[openjms-developer] OpenJms and Security

Cool! I've only had a quick glance but it looks promising.

Given the minimal schema changes, this could go into the 0.7.6 release.
We'd need to provide SQL scripts to add the new table and index, and update
the schema version no.

At this stage, I'm not too concerned about username and password being
transferred in plaintext, as the tcps or https connectors can be used if
this is an issue. However, it shouldn't be difficult to plugin encryption.

JDBM support is not required, as its being dropped post 0.7.6.

I'll have an in depth look at it tomorrow.

Regards,

Tim

-----Original Message-----
From: openjms-developer-***@lists.sourceforge.net
[mailto:openjms-developer-***@lists.sourceforge.net]On Behalf Of Knut at
work
Sent: Wednesday, 23 July 2003 4:10 AM
To: openjms-***@lists.sourceforge.net
Subject: [openjms-developer] OpenJms and Security

Hello!

I have developed a solution for authentication of users in OpenJMS.

This is just a very first 'shot' and I would be pleased if any of you guys
who knows the code would be so kind to have a look. I have only studied the
source for a couple of days so maybe ive choosed some stupid solutions :-)

Limitations:
-By the time only authentication of user/password, nothing for Acl against
Queue/Topic.
-username/password are beeing transferd from client to server in plaintext
-Only implemented for the TCP-connector
-Only impl. for RDBMS and tested against MySql

The source is taken from the openjms-0.7.5-src.

Howto:
unpack openjms-0.7.5-src.zip
Unpack the src.zip to ../main/.. in openjms-0.7.5-src catalog
Unpack the config.zip to ../config in openjms-0.7.5-src catalog
and build.

Add suitable drivers for the DB
and run.

openjms.xml
-------------------
if you set <SecurityConfiguration enableSecurity="false"/> openjms should
behave ex. as before (i hope....)

Knut

Knut at work

2003-07-22 19:29:24 UTC

Sorry, forgot to supply the changelog.

Also the only way to add new users is thru the openjms.xml file.
Have not done any changes to the Admin yet.

Knut
----- Original Message -----
From: Knut at work
To: openjms-***@lists.sourceforge.net
Sent: Tuesday, July 22, 2003 6:09 PM
Subject: OpenJms and Security

Hello!

I have developed a solution for authentication of users in OpenJMS.

This is just a very first 'shot' and I would be pleased if any of you guys who knows the code would be so kind to have a look. I have only studied the source for a couple of days so maybe ive choosed some stupid solutions :-)

Limitations:
-By the time only authentication of user/password, nothing for Acl against Queue/Topic.
-username/password are beeing transferd from client to server in plaintext
-Only implemented for the TCP-connector
-Only impl. for RDBMS and tested against MySql

The source is taken from the openjms-0.7.5-src.

Howto:
unpack openjms-0.7.5-src.zip
Unpack the src.zip to ../main/.. in openjms-0.7.5-src catalog
Unpack the config.zip to ../config in openjms-0.7.5-src catalog
and build.

Add suitable drivers for the DB
and run.

openjms.xml
-------------------
if you set <SecurityConfiguration enableSecurity="false"/> openjms should behave ex. as before (i hope....)

Knut

Tim Anderson

2003-07-23 04:57:19 UTC

Thanks Knut.

I've applied the changes to CVS. Allow ~24 hours from when you get this
message for them to
propagate through to the anon CVS server.

I've made a few changes:
o UserManager is no longer a singleton.
OpenJMS relies too much on singletons - they're a code smell I'd like to
remove.

o Authentication check has been moved out of the TCP connector and into
JmsServerConnectionManager. This means each connector now has
authentication support.

o JMSSecurityException is now raised on the server, rather than in the
client code.

o minor reformatting

I've also updated the dbtool schema, and added a schema converter to migrate
existing databases to the new 0.7.6 schema.

Still to do, in no particular order:

1. update remaining create_*.sql scripts to include the users table.
2. add sql scripts to create the users tables, for existing databases
3. update configuration reference xdoc to include <SecurityConfiguration/>
and <Users/>
4. add security section to the administrators guide xdocs
5. add user management to the admin GUI
6. update sample configs to include <SecurityConfiguration/> and <Users/>
7. more testing. I'll be running it against the JMS CTS over the next few
days.
8. Add encryption of password, to avoid sending it cleartext [optional]

If you (or anyone else for that matter) wants to do any of the above, please
let me know.

Also, I had a hard time applying these changes, because CVS has moved on bit
since
you checked last out. In future, could you submit patches created using
diff,

diff -u src/path/to/some/changed/file1 >> patches.txt
diff -u src/path/to/some/changed/file2 >> patches.txt

Thanks,

Tim

-----Original Message-----
From: openjms-developer-***@lists.sourceforge.net
[mailto:openjms-developer-***@lists.sourceforge.net]On Behalf Of Knut at
work
Sent: Wednesday, 23 July 2003 5:29 AM
To: openjms-***@lists.sourceforge.net
Subject: [openjms-developer] Fw: OpenJms and Security

Sorry, forgot to supply the changelog.

Also the only way to add new users is thru the openjms.xml file.
Have not done any changes to the Admin yet.

Knut
----- Original Message -----
From: Knut at work
To: openjms-***@lists.sourceforge.net
Sent: Tuesday, July 22, 2003 6:09 PM
Subject: OpenJms and Security

Hello!

I have developed a solution for authentication of users in OpenJMS.

This is just a very first 'shot' and I would be pleased if any of you guys
who knows the code would be so kind to have a look. I have only studied the
source for a couple of days so maybe ive choosed some stupid solutions :-)

Limitations:
-By the time only authentication of user/password, nothing for Acl against
Queue/Topic.
-username/password are beeing transferd from client to server in plaintext
-Only implemented for the TCP-connector
-Only impl. for RDBMS and tested against MySql

The source is taken from the openjms-0.7.5-src.

Howto:
unpack openjms-0.7.5-src.zip
Unpack the src.zip to ../main/.. in openjms-0.7.5-src catalog
Unpack the config.zip to ../config in openjms-0.7.5-src catalog
and build.

Add suitable drivers for the DB
and run.

openjms.xml
-------------------
if you set <SecurityConfiguration enableSecurity="false"/> openjms should
behave ex. as before (i hope....)

Knut

Tim Anderson

2003-07-23 05:49:42 UTC

Post by Tim Anderson
1. update remaining create_*.sql scripts to include the users table.
2. add sql scripts to create the users tables, for existing databases
3. update configuration reference xdoc to include <SecurityConfiguration/>

and <Users/>

Post by Tim Anderson
4. add security section to the administrators guide xdocs
5. add user management to the admin GUI
6. update sample configs to include <SecurityConfiguration/> and <Users/>
7. more testing. I'll be running it against the JMS CTS over the next few

days.

Post by Tim Anderson
8. Add encryption of password, to avoid sending it cleartext [optional]

9. Add authentication to the embedded JNDI provider
10. Add authentication the administration API

Post by Tim Anderson
If you (or anyone else for that matter) wants to do any of the above,

please let me know.

Jim Alateras

2003-07-23 10:52:13 UTC

Post by Tim Anderson
-----Original Message-----
Sent: Wednesday, July 23, 2003 8:32 PM
Subject: RE: [openjms-developer] Fw: OpenJms and Security
I've no problem with splitting APIs so long
as we can deprecate the existing functionality and
remove it in a future release.
One thing I've been wanting to do is have
AdminConnectionFactory return AdminConnection instances
(never like the *Ifc naming convention ;), and
update the method signatures to use JDK 1.2 collections.
Splitting the API on responsibilities would be good as well.
+1 to rewrite of admin gui. More along the lines of
iBus//MessageServers GUI, than Sonic's which from memory was
awful.

+1 to rewrite I also think it is worth looking into MQSeries Explorer.

Post by Tim Anderson
+0 to JMX support. Must confess I've never really looked into
it. I've been meaning to, along with the possibilities of making
the server Avalon based (http://avalon.apache.org), or perhaps
using one of the lighter weight containers such as picocontainer
(http://www.picocontainer.org).

+1 To JMX support we could embed mx4j similar to the Avalon Phoenix
container. We could then write a JMX-based management application
(alternatively we could use third-party jmx enabled management
applications). We could also look at OpenNMS, which I believe is a
JMX-enabled management application

There is a series of articles at IBM AlphaWorks on JMX. If anyone is
interested you should be able to get to all 3 articles from here
http://www-106.ibm.com/developerworks/java/library/j-jmx3/

It would also be nice to ditch our BasicService stuff and go do either one
of the Avalon containers. The lightweight containers you mentioned are still
under heavt development. Has anyone looked into HiveMind
http://jakarta.apache.org/commons/sandbox/hivemind/

Post by Tim Anderson
Top of my list at the moment is to get 0.7.6 ready.
. fixing bugs reported by the CTS.
. migrating all of the docs to xdoc format, so the website
can be completely generated by maven.
I want to get rid of the PDF users guide which is too hard to
maintain.
. finish the maven based build
. generating performance stats to get a feel for where the
bottlenecks are. I hope to publish some data in the next
week.
-Tim
PS: probably should keep posts on the developer list...

Post by Tim Anderson
-----Original Message-----
Sent: Wednesday, 23 July 2003 9:45 PM
Subject: Re: [openjms-developer] Fw: OpenJms and Security
I'll have a look at the Admin API and GUI.
Wouldnt it be better to split the AdminItf into AdminItf
(create/delete/udate) and MonitorItf for monitoring the system (count,
destinationlist, userlist, etc.)???
For now Ill auth. the admin against the users in db.
For later we should have spesial. Admin-users.
Users <----many-to-many---> Groups
Groups will contain two default groups: Administrators and PUBLIC
Users will ALWAYS contain at least on user that is a member of
Administrators and all users will by default become a member of PUBLIC.
By doing this it will be easy to impl. Acls
(This pretty much like the way this is impl. in SonicMQ)
I would also like to rewrite the Admin GUI when I find the

time, maybe in

Post by Tim Anderson
september.
Maybe It should be ported to JMX??
Sorry for all this thoughts/questions, but when you start to
think..........
:-)
Unfortunatly we a have a delivery in apx. 3-4 weeks time and we are of
course at least one month after sched. so Ill have to put a lot
of effort in
to that :-((
K
----- Original Message -----
Sent: Wednesday, July 23, 2003 5:49 AM
Subject: RE: [openjms-developer] Fw: OpenJms and Security

Post by Tim Anderson
1. update remaining create_*.sql scripts to include the users table.
2. add sql scripts to create the users tables, for existing

databases

Post by Tim Anderson
3. update configuration reference xdoc to include

Post by Tim Anderson
and <Users/>

Post by Tim Anderson
4. add security section to the administrators guide xdocs
5. add user management to the admin GUI
6. update sample configs to include <SecurityConfiguration/> and

Post by Tim Anderson
7. more testing. I'll be running it against the JMS CTS

over the next

Post by Tim Anderson
few

Post by Tim Anderson
days.

Post by Tim Anderson
8. Add encryption of password, to avoid sending it cleartext

[optional]

Post by Tim Anderson
9. Add authentication to the embedded JNDI provider
10. Add authentication the administration API

Post by Tim Anderson
If you (or anyone else for that matter) wants to do any of

the above,

Post by Tim Anderson
please let me know.
-------------------------------------------------------
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a

single machine.

Post by Tim Anderson
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual

machines at the

Post by Tim Anderson
same time. Free trial click here: http://www.vmware.com/wl/offer/345/0
_______________________________________________
openjms-developer mailing list
https://lists.sourceforge.net/lists/listinfo/openjms-developer

Knut at work

2003-07-23 15:43:27 UTC

----- Original Message -----
From: "Jim Alateras" <***@comware.com.au>
To: <***@netspace.net.au>; "Knut at work" <***@royalhighgate.com>
Cc: "sourceforge-openjms-dev" <openjms-***@lists.sourceforge.net>
Sent: Wednesday, July 23, 2003 10:52 AM
Subject: RE: [openjms-developer] Fw: OpenJms and Security

+1 for this proposal, lets do it this way.

Post by Tim Anderson
+1 to rewrite of admin gui. More along the lines of
iBus//MessageServers GUI, than Sonic's which from memory was
awful.

You prob. refer to version 4 or lower of SonicMQ.
Have a look at the new SonicMQ version 5.0 - this is jmx-based and the
managment console is totaly rewritten.

Post by Jim Alateras
+1 to rewrite I also think it is worth looking into MQSeries Explorer.

Im not familiar with iBus and have not used MQSeries for a couple of
ears - Ill take a look.

+1 To JMX support we could embed mx4j similar to the Avalon Phoenix
container. We could then write a JMX-based management application
(alternatively we could use third-party jmx enabled management
applications). We could also look at OpenNMS, which I believe is a
JMX-enabled management application
There is a series of articles at IBM AlphaWorks on JMX. If anyone is
interested you should be able to get to all 3 articles from here
http://www-106.ibm.com/developerworks/java/library/j-jmx3/
It would also be nice to ditch our BasicService stuff and go do either one
of the Avalon containers. The lightweight containers you mentioned are still
under heavt development. Has anyone looked into HiveMind
http://jakarta.apache.org/commons/sandbox/hivemind/

time, maybe in

Post by Tim Anderson
1. update remaining create_*.sql scripts to include the users table.
2. add sql scripts to create the users tables, for existing

databases

Post by Tim Anderson
3. update configuration reference xdoc to include

Post by Tim Anderson
and <Users/>

Post by Tim Anderson
4. add security section to the administrators guide xdocs
5. add user management to the admin GUI
6. update sample configs to include <SecurityConfiguration/> and

Post by Tim Anderson
7. more testing. I'll be running it against the JMS CTS

over the next

Post by Tim Anderson
few

Post by Tim Anderson
days.

Post by Tim Anderson
8. Add encryption of password, to avoid sending it cleartext

[optional]

Post by Tim Anderson
9. Add authentication to the embedded JNDI provider
10. Add authentication the administration API

Post by Tim Anderson
If you (or anyone else for that matter) wants to do any of

the above,

Post by Tim Anderson
please let me know.
-------------------------------------------------------
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a

single machine.

Post by Tim Anderson
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual

machines at the

http://www.vmware.com/wl/offer/345/0

Post by Tim Anderson
_______________________________________________
openjms-developer mailing list
https://lists.sourceforge.net/lists/listinfo/openjms-developer

Tim Anderson

2003-07-24 06:53:12 UTC