[jboss-jira] [JBoss JIRA] (WFLY-9181) ReadOnly user able to perform runtimeOnly operations on JMS queues and Topic thorugh CLI

[ https://issues.jboss.org/browse/WFLY-9181?page=com.atlassian.jira.plugin.... ] shailendra singh updated WFLY-9181: ----------------------------------- Description: ReadOnly user able to perform runtimeOnlly operations on JMS queues thorugh CLI Like:- 'Monitor' roles have permissions to remove messages from the queue. {code:java} [standalone@localhost:9990 /] /subsystem=messaging-activemq/server=default/jms-queue=DLQ:remove-messages() { "outcome" => "success", "result" => 14 } [standalone@localhost:9990 /] {code} Also drop-all-subscriptions on a topic. {code:java} [[standalone@localhost:9990 /] /subsystem=messaging-activemq/server=default/jms-topic=testTopic:drop-all-subscriptions() { "outcome" => "success", "result" => undefined } [standalone@localhost:9990 /] {code} So even a read-only role ('Monitor') has access to :remove-messages. To show RBAC is enforced for other CLI operations: {code:java} [standalone@localhost:9990 /] /subsystem=messaging-activemq/server=default/jms-queue=DLQ:remove() { "outcome" => "failed", "failure-description" => "WFLYCTL0313: Unauthorized to execute operation 'remove' for resource '[ (\"subsystem\" => \"messaging-activemq\"), (\"server\" => \"default\"), (\"jms-queue\" => \"DLQ\") ]' -- \"WFLYCTL0332: Permission denied\"", "rolled-back" => true } [standalone@localhost:9990 /] {code} Expectation:- The permissions between the monitoring console (GUI) and the CLI should be in sync for flushing a JMS queue. was: ReadOnly user able to perform runtimeOnlly operations on JMS queues thorugh CLI Like:- 'Monitor' roles have permissions to remove messages from the queue. {code:java} [standalone@localhost:9990 /] /subsystem=messaging-activemq/server=default/jms-queue=DLQ:remove-messages() { "outcome" => "success", "result" => 14 } [standalone@localhost:9990 /] {code} So even a read-only role ('Monitor') has access to :remove-messages. To show RBAC is enforced for other CLI operations: {code:java} [standalone@localhost:9990 /] /subsystem=messaging-activemq/server=default/jms-queue=DLQ:remove() { "outcome" => "failed", "failure-description" => "WFLYCTL0313: Unauthorized to execute operation 'remove' for resource '[ (\"subsystem\" => \"messaging-activemq\"), (\"server\" => \"default\"), (\"jms-queue\" => \"DLQ\") ]' -- \"WFLYCTL0332: Permission denied\"", "rolled-back" => true } [standalone@localhost:9990 /] {code} Expectation:- The permissions between the monitoring console (GUI) and the CLI should be in sync for flushing a JMS queue. -- This message was sent by Atlassian JIRA (v7.2.3#72005)