Feature: Support for authoriztion of connection fields

[mattrpav]

• Add an isSsl() helper getter to Connector
• Add ConnectionCallback for processing clientId authz
• Include support for authorizing network connections

This feature provides hooks for authorization connections based on clientId, including specifying if a specific user may register their connection as a network connection.

Network Connection authorization is optional, and detected automatically by the broker-side JAAS handling when a clientId authorization is configured. If clientId authorization is not configure, the authorization check for network connections is skipped matching current behavior.

[cshannon]

In general it doesn't really seem like we should be doing any kind of authentication checks here and I think it makes sense to move this and treat each connection attempt independently.

The proper place to do the checking is here:

activemq/activemq-broker/src/main/java/org/apache/activemq/broker/TransportConnection.java

Line 866 in d9093d3

addNetworkConnection();

After the addConnection() executes to handle the jaas authenticaiton logic there is that line which process addNetworkConnection(). These checks should be done either before the addNetworkConnection() call or just moved into that method first so that we throw the exception and cleanup before continuing.

I don't think it makes sense to loop over all states, I think we can just allow it as long as the current connection attempt is ok (there's usually only 1 state anyways)

[mattrpav]

Good catch. The original intent was authz only the network conn info part. Since the feature expanded to allow authz on a number of connection related infos, the place you pointed out is not just subjectively better -- but required for those other authz points to be functional.

[cshannon]

LGTM, the design of the auth decision based on network/client id being made entirely inside of the jaas module makes sense and aligns with existing authentication. I could see there being tweaks to this in the future (maybe other ways to configure or enhancements) but it's a new feature so it's fine to go into 6.4.0 and it could always be improved if stuff comes up.