How to make authorization on endpoints working

[radomir.kadlec]

Hello,

I will use authorization on my cxfbc:consumer endpoints. So I will order diffrent user roles to my endpoints to allow the access only for users owning the dedicated role.

I use DefaultAuthorizationEntry in the Spring configuration as described in this manual:

http://servicemix.apache.org/SMX4NMR/5-security.html

At first I created a new DefaultAuthorizationEntry with type="Remove" to remove the default authorization entry for endpoint="*".

Then in my second DefaultAuthorizationEntry I entered the name of my endpoint to be authorized in the "endpoint" property.

But the DefaultAuthorizationService did not find any matching endpoint to my entry.

In the debugging mode I realized, the authorization service compares the entered endpoint name with a generated endpoint id. No wonder, no matching endpoins are found.

It seems, there is a BUG in the authorization process in ServiceMix.

See FlowRegistryImpl line 93, where the endpoint id instaed of endpoint name is used to call authorizationService.getAcls.

I use the newest apache-servicemix-4.4.1-fuse-06-03 and osgi deployment.

Thank you for any tips, how to make the authorization working.

Radomir

[ffang]

Hi,

This is a bug, will create an internal jira ticket and fix it soon.

Freeman

[radomir.kadlec]

Thank you Freeman!

I saw in the Jira, you have created and fixed the bug allready.

The planed version you entered is ServiceMix NMR 1.6.0.

Will this change come in Fuse ESB too? In which Fuse version?

Thank you

Radomir

[ffang]

Hi,

Yeah, next FUSE ESB release will pick up this fix too.

Btw, you actually don't need a new DefaultAuthorizationEntry with type="Remove" to remove the default authorization entry for endpoint="*", the AuthorizationEntry with type="Set" will clear all firstly for that entry.

Freeman

Edited by: ffang on Jun 11, 2012 8:52 AM

[radomir.kadlec]

Thank you Freeman!

I am expecting the new Fuse ESB release.

Yes, I know the Set/Remove/Add possibilities in DefaultAuthorizationEntry.

I have many configuration files with many services, not only one.

Therefore I use the Remove command in one place in my common configuration file.

All other configuration files with their services use than the Add command to add their own authorization entries.

Radomir