ARTEMIS-1740: Add support for regex based certificate authentication

[LionelCons]

This adds the possibility to have an optional properties file containing regular expressions to match against the DN.

[clebertsuconic]

@jbertram can you look into this one? you have more miles on security than I do. :)

[jbertram]

This looks good except for a few things:

• I would rather not have an additional file for the regex properties. I think it would be better to instead denote the regex in the normal user properties file using the traditional forward slashes (as described in the JIRA).
• There's no documentation. The new functionality should be documented in docs/user-manual/en/security.md.
• I'd like to see an integration test added to org.apache.activemq.artemis.tests.integration.security.SecurityTest. There's several tests in there already which test cert-based login.

[franz1981]

You could use a Suppliers::memoize to allow a thread-safe lazy initialization without having that method synchronized even when you just need to get regexpProps.
But is is needed?

[franz1981]

getUserByRegexp is synchronized but there are uses of usersByDn and regexpByUser, like these ones, that are not: what is the reason to have String getUserByRegexp(String dn) synchronized?

[LionelCons]

The intent of synchronized is to protect the modification of usersByDn.

[franz1981]

@LionelCons

And it makes sense, but there are parts like:
String name = usersByDn.get(dn);
that are not synchronized, hence it won't be thread-safe.
My advice is to use a lazy initialization through a Suppliers::memoize or similar construct and always use Supplier::get to access the variable: that would allow to have always a thread-safe access to an unmodifiable resource, lazy initialized.

[LionelCons]

@franz1981 your comment goes beyond my modifications since the existing code already uses the get method (in getUserNameForCertificates and getUserRoles, at least).

[franz1981]

Hence this userByDb not synchronized access no longer exists in the new commit?
With github and multiple commits is not simple to do reviews :P

[LionelCons]

The final code can be seen here.

Just like in the original code, both getUserNameForCertificates and getUserRoles still use get.

[jbertram]

Thanks for the changes, @LionelCons. Can you squash your commits?

[LionelCons]

@jbertram can you squash the commits when accepting the merge?

[clebertsuconic]

@LionelCons I can.. if this is ready to be merged.

[clebertsuconic]

done