Package org.apache.activemq.shiro.authz

Class AuthorizationFilter

  • All Implemented Interfaces:
    Broker, Region, org.apache.activemq.Service
    public class AuthorizationFilter
extends EnvironmentFilter
    The AuthorizationFilter asserts that actions are allowed to execute first before they are actually executed. Such actions include creating, removing, reading from and writing to destinations.

    This implementation is strictly permission-based, allowing for the finest-grained security policies possible. Whenever a Subject associated with a connection attempts to perform an Action (such as creating a destination, or reading from a queue, etc), one or more Permissions representing that action are checked.

    If the SubjectisPermitted to perform the action, the action is allowed to execute and the broker filter chain executes uninterrupted.

    However, if the Subject is not permitted to perform the action, an UnauthorizedException will be thrown, preventing the filter chain from executing that action.

    ActionPermissionResolver

    The attempted Action is guarded by one or more Permissions as indicated by a configurable actionPermissionResolver. The actionPermissionResolver indicates which permissions must be granted to the connection Subject in order for the action to execute.

    The default actionPermissionResolver instance is a DestinationActionPermissionResolver, which indicates which permissions are required to perform any action on a particular destination. Those familiar with Shiro's WildcardPermission syntax will find the DestinationActionPermissionResolver's createPermissionString method documentation valuable for understanding how destination actions are represented as permissions.

    Since:
    5.10.0
    See Also:
    ActionPermissionResolver, DestinationActionPermissionResolver