com/0112098/
