wso2 / andes

Apache License 2.0
39 stars 128 forks source link

Fix issues in authorization #997

Closed sdkottegoda closed 6 years ago

sdkottegoda commented 6 years ago

Purpose

Permission for queue consume is granted during the binding authorization. The issue was caused due to the fact that the permission check for binding was done after adding the binding. This existence of the incorrect binding causes the next consume call to be directly checked for autherization skipping necessary permission granting in binding creation. Resolves: wso2/product-ei#2631

A user is granted permission to consume from a queue upon being authorized for the binding. Authorization for binding only happens for a new binding. The second user with the same subscription id is not granted permission to consume from the queue since binding authorization is skipped. Resolves: wso2/product-ei#2603