From 7715b5ee128d2a629c2e5940247e86be91a694fc Mon Sep 17 00:00:00 2001 From: jbertram Date: Thu, 26 May 2016 09:18:11 -0500 Subject: [PATCH] ARTEMIS-529 support dual auth A new feature whereby 2-way SSL connections can be authenticated differently than non-SSL connections. --- .../artemis/factory/JaasSecurityHandler.java | 2 +- .../activemq/artemis/dto/JaasSecurityDTO.java | 3 + .../security/ActiveMQJAASSecurityManager.java | 38 ++++- docs/user-manual/en/security.md | 49 ++++-- examples/features/standard/pom.xml | 2 + .../ssl-enabled-dual-authentication/pom.xml | 110 ++++++++++++++ .../readme.html | 75 +++++++++ .../example/SSLDualAuthenticationExample.java | 99 ++++++++++++ .../activemq/server0/artemis-roles.properties | 17 +++ .../activemq/server0/artemis-users.properties | 17 +++ .../resources/activemq/server0/bootstrap.xml | 28 ++++ .../resources/activemq/server0/broker.xml | 57 +++++++ .../activemq/server0/cert-roles.properties | 18 +++ .../activemq/server0/cert-users.properties | 18 +++ .../activemq/server0/client-side-keystore.jks | Bin 0 -> 1303 bytes .../server0/client-side-truststore.jks | Bin 0 -> 963 bytes .../resources/activemq/server0/login.config | 30 ++++ .../activemq/server0/server-side-keystore.jks | Bin 0 -> 2253 bytes .../server0/server-side-truststore.jks | Bin 0 -> 1732 bytes .../src/main/resources/jndi.properties | 21 +++ .../ssl/CoreClientOverTwoWaySSLTest.java | 6 +- .../ssl/DualAuthenticationTest.java | 142 ++++++++++++++++++ .../dual-authentication-cert-roles.properties | 18 +++ .../dual-authentication-cert-users.properties | 18 +++ .../dual-authentication-roles.properties | 18 +++ .../dual-authentication-users.properties | 18 +++ .../src/test/resources/login.config | 14 ++ 27 files changed, 802 insertions(+), 16 deletions(-) create mode 100644 examples/features/standard/ssl-enabled-dual-authentication/pom.xml create mode 100644 examples/features/standard/ssl-enabled-dual-authentication/readme.html create mode 100644 examples/features/standard/ssl-enabled-dual-authentication/src/main/java/org/apache/activemq/artemis/jms/example/SSLDualAuthenticationExample.java create mode 100644 examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/artemis-roles.properties create mode 100644 examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/artemis-users.properties create mode 100644 examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/bootstrap.xml create mode 100644 examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/broker.xml create mode 100644 examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/cert-roles.properties create mode 100644 examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/cert-users.properties create mode 100644 examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/client-side-keystore.jks create mode 100644 examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/client-side-truststore.jks create mode 100644 examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/login.config create mode 100644 examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/server-side-keystore.jks create mode 100644 examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/server-side-truststore.jks create mode 100644 examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/jndi.properties create mode 100644 tests/integration-tests/src/test/java/org/apache/activemq/artemis/tests/integration/ssl/DualAuthenticationTest.java create mode 100644 tests/integration-tests/src/test/resources/dual-authentication-cert-roles.properties create mode 100644 tests/integration-tests/src/test/resources/dual-authentication-cert-users.properties create mode 100644 tests/integration-tests/src/test/resources/dual-authentication-roles.properties create mode 100644 tests/integration-tests/src/test/resources/dual-authentication-users.properties diff --git a/artemis-cli/src/main/java/org/apache/activemq/artemis/factory/JaasSecurityHandler.java b/artemis-cli/src/main/java/org/apache/activemq/artemis/factory/JaasSecurityHandler.java index 2f45f94b1ce..dc677e094a5 100644 --- a/artemis-cli/src/main/java/org/apache/activemq/artemis/factory/JaasSecurityHandler.java +++ b/artemis-cli/src/main/java/org/apache/activemq/artemis/factory/JaasSecurityHandler.java @@ -25,7 +25,7 @@ public class JaasSecurityHandler implements SecurityHandler { @Override public ActiveMQSecurityManager createSecurityManager(SecurityDTO security) throws Exception { JaasSecurityDTO jaasSecurity = (JaasSecurityDTO) security; - ActiveMQJAASSecurityManager securityManager = new ActiveMQJAASSecurityManager(jaasSecurity.domain); + ActiveMQJAASSecurityManager securityManager = new ActiveMQJAASSecurityManager(jaasSecurity.domain, jaasSecurity.certificateDomain); return securityManager; } } diff --git a/artemis-dto/src/main/java/org/apache/activemq/artemis/dto/JaasSecurityDTO.java b/artemis-dto/src/main/java/org/apache/activemq/artemis/dto/JaasSecurityDTO.java index a988bff51f0..2aa0e00784d 100644 --- a/artemis-dto/src/main/java/org/apache/activemq/artemis/dto/JaasSecurityDTO.java +++ b/artemis-dto/src/main/java/org/apache/activemq/artemis/dto/JaasSecurityDTO.java @@ -27,4 +27,7 @@ public class JaasSecurityDTO extends SecurityDTO { @XmlAttribute(name = "domain", required = true) public String domain; + + @XmlAttribute(name = "certificate-domain", required = false) + public String certificateDomain; } diff --git a/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQJAASSecurityManager.java b/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQJAASSecurityManager.java index 6e28e913063..cd380ec394f 100644 --- a/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQJAASSecurityManager.java +++ b/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/ActiveMQJAASSecurityManager.java @@ -50,7 +50,9 @@ public class ActiveMQJAASSecurityManager implements ActiveMQSecurityManager2 { private static final String WILDCARD = "*"; private String configurationName; + private String certificateConfigurationName; private SecurityConfiguration configuration; + private SecurityConfiguration certificateConfiguration; private String rolePrincipalClass = "org.apache.activemq.artemis.spi.core.security.jaas.RolePrincipal"; public ActiveMQJAASSecurityManager() { @@ -60,11 +62,23 @@ public ActiveMQJAASSecurityManager(String configurationName) { this.configurationName = configurationName; } + public ActiveMQJAASSecurityManager(String configurationName, String certificateConfigurationName) { + this.configurationName = configurationName; + this.certificateConfigurationName = certificateConfigurationName; + } + public ActiveMQJAASSecurityManager(String configurationName, SecurityConfiguration configuration) { this.configurationName = configurationName; this.configuration = configuration; } + public ActiveMQJAASSecurityManager(String configurationName, String certificateConfigurationName, SecurityConfiguration configuration, SecurityConfiguration certificateConfiguration) { + this.configurationName = configurationName; + this.configuration = configuration; + this.certificateConfigurationName = certificateConfigurationName; + this.certificateConfiguration = certificateConfiguration; + } + @Override public boolean validateUser(String user, String password) { return validateUser(user, password, null); @@ -144,7 +158,13 @@ public boolean validateUserAndRole(final String user, } private Subject getAuthenticatedSubject(final String user, final String password, final X509Certificate[] certificates) throws LoginException { - LoginContext lc = new LoginContext(configurationName, null, new JaasCallbackHandler(user, password, certificates), configuration); + LoginContext lc; + if (certificateConfigurationName != null && certificateConfigurationName.length() > 0 && certificates != null) { + lc = new LoginContext(certificateConfigurationName, null, new JaasCallbackHandler(user, password, certificates), certificateConfiguration); + } + else { + lc = new LoginContext(configurationName, null, new JaasCallbackHandler(user, password, certificates), configuration); + } lc.login(); return lc.getSubject(); } @@ -172,6 +192,14 @@ public void setConfiguration(SecurityConfiguration configuration) { this.configuration = configuration; } + public void setCertificateConfigurationName(final String certificateConfigurationName) { + this.certificateConfigurationName = certificateConfigurationName; + } + + public void setCertificateConfiguration(SecurityConfiguration certificateConfiguration) { + this.certificateConfiguration = certificateConfiguration; + } + public SecurityConfiguration getConfiguration() { if (configuration == null) { configuration = new SecurityConfiguration(); @@ -180,6 +208,14 @@ public SecurityConfiguration getConfiguration() { return configuration; } + public SecurityConfiguration getCertificateConfiguration() { + if (certificateConfiguration == null) { + certificateConfiguration = new SecurityConfiguration(); + } + + return certificateConfiguration; + } + public String getRolePrincipalClass() { return rolePrincipalClass; } diff --git a/docs/user-manual/en/security.md b/docs/user-manual/en/security.md index f6e654d084d..a0abb3d0026 100644 --- a/docs/user-manual/en/security.md +++ b/docs/user-manual/en/security.md @@ -238,10 +238,9 @@ As mentioned, there are a few places where a translation was performed to achiev ## Secure Sockets Layer (SSL) Transport -When messaging clients are connected to servers, or servers are -connected to other servers (e.g. via bridges) over an untrusted network -then Apache ActiveMQ Artemis allows that traffic to be encrypted using the Secure -Sockets Layer (SSL) transport. +When messaging clients are connected to servers, or servers are connected to other servers (e.g. via bridges) over an +untrusted network then Apache ActiveMQ Artemis allows that traffic to be encrypted using the Secure Sockets Layer (SSL) +transport. For more information on configuring the SSL transport, please see [Configuring the Transport](configuring-transports.md). @@ -250,12 +249,11 @@ For more information on configuring the SSL transport, please see [Configuring t Apache ActiveMQ Artemis ships with two security manager implementations: - The legacy, deprecated `ActiveMQSecurityManager` that reads user credentials, i.e. user names, passwords and role -information from properties files on the classpath called `artemis-users.properties` and `artemis-roles.properties`. -This is the default security manager. +information from properties files on the classpath called `artemis-users.properties` and `artemis-roles.properties`. - The flexible, pluggable `ActiveMQJAASSecurityManager` which supports any standard JAAS login module. Artemis ships -with several login modules which will be discussed further down. - +with several login modules which will be discussed further down. This is the default security manager. + ### JAAS Security Manager When using JAAS much of the configuration depends on which login module is used. However, there are a few commonalities @@ -278,17 +276,46 @@ The `login.config` file is a standard JAAS configuration file. You can read more [Oracle's website](https://docs.oracle.com/javase/8/docs/technotes/guides/security/jgss/tutorials/LoginConfigFile.html). In short, the file defines: -- an alias for a configuration (e.g. `PropertiesLogin`) +- an alias for an entry (e.g. `PropertiesLogin`) -- the implementation class (e.g. `org.apache.activemq.artemis.spi.core.security.jaas.PropertiesLoginModule`) +- the implementation class for the login module (e.g. `org.apache.activemq.artemis.spi.core.security.jaas.PropertiesLoginModule`) -- a flag which indicates whether the success of the LoginModule is `required`, `requisite`, `sufficient`, or `optional` +- a flag which indicates whether the success of the login module is `required`, `requisite`, `sufficient`, or `optional` +(see more details on these flags in the [JavaDoc](http://docs.oracle.com/javase/8/docs/api/javax/security/auth/login/Configuration.html) - a list of configuration options specific to the login module implementation By default, the location and name of `login.config` is specified on the Artemis command-line which is set by `etc/artemis.profile` on linux and `etc\artemis.profile.cmd` on Windows. +#### Dual Authentication + +The JAAS Security Manager also supports another configuration parameter - `certificate-domain`. This is useful when you +want to authenticate clients connecting with SSL connections based on their SSL certificates (e.g. using the `CertificateLoginModule` +discussed below) but you still want to authenticate clients connecting with non-SSL connections with, e.g., username and +password. Here's an example of what would go in `bootstrap.xml`: + + + +And here's the corresponding `login.config`: + + PropertiesLogin { + org.apache.activemq.artemis.spi.core.security.jaas.PropertiesLoginModule required + debug=false + org.apache.activemq.jaas.properties.user="artemis-users.properties" + org.apache.activemq.jaas.properties.role="artemis-roles.properties"; + }; + + CertLogin { + org.apache.activemq.artemis.spi.core.security.jaas.TextFileCertificateLoginModule required + debug=true + org.apache.activemq.jaas.textfiledn.user="cert-users.properties" + org.apache.activemq.jaas.textfiledn.role="cert-roles.properties"; + }; + +When the broker is configured this way then any client connecting with SSL and a client certificate will be authenticated +using `CertLogin` and any client connecting without SSL will be authenticated using `PropertiesLogin`. + ### JAAS Login Modules #### GuestLoginModule diff --git a/examples/features/standard/pom.xml b/examples/features/standard/pom.xml index 05d1b64eb14..88a5823be57 100644 --- a/examples/features/standard/pom.xml +++ b/examples/features/standard/pom.xml @@ -86,6 +86,7 @@ under the License. send-acknowledgements spring-integration ssl-enabled + ssl-enabled-dual-authentication static-selector temp-queue topic @@ -147,6 +148,7 @@ under the License. send-acknowledgements spring-integration ssl-enabled + ssl-enabled-dual-authentication static-selector diff --git a/examples/features/standard/ssl-enabled-dual-authentication/pom.xml b/examples/features/standard/ssl-enabled-dual-authentication/pom.xml new file mode 100644 index 00000000000..a13d33a9433 --- /dev/null +++ b/examples/features/standard/ssl-enabled-dual-authentication/pom.xml @@ -0,0 +1,110 @@ + + + + + 4.0.0 + + + org.apache.activemq.examples.broker + jms-examples + 1.3.0-SNAPSHOT + + + ssl-enabled-dual-authentication + jar + ActiveMQ Artemis JMS SSL Enabled Dual Authentication Example + + + ${project.basedir}/../../../.. + + + + + org.apache.activemq + artemis-jms-client + ${project.version} + + + + + + + org.apache.activemq + artemis-maven-plugin + + + create + + create + + + ${noServer} + + + + start + + cli + + + ${noServer} + true + tcp://localhost:61616 + consumer + activemq + + run + + + + + runClient + + runClient + + + org.apache.activemq.artemis.jms.example.SSLDualAuthenticationExample + + + + stop + + cli + + + ${noServer} + + stop + + + + + + + org.apache.activemq.examples.broker + ssl-enabled-dual-authentication + ${project.version} + + + + + + + diff --git a/examples/features/standard/ssl-enabled-dual-authentication/readme.html b/examples/features/standard/ssl-enabled-dual-authentication/readme.html new file mode 100644 index 00000000000..93d7c72afdc --- /dev/null +++ b/examples/features/standard/ssl-enabled-dual-authentication/readme.html @@ -0,0 +1,75 @@ + + + + + ActiveMQ Artemis JMS SSL Example + + + + + +

JMS SSL Dual Authentication Example

+ + 
To run the example, simply type mvn verify from this directory, 
or mvn -PnoServer verify if you want to start and create the server manually.
+ +

This example shows you how to configure 2-way SSL along with 2 different authentications mechanisms so that SSL and non-SSL clients can send and consume messages to/from ActiveMQ Artemis. + The non-SSL authentication mechanism simply uses username and password. The SSL authentication mechanism uses the client's certificate.

+ +

To configure 2-way SSL you need to configure the acceptor as follows:

+ +

+ 

+           
+      <!-- Acceptor -->
+
+      <acceptor name="netty-ssl-acceptor">tcp://localhost:5500?sslEnabled=true;needClientAuth=true;keyStorePath=${data.dir}/../etc/server-side-keystore.jks;keyStorePassword=secureexample;trustStorePath=${data.dir}/../etc/server-side-truststore.jks;trustStorePassword=secureexample</acceptor>
+           
+
+

+ +

In the server-side URL, the server-side-keystore.jks is the key store file holding the server's certificate. The server-side-truststore.jks is the file holding the certificates which the server trusts. Notice also the "sslEnabled" and "needClientAuth" parameters which enable SSL and require clients to present their own certificate respectively. Here's the URL the client uses to connect over SSL:

+ +

+ 

+           
+      tcp://localhost:5500?sslEnabled=true&trustStorePath=activemq/server0/client-side-truststore.jks&trustStorePassword=secureexample&keyStorePath=activemq/server0/client-side-keystore.jks&keyStorePassword=secureexample
+           
+
+

+ +

In the client-side URL, the client-side-keystore.jks is the key store file holding the client's certificate. The client-side-truststore.jks is the file holding the certificates which the client trusts. The "sslEnabled" parameter is present here as well just as it is on the server.

+ +

The various keystore files are generated using the following commands:

+ +

+ 

+           
+keytool -genkey -keystore server-side-keystore.jks -storepass secureexample -keypass secureexample -dname "CN=ActiveMQ Artemis Server, OU=Artemis, O=ActiveMQ, L=AMQ, S=AMQ, C=AMQ" -keyalg RSA
+keytool -export -keystore server-side-keystore.jks -file server-side-cert.cer -storepass secureexample
+keytool -import -keystore client-side-truststore.jks -file server-side-cert.cer -storepass secureexample -keypass secureexample -noprompt
+keytool -genkey -keystore client-side-keystore.jks -storepass secureexample -keypass secureexample -dname "CN=ActiveMQ Artemis Client, OU=Artemis, O=ActiveMQ, L=AMQ, S=AMQ, C=AMQ" -keyalg RSA
+keytool -export -keystore client-side-keystore.jks -file client-side-cert.cer -storepass secureexample
+keytool -import -keystore server-side-truststore.jks -file client-side-cert.cer -storepass secureexample -keypass secureexample -noprompt
+           
+
+

+ + + diff --git a/examples/features/standard/ssl-enabled-dual-authentication/src/main/java/org/apache/activemq/artemis/jms/example/SSLDualAuthenticationExample.java b/examples/features/standard/ssl-enabled-dual-authentication/src/main/java/org/apache/activemq/artemis/jms/example/SSLDualAuthenticationExample.java new file mode 100644 index 00000000000..a3c928e5867 --- /dev/null +++ b/examples/features/standard/ssl-enabled-dual-authentication/src/main/java/org/apache/activemq/artemis/jms/example/SSLDualAuthenticationExample.java @@ -0,0 +1,99 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.activemq.artemis.jms.example; + +import javax.jms.Connection; +import javax.jms.ConnectionFactory; +import javax.jms.MessageConsumer; +import javax.jms.MessageProducer; +import javax.jms.Queue; +import javax.jms.Session; +import javax.jms.TextMessage; +import javax.naming.InitialContext; + +/** + * A simple JMS Queue example that uses dual broker authentication mechanisms for SSL and non-SSL connections. + */ +public class SSLDualAuthenticationExample { + + public static void main(final String[] args) throws Exception { + Connection producerConnection = null; + Connection consumerConnection = null; + InitialContext initialContext = null; + try { + // Step 1. Create an initial context to perform the JNDI lookup. + initialContext = new InitialContext(); + + // Step 2. Perfom a lookup on the queue + Queue queue = (Queue) initialContext.lookup("queue/exampleQueue"); + + // Step 3. Perform a lookup on the producer's SSL Connection Factory + ConnectionFactory producerConnectionFactory = (ConnectionFactory) initialContext.lookup("SslConnectionFactory"); + + // Step 4. Perform a lookup on the consumer's Connection Factory + ConnectionFactory consumerConnectionFactory = (ConnectionFactory) initialContext.lookup("ConnectionFactory"); + + // Step 5.Create a JMS Connection for the producer + producerConnection = producerConnectionFactory.createConnection(); + + // Step 6.Create a JMS Connection for the consumer + consumerConnection = consumerConnectionFactory.createConnection("consumer", "activemq"); + + // Step 7. Create a JMS Session for the producer + Session producerSession = producerConnection.createSession(false, Session.AUTO_ACKNOWLEDGE); + + // Step 8. Create a JMS Session for the consumer + Session consumerSession = consumerConnection.createSession(false, Session.AUTO_ACKNOWLEDGE); + + // Step 9. Create a JMS Message Producer + MessageProducer producer = producerSession.createProducer(queue); + + // Step 10. Create a Text Message + TextMessage message = producerSession.createTextMessage("This is a text message"); + + System.out.println("Sent message: " + message.getText()); + + // Step 11. Send the Message + producer.send(message); + + // Step 12. Create a JMS Message Consumer + MessageConsumer messageConsumer = consumerSession.createConsumer(queue); + + // Step 13. Start the Connection + consumerConnection.start(); + + // Step 14. Receive the message + TextMessage messageReceived = (TextMessage) messageConsumer.receive(5000); + + System.out.println("Received message: " + messageReceived.getText()); + + initialContext.close(); + } + finally { + // Step 15. Be sure to close our JMS resources! + if (initialContext != null) { + initialContext.close(); + } + if (producerConnection != null) { + producerConnection.close(); + } + if (consumerConnection != null) { + consumerConnection.close(); + } + } + } +} diff --git a/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/artemis-roles.properties b/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/artemis-roles.properties new file mode 100644 index 00000000000..643dfc37d16 --- /dev/null +++ b/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/artemis-roles.properties @@ -0,0 +1,17 @@ +## --------------------------------------------------------------------------- +## Licensed to the Apache Software Foundation (ASF) under one or more +## contributor license agreements. See the NOTICE file distributed with +## this work for additional information regarding copyright ownership. +## The ASF licenses this file to You under the Apache License, Version 2.0 +## (the "License"); you may not use this file except in compliance with +## the License. You may obtain a copy of the License at +## +## http://www.apache.org/licenses/LICENSE-2.0 +## +## Unless required by applicable law or agreed to in writing, software +## distributed under the License is distributed on an "AS IS" BASIS, +## WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +## See the License for the specific language governing permissions and +## limitations under the License. +## --------------------------------------------------------------------------- +consumers=consumer \ No newline at end of file diff --git a/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/artemis-users.properties b/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/artemis-users.properties new file mode 100644 index 00000000000..1c68f505ddd --- /dev/null +++ b/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/artemis-users.properties @@ -0,0 +1,17 @@ +## --------------------------------------------------------------------------- +## Licensed to the Apache Software Foundation (ASF) under one or more +## contributor license agreements. See the NOTICE file distributed with +## this work for additional information regarding copyright ownership. +## The ASF licenses this file to You under the Apache License, Version 2.0 +## (the "License"); you may not use this file except in compliance with +## the License. You may obtain a copy of the License at +## +## http://www.apache.org/licenses/LICENSE-2.0 +## +## Unless required by applicable law or agreed to in writing, software +## distributed under the License is distributed on an "AS IS" BASIS, +## WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +## See the License for the specific language governing permissions and +## limitations under the License. +## --------------------------------------------------------------------------- +consumer=activemq \ No newline at end of file diff --git a/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/bootstrap.xml b/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/bootstrap.xml new file mode 100644 index 00000000000..2d753e7de10 --- /dev/null +++ b/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/bootstrap.xml @@ -0,0 +1,28 @@ + + + + + + + + + + + + + diff --git a/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/broker.xml b/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/broker.xml new file mode 100644 index 00000000000..14fa849c773 --- /dev/null +++ b/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/broker.xml @@ -0,0 +1,57 @@ + + + + + + + + + + + + + ./data/messaging/bindings + + ./data/messaging/journal + + ./data/messaging/largemessages + + ./data/messaging/paging + + + + tcp://localhost:61616 + tcp://localhost:5500?sslEnabled=true;needClientAuth=true;keyStorePath=${data.dir}/../etc/server-side-keystore.jks;keyStorePassword=secureexample;trustStorePath=${data.dir}/../etc/server-side-truststore.jks;trustStorePassword=secureexample + + + + + + + + + + + + + + diff --git a/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/cert-roles.properties b/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/cert-roles.properties new file mode 100644 index 00000000000..f52fa217531 --- /dev/null +++ b/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/cert-roles.properties @@ -0,0 +1,18 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +producers=producer diff --git a/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/cert-users.properties b/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/cert-users.properties new file mode 100644 index 00000000000..06874dc5e97 --- /dev/null +++ b/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/cert-users.properties @@ -0,0 +1,18 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +producer=CN=ActiveMQ Artemis Client, OU=Artemis, O=ActiveMQ, L=AMQ, ST=AMQ, C=AMQ diff --git a/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/client-side-keystore.jks b/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/client-side-keystore.jks new file mode 100644 index 0000000000000000000000000000000000000000..cb65a44ddc868383e07e700b941d9ac0709daf58 GIT binary patch literal 1303 zcmezO_TO6u1_mY|W&~r_+{*0KN+2&_z1sy2Al+}!#Mo`X$Ht}2#>m2`#U#kc$jZRd z#903PyT#h@IPs9J5x3RWJvkMao!|^cgJXbP~&rKw3WXmtk#sink!k~r2bsZtnRxq zlbF1@GPb>#=puS4LgYpNeOINWEf3}{X3x7k*|KgH_o=I|w?4db!fN`RJMwi5k39}L zX6)6Hd?{eN?WvX9|D@@Pzl$_joEDm1opopd`@0I0UlUoZmoWX`CPm<%dVT& z+ld{q+Uii6bVKsq9n({h74y8Z&i*{ZR5#Cz&3*q&f5zM?=f$IE)M%=S?OLT7;`aFU z6yJFtr+>dE)9h??n296K=J@#)UUpIYk4348gtzZud3pYF)ayA9i{z40({1P1?$g#6 z?PT|!ysAIUXz(iwzYFw_C*ONBIp z?t9JAd-LS^H^J>eHt$^+4$Ij$YztJ&bd7aT3j7^u+Z*v~|Ix3z48EP79h!5!(Yis_ zB>z)d!uIT$0ZW(6pZ|iTT0rTL|L&F7|7|}e{lhx^`LPwtMEO~MH-Ec)RPHd7X^3!? z*hHgmrJvVnCtlZj|4E5ia_&VB#^X$)4AT<=`bCww&up5svuV-m7VZxbGG9SX`~Gl2 z>$Tao_fGFw9b>j5d}rm9^}Byry=wXy?!#@%-jp5~8Q!<+N~Hg@LUw`1hAp0Ag~~5{ zG{l6rpXW5{IkD`ajaXH8NKLQCgT?FQv^Os+otU?{p8J=gY0}5vNmYz0)@PP{+_xfd zLg$L+`wyd@&S#s{ofg+n9jcnb=wtowyr&j(V+#XQV?)s~+5CQI;iS;)p4oc!kN0cY zZd<*dUtrpOX#?iMImV0LU7d1rPO%8oXYWFo~$HDUtbi!Q0ufZ=QC6{toV=3z~tVvYLw}L)s#B!Eh7c# zY5d83%;ReHzWNmYgG(Q-_2x;B`F1)!YoAw5deG^=9+R$pk}-IEbyj50l8^mmk0z-| zD=mNLc6sIe&-e8A7AH!i>=3^>scCCC6u7`XRfp#D8o1>mL(b*B)7=UgyqI zo8rq+{Na+y`<!U37@*3Fs9 zGQNLnCNfP?5v(%w&f3)%cfhm!2g9nY<`3da=X*<91oa2E#J^o+DHgKmqI&$59hPRWD^Yd*2tX{NuH7scp1N&#bvysY@a)^KR2A3*wEcosC90U z087$R_J)UT;+?4)ziZ__b*w!YRq^$uZ;~I^6x}TA<4kD}v@Rc7qSqNjK7Gz4qPAqH7<=}8XfS0d%rHhsQI=tB#TX zMG0f)HfzKH?CB_ZS2S2C9LCfj~|Gm<*opF;lu|jT=7V;`C@?5&_}u zYK=(7(luT3FOLbZsgr`m>P>~kHCuBJ5j#hWA1-h*!x>Z9lT29*-_x*b?~at=i?fp) zdi=L{piIMX_dfb8fx%UP!)to-c^7jIL(|`m$|~fuH}w{+JG$1#^uQ_sl)KwF;tK=F z67}Pu!dlne)Lxwr?S&;J^6(;086MfH;*yxgO%EKGc(oG=KN@a0hY3<=2#q#;%|+jM zT$>2t!8?LJ#sw;^tr4&2owN49PNbNVikLBXroaMZ?`|LuhOmRq`h%$4yB~gR&HyM|J5@jD9Iqz+ib3WJy?uoe}p!z zK}pUT$oO{YTeKz1JT6HkfiMM?sW6HZuw`Kv>!XfS%hb5QV{&?ekEB${cR|{Wimhjo zP5JcGUVB{&@5>oyGBQ+(IR_0eXA{bXHFHK<@0Ac=J70@P7=5AorY3jV8J@lJvsT@$ zY})?9(JV}nJGr~Go3`I-+M8^3|G-_qmJ>naK+kP_#Ig#!*9Six%p=5xpq-qWyhnl=x>C3 zJ*W_D%dmN*xyF@dU)|;?{ZCzUC70li)Kl`Ww0z7TE2KN105;7;)?AH7R4+%v6b&Qc zwb#~4pWQd5z>n4kaQc48hLX~J_a8(mjV&EotXhz`p6y>_L=0W*o8_w>ptWN8m`qBc z*snd~<^I-?cnbGbK?8KSgSq%tO4kArkHjagTPx)F%t$ zjF$F7gxd@R866u~IZHSPW3XjkuX=1Zs=zGkt;$=VYZ4p#W8{LFXgc~#ON?Qo2+Q-! zd<{o#6mBGyY^2^+_Aan_sOVngRsRgQsOwXSJm64T|MSB|Iw%c83?Fs*9PbH>QhUzRCYt{`vB24%T$dmVlOl}HEjiNqS!fMQh#2R9@PAd%_ zlYvg1r%5)6L3YbwA@_7kzf{ZznwTZ0x>I=tv@OJ)eaFwR&IS)JZbVs#NY@TYbl0bR zw9Sh~Rao7QHq4dNTwO&c(qV8dPfztDo_-}3VKp~hmjJoBZxuEFSd2~@ItV=gfFl7x z=7>d*L4L&?ARq_?hE=;>LkK{4)Dkg?+X6r!A1442jO0h~LO5_>h$x4#^|`-@`ya&h z2MHqte|PeVavNU`@eB1junQgR+XIPDl*^bH;uYjaLc$R8zbhP~l7E?Ce_p}ty@;V+ zM1;Jg08$5u(9%O7wRCiJT@Da^aMb-1|BWY+fr@_*=HTDpAOi&f2r`ftLx0(zCF<)ThrF8y$4GD=myAP(LFALf4@uOiS za@rW3qYt{G&mM@(93uo{yl1SXVn#Y`qjrg*9B zMar)wGhVs;wmD}_u;I;7_c!PSd4EkbvL$~fNmO&WTPNwaM>=#Dt>WbTIpSe?KR{ik+zDz#s)blTpsbi@+jOW IlooIIKQG79H~;_u literal 0 HcmV?d00001 diff --git a/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/server-side-truststore.jks b/examples/features/standard/ssl-enabled-dual-authentication/src/main/resources/activemq/server0/server-side-truststore.jks new file mode 100644 index 0000000000000000000000000000000000000000..0b7e224163358aef1f20d04f5c6720f98b97679a GIT binary patch literal 1732 zcmezO_TO6u1_mZLW=={>VPIek*!;DvkAXEp&(y$@fq_}Wpov+p`ni!fH z8AJiOW(I~v=1?x3T+zh1-Jpq42j+c7AV;35v610#eQ={}sgP#SeXlusZ=O8=Cb&Jw z=DiEUVLAJTZGmc;uCWeEfxjbddn11BKl*i-!MD@1LvyY-S~tj=+HZ6MH!u=sa<}1i)-ybe$y*AtS-swH7W6XAh z@2s4%e)lh{S4}^|eYkDeo6-X#!~1q!iS&O~$S%;>u*FlXQ2B+AhM4g7^PEOKCzd_5 z5v%GBsp-{tuy~!E_U2`!6Z00=bN^B_P5Ssdsftm>`plA#`&I-_=v>i!|6$bA`D~NA z)8ZPcLse54eXReT_tau;Y++z(Y%r=kbN_I)aQjBz7apnmULCHGthwoYIiq;Vm%RmV z?@n47b>?ra)6b>tSrY0=%WwEk-FIip&c&-Y+G@ zt&Qi`{8=yFqpKpTwk+J%ihWU}<mkT;M8rYl)K7BLo)MB_7#Mv^mDt4;Yl_xFC?=tt8y4N;Ocvp$1?4wHy=*^=l6 zw!k~;c?Q#?BJOs1TP)kkB*NsMsjZi_Qb6d)+Gd^R=1KCew@n1+Bi7u??9@t7E?Vy{ z@eh%UoPfE=4w#GnKy#6z#DORj>kJBE`G#7#NWnl3l8eM)Sxo_&!O*jm1u#RIo0!6~ zlo^ye5KbD+U*zVmqGPi8{m#Nkq1ipN_39t**RtKVdOyFwwENNq%!PA|7rnbW<>Z`V z5!OF#8z<$xSh<$n_rn~n4xMAQd-wMFMyjs4dd87s#twc1g?$D>+tw=_V_Ov;pnB)) zo5XCZu0#%(eRM%HFxSayE|v^wi`12K k_4O@1aE-GsYR(x({$u$93H;)JLJaM8R params = new HashMap<>(); + params.put(TransportConstants.SSL_ENABLED_PROP_NAME, true); + params.put(TransportConstants.KEYSTORE_PATH_PROP_NAME, SERVER_SIDE_KEYSTORE); + params.put(TransportConstants.KEYSTORE_PASSWORD_PROP_NAME, PASSWORD); + params.put(TransportConstants.TRUSTSTORE_PATH_PROP_NAME, SERVER_SIDE_TRUSTSTORE); + params.put(TransportConstants.TRUSTSTORE_PASSWORD_PROP_NAME, PASSWORD); + params.put(TransportConstants.NEED_CLIENT_AUTH_PROP_NAME, true); + params.put(TransportConstants.PORT_PROP_NAME, "61617"); + ConfigurationImpl config = createBasicConfig(); + config.addAcceptorConfiguration(new TransportConfiguration(NETTY_ACCEPTOR_FACTORY, params)); + config.addAcceptorConfiguration(new TransportConfiguration(NETTY_ACCEPTOR_FACTORY)); + config.setSecurityEnabled(true); + + ActiveMQSecurityManager securityManager = new ActiveMQJAASSecurityManager("DualAuthenticationPropertiesLogin", "DualAuthenticationCertLogin"); + server = addServer(ActiveMQServers.newActiveMQServer(config, ManagementFactory.getPlatformMBeanServer(), securityManager, false)); + + HierarchicalRepository> securityRepository = server.getSecurityRepository(); + Role sendRole = new Role("producers", true, false, true, false, true, false, false); + Role receiveRole = new Role("consumers", false, true, false, false, false, false, false); + Set roles = new HashSet<>(); + roles.add(sendRole); + roles.add(receiveRole); + securityRepository.addMatch(DualAuthenticationTest.QUEUE.toString(), roles); + + server.start(); + waitForServerToStart(server); + tc = new TransportConfiguration(NETTY_CONNECTOR_FACTORY); + } +} diff --git a/tests/integration-tests/src/test/resources/dual-authentication-cert-roles.properties b/tests/integration-tests/src/test/resources/dual-authentication-cert-roles.properties new file mode 100644 index 00000000000..f52fa217531 --- /dev/null +++ b/tests/integration-tests/src/test/resources/dual-authentication-cert-roles.properties @@ -0,0 +1,18 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +producers=producer diff --git a/tests/integration-tests/src/test/resources/dual-authentication-cert-users.properties b/tests/integration-tests/src/test/resources/dual-authentication-cert-users.properties new file mode 100644 index 00000000000..06874dc5e97 --- /dev/null +++ b/tests/integration-tests/src/test/resources/dual-authentication-cert-users.properties @@ -0,0 +1,18 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +producer=CN=ActiveMQ Artemis Client, OU=Artemis, O=ActiveMQ, L=AMQ, ST=AMQ, C=AMQ diff --git a/tests/integration-tests/src/test/resources/dual-authentication-roles.properties b/tests/integration-tests/src/test/resources/dual-authentication-roles.properties new file mode 100644 index 00000000000..9c931731a4d --- /dev/null +++ b/tests/integration-tests/src/test/resources/dual-authentication-roles.properties @@ -0,0 +1,18 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +consumers=consumer \ No newline at end of file diff --git a/tests/integration-tests/src/test/resources/dual-authentication-users.properties b/tests/integration-tests/src/test/resources/dual-authentication-users.properties new file mode 100644 index 00000000000..7b61983e3aa --- /dev/null +++ b/tests/integration-tests/src/test/resources/dual-authentication-users.properties @@ -0,0 +1,18 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +consumer=consumerPassword diff --git a/tests/integration-tests/src/test/resources/login.config b/tests/integration-tests/src/test/resources/login.config index 7c160c50d41..6bc3498994d 100644 --- a/tests/integration-tests/src/test/resources/login.config +++ b/tests/integration-tests/src/test/resources/login.config @@ -123,3 +123,17 @@ CertLogin { org.apache.activemq.jaas.textfiledn.user="cert-users.properties" org.apache.activemq.jaas.textfiledn.role="cert-roles.properties"; }; + +DualAuthenticationCertLogin { + org.apache.activemq.artemis.spi.core.security.jaas.TextFileCertificateLoginModule required + debug=true + org.apache.activemq.jaas.textfiledn.user="dual-authentication-cert-users.properties" + org.apache.activemq.jaas.textfiledn.role="dual-authentication-cert-roles.properties"; +}; + +DualAuthenticationPropertiesLogin { + org.apache.activemq.artemis.spi.core.security.jaas.PropertiesLoginModule required + debug=true + org.apache.activemq.jaas.properties.user="dual-authentication-users.properties" + org.apache.activemq.jaas.properties.role="dual-authentication-roles.properties"; +};