QPID-5634: [Java Broker] Remove support for AccessPlugins at the level of the virtualhost. Introduce supports for ACLs rules that include virtualhost predicate.

git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1579986 13f79535-47bb-0310-9956-ffa450edef68

28 files changed, 1122 insertions, 515 deletions

diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/exchange/AbstractExchange.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/exchange/AbstractExchange.java
index a30806d810..25f20ba1ee 100644
--- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/exchange/AbstractExchange.java
+++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/exchange/AbstractExchange.java
@@ -612,7 +612,7 @@ public abstract class AbstractExchange<T extends AbstractExchange<T>>
         }
 
         // Check access
-        _virtualHost.getSecurityManager().authoriseUnbind(this, bindingKey, queue);
+        _virtualHost.getSecurityManager().authoriseUnbind(binding);
 
         BindingImpl b = _bindingsMap.remove(new BindingIdentifier(bindingKey,queue));
 
diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/VirtualHost.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/VirtualHost.java
index 4aec9b38a0..ee10ecfc8b 100644
--- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/VirtualHost.java
+++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/VirtualHost.java
@@ -22,7 +22,6 @@ package org.apache.qpid.server.model;
 
 import org.apache.qpid.server.configuration.updater.TaskExecutor;
 import org.apache.qpid.server.message.MessageInstance;
-import org.apache.qpid.server.security.SecurityManager;
 import org.apache.qpid.server.store.MessageStore;
 
 import java.security.AccessControlException;
@@ -179,12 +178,6 @@ public interface VirtualHost<X extends VirtualHost<X>> extends ConfiguredObject<
 
     void executeTransaction(TransactionalOperation op);
 
-    /**
-     * A temporary hack to expose host security manager.
-     * TODO We need to add and implement an authorization provider configured object instead
-     */
-    SecurityManager getSecurityManager();
-
     // TODO - remove this
     TaskExecutor getTaskExecutor();
 
diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/VirtualHostAdapter.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/VirtualHostAdapter.java
index 72b316c784..6dbc2eea85 100644
--- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/VirtualHostAdapter.java
+++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/model/adapter/VirtualHostAdapter.java
@@ -49,7 +49,6 @@ import org.apache.qpid.server.plugin.ExchangeType;
 import org.apache.qpid.server.protocol.AMQConnectionModel;
 import org.apache.qpid.server.queue.AMQQueue;
 import org.apache.qpid.server.queue.ConflationQueue;
-import org.apache.qpid.server.security.SecurityManager;
 import org.apache.qpid.server.security.access.Operation;
 import org.apache.qpid.server.stats.StatisticsGatherer;
 import org.apache.qpid.server.store.MessageStore;
@@ -1126,12 +1125,6 @@ public final class VirtualHostAdapter extends AbstractConfiguredObject<VirtualHo
     }
 
     @Override
-    public SecurityManager getSecurityManager()
-    {
-        return _virtualHost.getSecurityManager();
-    }
-
-    @Override
     public MessageStore getMessageStore()
     {
         return _virtualHost.getMessageStore();
diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/SecurityManager.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/SecurityManager.java
index 77886e9030..478499fe6c 100755
--- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/SecurityManager.java
+++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/SecurityManager.java
@@ -18,27 +18,6 @@
  */
 package org.apache.qpid.server.security;
 
-import org.apache.log4j.Logger;
-
-import org.apache.qpid.server.binding.BindingImpl;
-import org.apache.qpid.server.consumer.ConsumerImpl;
-import org.apache.qpid.server.exchange.ExchangeImpl;
-
-import org.apache.qpid.server.model.*;
-import org.apache.qpid.server.plugin.AccessControlFactory;
-import org.apache.qpid.server.plugin.QpidServiceLoader;
-import org.apache.qpid.server.protocol.AMQConnectionModel;
-import org.apache.qpid.server.queue.AMQQueue;
-import org.apache.qpid.server.security.access.FileAccessControlProviderConstants;
-import org.apache.qpid.server.security.access.ObjectProperties;
-import org.apache.qpid.server.security.access.ObjectType;
-import org.apache.qpid.server.security.access.Operation;
-import org.apache.qpid.server.security.access.OperationLoggingDetails;
-import org.apache.qpid.server.security.auth.AuthenticatedPrincipal;
-import org.apache.qpid.server.security.auth.TaskPrincipal;
-
-import javax.security.auth.Subject;
-
 import static org.apache.qpid.server.security.access.ObjectType.BROKER;
 import static org.apache.qpid.server.security.access.ObjectType.EXCHANGE;
 import static org.apache.qpid.server.security.access.ObjectType.GROUP;
@@ -62,54 +41,48 @@ import java.security.AccessController;
 import java.security.Principal;
 import java.util.Collection;
 import java.util.Collections;
-import java.util.HashMap;
-import java.util.Map;
-import java.util.Map.Entry;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 
+import javax.security.auth.Subject;
+
+import org.apache.qpid.server.binding.BindingImpl;
+import org.apache.qpid.server.consumer.ConsumerImpl;
+import org.apache.qpid.server.exchange.ExchangeImpl;
+import org.apache.qpid.server.model.AccessControlProvider;
+import org.apache.qpid.server.model.Broker;
+import org.apache.qpid.server.model.ConfigurationChangeListener;
+import org.apache.qpid.server.model.ConfiguredObject;
+import org.apache.qpid.server.model.State;
+import org.apache.qpid.server.protocol.AMQConnectionModel;
+import org.apache.qpid.server.queue.AMQQueue;
+import org.apache.qpid.server.security.access.ObjectProperties;
+import org.apache.qpid.server.security.access.ObjectProperties.Property;
+import org.apache.qpid.server.security.access.ObjectType;
+import org.apache.qpid.server.security.access.Operation;
+import org.apache.qpid.server.security.access.OperationLoggingDetails;
+import org.apache.qpid.server.security.auth.AuthenticatedPrincipal;
+import org.apache.qpid.server.security.auth.TaskPrincipal;
+
 public class SecurityManager implements ConfigurationChangeListener
 {
-    private static final Logger _logger = Logger.getLogger(SecurityManager.class);
-
     private static final Subject SYSTEM = new Subject(true,
                                                      Collections.singleton(new SystemPrincipal()),
                                                      Collections.emptySet(),
                                                      Collections.emptySet());
 
+    private final ConcurrentHashMap<String, AccessControl> _plugins = new ConcurrentHashMap<String, AccessControl>();
+    private final boolean _managementMode;
+    private final Broker<?> _broker;
 
-    private ConcurrentHashMap<String, AccessControl> _globalPlugins = new ConcurrentHashMap<String, AccessControl>();
-    private ConcurrentHashMap<String, AccessControl> _hostPlugins = new ConcurrentHashMap<String, AccessControl>();
-
-    private boolean _managementMode;
-
-    private Broker _broker;
+    private final ConcurrentHashMap<PublishAccessCheckCacheEntry, PublishAccessCheck> _publishAccessCheckCache = new ConcurrentHashMap<SecurityManager.PublishAccessCheckCacheEntry, SecurityManager.PublishAccessCheck>();
 
-    /*
-     * Used by the Broker.
-     */
-    public SecurityManager(Broker broker, boolean managementMode)
+    public SecurityManager(Broker<?> broker, boolean managementMode)
     {
         _managementMode = managementMode;
         _broker = broker;
     }
 
-    /*
-     * Used by the VirtualHost to allow deferring to the broker level security plugins if required.
-     */
-    public SecurityManager(SecurityManager parent, String aclFile, String vhostName)
-    {
-        _managementMode = parent._managementMode;
-        _broker = parent._broker;
-        if(!_managementMode)
-        {
-            configureVirtualHostAclPlugin(aclFile, vhostName);
-
-            // our global plugins are the parent's host plugins
-            _globalPlugins = parent._hostPlugins;
-        }
-    }
-
     public static Subject getSubjectWithAddedSystemRights()
     {
         Subject subject = Subject.getSubject(AccessController.getContext());
@@ -135,50 +108,11 @@ public class SecurityManager implements ConfigurationChangeListener
         return subject;
     }
 
-    private void configureVirtualHostAclPlugin(String aclFile, String vhostName)
-    {
-        if(aclFile != null)
-        {
-            Map<String, Object> attributes = new HashMap<String, Object>();
-
-            attributes.put(AccessControlProvider.TYPE, FileAccessControlProviderConstants.ACL_FILE_PROVIDER_TYPE);
-            attributes.put(FileAccessControlProviderConstants.PATH, aclFile);
-
-            for (AccessControlFactory provider : (new QpidServiceLoader<AccessControlFactory>()).instancesOf(AccessControlFactory.class))
-            {
-                AccessControl accessControl = provider.createInstance(attributes, _broker);
-                accessControl.open();
-                if(accessControl != null)
-                {
-                    String pluginTypeName = getPluginTypeName(accessControl);
-                    _hostPlugins.put(pluginTypeName, accessControl);
-
-                    if(_logger.isDebugEnabled())
-                    {
-                        _logger.debug("Added access control to host plugins with name: " + vhostName);
-                    }
-
-                    break;
-                }
-            }
-        }
-
-        if(_logger.isDebugEnabled())
-        {
-            _logger.debug("Configured " + _hostPlugins.size() + " access control plugins");
-        }
-    }
-
     private String getPluginTypeName(AccessControl accessControl)
     {
         return accessControl.getClass().getName();
     }
 
-    public static Logger getLogger()
-    {
-        return _logger;
-    }
-
     public static boolean isSystemProcess()
     {
         Subject subject = Subject.getSubject(AccessController.getContext());
@@ -234,71 +168,14 @@ public class SecurityManager implements ConfigurationChangeListener
             return true;
         }
 
-        Map<String, AccessControl> remainingPlugins = _globalPlugins.isEmpty()
-                ? Collections.<String, AccessControl>emptyMap()
-                : _hostPlugins.isEmpty() ? _globalPlugins : new HashMap<String, AccessControl>(_globalPlugins);
-
-        if(!_hostPlugins.isEmpty())
-        {
-            for (Entry<String, AccessControl> hostEntry : _hostPlugins.entrySet())
-            {
-                // Create set of global only plugins
-                AccessControl globalPlugin = remainingPlugins.get(hostEntry.getKey());
-                if (globalPlugin != null)
-                {
-                    remainingPlugins.remove(hostEntry.getKey());
-                }
-
-                Result host = checker.allowed(hostEntry.getValue());
-
-                if (host == Result.DENIED)
-                {
-                    // Something vetoed the access, we're done
-                    return false;
-                }
-
-                // host allow overrides global allow, so only check global on abstain or defer
-                if (host != Result.ALLOWED)
-                {
-                    if (globalPlugin == null)
-                    {
-                        if (host == Result.DEFER)
-                        {
-                            host = hostEntry.getValue().getDefault();
-                        }
-                        if (host == Result.DENIED)
-                        {
-                            return false;
-                        }
-                    }
-                    else
-                    {
-                        Result global = checker.allowed(globalPlugin);
-                        if (global == Result.DEFER)
-                        {
-                            global = globalPlugin.getDefault();
-                        }
-                        if (global == Result.ABSTAIN && host == Result.DEFER)
-                        {
-                            global = hostEntry.getValue().getDefault();
-                        }
-                        if (global == Result.DENIED)
-                        {
-                            return false;
-                        }
-                    }
-                }
-            }
-        }
-
-        for (AccessControl plugin : remainingPlugins.values())
+        for (AccessControl plugin : _plugins.values())
         {
             Result remaining = checker.allowed(plugin);
-			if (remaining == Result.DEFER)
+            if (remaining == Result.DEFER)
             {
                 remaining = plugin.getDefault();
             }
-			if (remaining == Result.DENIED)
+            if (remaining == Result.DENIED)
             {
                 return false;
             }
@@ -308,28 +185,23 @@ public class SecurityManager implements ConfigurationChangeListener
         return true;
     }
 
-    public void authoriseCreateBinding(BindingImpl binding)
+    public void authoriseCreateBinding(final BindingImpl binding)
     {
-        final ExchangeImpl exch = binding.getExchange();
-        final AMQQueue queue = binding.getAMQQueue();
-        final String bindingKey = binding.getBindingKey();
-
-        boolean allowed =
-            checkAllPlugins(new AccessCheck()
+        boolean allowed = checkAllPlugins(new AccessCheck()
         {
             Result allowed(AccessControl plugin)
             {
-                return plugin.authorise(BIND, EXCHANGE, new ObjectProperties(exch, queue, bindingKey));
+                return plugin.authorise(BIND, EXCHANGE, new ObjectProperties(binding));
             }
         });
 
         if(!allowed)
         {
-            throw new AccessControlException("Permission denied: binding " + bindingKey);
+            throw new AccessControlException("Permission denied: binding " + binding.getBindingKey());
         }
     }
 
-    public void authoriseMethod(final Operation operation, final String componentName, final String methodName)
+    public void authoriseMethod(final Operation operation, final String componentName, final String methodName, final String virtualHostName)
     {
         boolean allowed =  checkAllPlugins(new AccessCheck()
         {
@@ -339,8 +211,11 @@ public class SecurityManager implements ConfigurationChangeListener
                 properties.setName(methodName);
                 if (componentName != null)
                 {
-                    // Only set the property if there is a component name
-	                properties.put(ObjectProperties.Property.COMPONENT, componentName);
+                    properties.put(ObjectProperties.Property.COMPONENT, componentName);
+                }
+                if (virtualHostName != null)
+                {
+                    properties.put(ObjectProperties.Property.VIRTUALHOST_NAME, virtualHostName);
                 }
                 return plugin.authorise(operation, METHOD, properties);
             }
@@ -367,15 +242,19 @@ public class SecurityManager implements ConfigurationChangeListener
 
     public void authoriseCreateConnection(final AMQConnectionModel connection)
     {
+        final String virtualHostName = connection.getVirtualHostName();
         if(!checkAllPlugins(new AccessCheck()
         {
             Result allowed(AccessControl plugin)
             {
-                return plugin.authorise(Operation.ACCESS, VIRTUALHOST, ObjectProperties.EMPTY);
+                // We put the name into the properties under both name and virtualhost_name so the user may express predicates using either.
+                ObjectProperties properties = new ObjectProperties(virtualHostName);
+                properties.put(Property.VIRTUALHOST_NAME, virtualHostName);
+                return plugin.authorise(Operation.ACCESS, VIRTUALHOST, properties);
             }
         }))
         {
-            throw new AccessControlException("Permission denied: " + connection.getVirtualHostName());
+            throw new AccessControlException("Permission denied: " + virtualHostName);
         }
     }
 
@@ -403,10 +282,7 @@ public class SecurityManager implements ConfigurationChangeListener
         {
             Result allowed(AccessControl plugin)
             {
-                return plugin.authorise(CREATE, EXCHANGE, new ObjectProperties(exchange.isAutoDelete(),
-                                                                               exchange.isDurable(),
-                                                                               exchangeName,
-                                                                               exchange.getTypeName()));
+                return plugin.authorise(CREATE, EXCHANGE, new ObjectProperties(exchange));
             }
         }))
         {
@@ -421,11 +297,7 @@ public class SecurityManager implements ConfigurationChangeListener
         {
             Result allowed(AccessControl plugin)
             {
-                return plugin.authorise(CREATE, QUEUE, new ObjectProperties(queue.getAttribute(Queue.LIFETIME_POLICY) != LifetimePolicy.PERMANENT,
-                                                                            Boolean.TRUE.equals(queue.getAttribute(Queue.DURABLE)),
-                                                                            queue.getAttribute(Queue.EXCLUSIVE) != ExclusivityPolicy.NONE,
-                                                                            queueName,
-                                                                            queue.getOwner()));
+                return plugin.authorise(CREATE, QUEUE, new ObjectProperties(queue));
             }
         }))
         {
@@ -470,7 +342,7 @@ public class SecurityManager implements ConfigurationChangeListener
         {
             Result allowed(AccessControl plugin)
             {
-                return plugin.authorise(UPDATE, EXCHANGE, new ObjectProperties(exchange.getName()));
+                return plugin.authorise(UPDATE, EXCHANGE, new ObjectProperties(exchange));
             }
         }))
         {
@@ -484,7 +356,7 @@ public class SecurityManager implements ConfigurationChangeListener
         {
             Result allowed(AccessControl plugin)
             {
-                return plugin.authorise(DELETE, EXCHANGE, new ObjectProperties(exchange.getName()));
+                return plugin.authorise(DELETE, EXCHANGE, new ObjectProperties(exchange));
             }
         }))
         {
@@ -522,39 +394,15 @@ public class SecurityManager implements ConfigurationChangeListener
         }
     }
 
-    private ConcurrentHashMap<String, ConcurrentHashMap<String, PublishAccessCheck>> _immediatePublishPropsCache
-            = new ConcurrentHashMap<String, ConcurrentHashMap<String, PublishAccessCheck>>();
-    private ConcurrentHashMap<String, ConcurrentHashMap<String, PublishAccessCheck>> _publishPropsCache
-            = new ConcurrentHashMap<String, ConcurrentHashMap<String, PublishAccessCheck>>();
-
-    public void authorisePublish(final boolean immediate, String routingKey, String exchangeName)
+    public void authorisePublish(final boolean immediate, String routingKey, String exchangeName, String virtualHostName)
     {
-        if(routingKey == null)
+        PublishAccessCheckCacheEntry key = new PublishAccessCheckCacheEntry(immediate, routingKey, exchangeName, virtualHostName);
+        PublishAccessCheck check = _publishAccessCheckCache.get(key);
+        if (check == null)
         {
-            routingKey = "";
+            check = new PublishAccessCheck(new ObjectProperties(virtualHostName, exchangeName, routingKey, immediate));
+            _publishAccessCheckCache.putIfAbsent(key, check);
         }
-        if(exchangeName == null)
-        {
-            exchangeName = "";
-        }
-        PublishAccessCheck check;
-        ConcurrentHashMap<String, ConcurrentHashMap<String, PublishAccessCheck>> cache =
-                immediate ? _immediatePublishPropsCache : _publishPropsCache;
-
-        ConcurrentHashMap<String, PublishAccessCheck> exchangeMap = cache.get(exchangeName);
-        if(exchangeMap == null)
-        {
-            cache.putIfAbsent(exchangeName, new ConcurrentHashMap<String, PublishAccessCheck>());
-            exchangeMap = cache.get(exchangeName);
-        }
-
-            check = exchangeMap.get(routingKey);
-            if(check == null)
-            {
-                check = new PublishAccessCheck(new ObjectProperties(exchangeName, routingKey, immediate));
-                exchangeMap.put(routingKey, check);
-            }
-
         if(!checkAllPlugins(check))
         {
             throw new AccessControlException("Permission denied, publish to: exchange-name '" + exchangeName + "'");
@@ -575,17 +423,17 @@ public class SecurityManager implements ConfigurationChangeListener
         }
     }
 
-    public void authoriseUnbind(final ExchangeImpl exch, final String routingKey, final AMQQueue queue)
+    public void authoriseUnbind(final BindingImpl binding)
     {
         if(! checkAllPlugins(new AccessCheck()
         {
             Result allowed(AccessControl plugin)
             {
-                return plugin.authorise(UNBIND, EXCHANGE, new ObjectProperties(exch, queue, routingKey));
+                return plugin.authorise(UNBIND, EXCHANGE, new ObjectProperties(binding));
             }
         }))
         {
-            throw new AccessControlException("Permission denied: unbinding " + routingKey);
+            throw new AccessControlException("Permission denied: unbinding " + binding.getBindingKey());
         }
     }
 
@@ -618,29 +466,29 @@ public class SecurityManager implements ConfigurationChangeListener
         {
             if(newState == State.ACTIVE)
             {
-                synchronized (_hostPlugins)
+                synchronized (_plugins)
                 {
                     AccessControl accessControl = ((AccessControlProvider)object).getAccessControl();
                     String pluginTypeName = getPluginTypeName(accessControl);
 
-                    _hostPlugins.put(pluginTypeName, accessControl);
+                    _plugins.put(pluginTypeName, accessControl);
                 }
             }
             else if(newState == State.DELETED)
             {
-                synchronized (_hostPlugins)
+                synchronized (_plugins)
                 {
                     AccessControl control = ((AccessControlProvider)object).getAccessControl();
                     String pluginTypeName = getPluginTypeName(control);
 
                     // Remove the type->control mapping for this type key only if the
                     // given control is actually referred to.
-                    if(_hostPlugins.containsValue(control))
+                    if(_plugins.containsValue(control))
                     {
                         // If we are removing this control, check if another of the same
                         // type already exists on the broker and use it in instead.
                         AccessControl other = null;
-                        Collection<AccessControlProvider> providers = _broker.getAccessControlProviders();
+                        Collection<AccessControlProvider<?>> providers = _broker.getAccessControlProviders();
                         for(AccessControlProvider p : providers)
                         {
                             if(p == object || p.getState() != State.ACTIVE)
@@ -660,12 +508,12 @@ public class SecurityManager implements ConfigurationChangeListener
                         if(other != null)
                         {
                             //Another control of this type was found, use it instead
-                            _hostPlugins.replace(pluginTypeName, control, other);
+                            _plugins.replace(pluginTypeName, control, other);
                         }
                         else
                         {
                             //No other was found, remove the type entirely
-                            _hostPlugins.remove(pluginTypeName);
+                            _plugins.remove(pluginTypeName);
                         }
                     }
                 }
@@ -718,4 +566,90 @@ public class SecurityManager implements ConfigurationChangeListener
         });
     }
 
+    public static class PublishAccessCheckCacheEntry
+    {
+        private final boolean _immediate;
+        private final String _routingKey;
+        private final String _exchangeName;
+        private final String _virtualHostName;
+
+        public PublishAccessCheckCacheEntry(boolean immediate, String routingKey, String exchangeName, String virtualHostName)
+        {
+            super();
+            _immediate = immediate;
+            _routingKey = routingKey;
+            _exchangeName = exchangeName;
+            _virtualHostName = virtualHostName;
+        }
+
+        @Override
+        public int hashCode()
+        {
+            final int prime = 31;
+            int result = 1;
+            result = prime * result + ((_exchangeName == null) ? 0 : _exchangeName.hashCode());
+            result = prime * result + (_immediate ? 1231 : 1237);
+            result = prime * result + ((_routingKey == null) ? 0 : _routingKey.hashCode());
+            result = prime * result + ((_virtualHostName == null) ? 0 : _virtualHostName.hashCode());
+            return result;
+        }
+
+        @Override
+        public boolean equals(Object obj)
+        {
+            if (this == obj)
+            {
+                return true;
+            }
+            if (obj == null)
+            {
+                return false;
+            }
+            if (getClass() != obj.getClass())
+            {
+                return false;
+            }
+            PublishAccessCheckCacheEntry other = (PublishAccessCheckCacheEntry) obj;
+            if (_exchangeName == null)
+            {
+                if (other._exchangeName != null)
+                {
+                    return false;
+                }
+            }
+            else if (!_exchangeName.equals(other._exchangeName))
+            {
+                return false;
+            }
+            if (_immediate != other._immediate)
+            {
+                return false;
+            }
+            if (_routingKey == null)
+            {
+                if (other._routingKey != null)
+                {
+                    return false;
+                }
+            }
+            else if (!_routingKey.equals(other._routingKey))
+            {
+                return false;
+            }
+            if (_virtualHostName == null)
+            {
+                if (other._virtualHostName != null)
+                {
+                    return false;
+                }
+            }
+            else if (!_virtualHostName.equals(other._virtualHostName))
+            {
+                return false;
+            }
+            return true;
+        }
+
+
+    }
 }
diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/access/ObjectProperties.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/access/ObjectProperties.java
index ae0241314f..6122cef5c1 100644
--- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/access/ObjectProperties.java
+++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/access/ObjectProperties.java
@@ -26,8 +26,10 @@ import java.util.Map;
 
 import org.apache.commons.lang.StringUtils;
 import org.apache.commons.lang.builder.EqualsBuilder;
+import org.apache.qpid.server.binding.BindingImpl;
 import org.apache.qpid.server.exchange.ExchangeImpl;
 import org.apache.qpid.server.model.LifetimePolicy;
+import org.apache.qpid.server.model.VirtualHost;
 import org.apache.qpid.server.queue.AMQQueue;
 
 /**
@@ -39,7 +41,7 @@ import org.apache.qpid.server.queue.AMQQueue;
  */
 public class ObjectProperties
 {
-    public static final String STAR= "*";
+    public static final String WILD_CARD = "*";
 
     public static final ObjectProperties EMPTY = new ObjectProperties();
 
@@ -65,7 +67,8 @@ public class ObjectProperties
         PACKAGE,
         CLASS,
         FROM_NETWORK,
-        FROM_HOSTNAME;
+        FROM_HOSTNAME,
+        VIRTUALHOST_NAME;
 
         private static final Map<String, Property> _canonicalNameToPropertyMap = new HashMap<String, ObjectProperties.Property>();
 
@@ -152,60 +155,49 @@ public class ObjectProperties
         {
             put(Property.OWNER, queue.getOwner());
         }
-
+        put(Property.VIRTUALHOST_NAME, queue.getParent(VirtualHost.class).getName());
     }
 
-    public ObjectProperties(ExchangeImpl exch, AMQQueue queue, String routingKey)
+    public ObjectProperties(BindingImpl binding)
     {
-        this(queue);
+        ExchangeImpl<?> exch = binding.getExchange();
+        AMQQueue<?> queue = binding.getAMQQueue();
+        String routingKey = binding.getBindingKey();
 
         setName(exch.getName());
 
-		put(Property.QUEUE_NAME, queue.getName());
+        put(Property.QUEUE_NAME, queue.getName());
         put(Property.ROUTING_KEY, routingKey);
-    }
-
-    public ObjectProperties(String exchangeName, String routingKey, Boolean immediate)
-    {
-        this(exchangeName, routingKey);
+        put(Property.VIRTUALHOST_NAME, queue.getParent(VirtualHost.class).getName());
 
-        put(Property.IMMEDIATE, immediate);
+        // The temporary attribute (inherited from the binding's queue) seems to exist to allow the user to
+        // express rules about the binding of temporary queues (whose names cannot be predicted).
+        put(Property.TEMPORARY, queue.getLifetimePolicy() != LifetimePolicy.PERMANENT);
+        put(Property.DURABLE, queue.isDurable());
     }
 
-    public ObjectProperties(String exchangeName, String routingKey)
+    public ObjectProperties(String virtualHostName, String exchangeName, String routingKey, Boolean immediate)
     {
         super();
 
         setName(exchangeName);
 
         put(Property.ROUTING_KEY, routingKey);
+        put(Property.IMMEDIATE, immediate);
+        put(Property.VIRTUALHOST_NAME, virtualHostName);
     }
 
-    public ObjectProperties(Boolean autoDelete, Boolean durable, String exchangeName,
-            String exchangeType)
-    {
-        super();
-
-        setName(exchangeName);
-
-        put(Property.AUTO_DELETE, autoDelete);
-        put(Property.TEMPORARY, autoDelete);
-        put(Property.DURABLE, durable);
-        put(Property.TYPE, exchangeType);
-    }
-
-    public ObjectProperties(Boolean autoDelete, Boolean durable, Boolean exclusive,
-                            String queueName, String owner)
+    public ObjectProperties(ExchangeImpl<?> exchange)
     {
         super();
 
-        setName(queueName);
+        setName(exchange.getName());
 
-        put(Property.AUTO_DELETE, autoDelete);
-        put(Property.TEMPORARY, autoDelete);
-        put(Property.DURABLE, durable);
-        put(Property.EXCLUSIVE, exclusive);
-        put(Property.OWNER, owner);
+        put(Property.AUTO_DELETE, exchange.isAutoDelete());
+        put(Property.TEMPORARY, exchange.getLifetimePolicy() != LifetimePolicy.PERMANENT);
+        put(Property.DURABLE, exchange.isDurable());
+        put(Property.TYPE, exchange.getTypeName());
+        put(Property.VIRTUALHOST_NAME, exchange.getParent(VirtualHost.class).getName());
     }
 
     public ObjectProperties(Boolean exclusive, Boolean noAck, Boolean noLocal, Boolean nowait, AMQQueue queue)
@@ -283,8 +275,8 @@ public class ObjectProperties
     {
         return (StringUtils.isEmpty(ruleValue)
                 || StringUtils.equals(thisValue, ruleValue))
-                || ruleValue.equals(STAR)
-                || (ruleValue.endsWith(STAR)
+                || ruleValue.equals(WILD_CARD)
+                || (ruleValue.endsWith(WILD_CARD)
                         && thisValue != null
                         && thisValue.length() >= ruleValue.length() - 1
                         && thisValue.startsWith(ruleValue.substring(0, ruleValue.length() - 1)));
diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/access/OperationLoggingDetails.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/access/OperationLoggingDetails.java
index a683199abc..f36695cb86 100644
--- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/access/OperationLoggingDetails.java
+++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/security/access/OperationLoggingDetails.java
@@ -32,6 +32,42 @@ public class OperationLoggingDetails extends ObjectProperties
     }
 
     @Override
+    public int hashCode()
+    {
+        return super.hashCode() + ((_description == null) ? 0 : _description.hashCode());
+    }
+
+    @Override
+    public boolean equals(Object obj)
+    {
+        if (this == obj)
+        {
+            return true;
+        }
+        if (!super.equals(obj))
+        {
+            return false;
+        }
+        if (getClass() != obj.getClass())
+        {
+            return false;
+        }
+        OperationLoggingDetails other = (OperationLoggingDetails) obj;
+        if (_description == null)
+        {
+            if (other._description != null)
+            {
+                return false;
+            }
+        }
+        else if (!_description.equals(other._description))
+        {
+            return false;
+        }
+        return true;
+    }
+
+    @Override
     public String toString()
     {
         StringBuilder sb = new StringBuilder("(");
diff --git a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/virtualhost/AbstractVirtualHost.java b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/virtualhost/AbstractVirtualHost.java
index a4719f6058..2f1939be39 100644
--- a/qpid/java/broker-core/src/main/java/org/apache/qpid/server/virtualhost/AbstractVirtualHost.java
+++ b/qpid/java/broker-core/src/main/java/org/apache/qpid/server/virtualhost/AbstractVirtualHost.java
@@ -156,7 +156,7 @@ public abstract class AbstractVirtualHost implements VirtualHost, IConnectionReg
 
         _eventLogger.message(VirtualHostMessages.CREATED(_name));
 
-        _securityManager = new SecurityManager(parentSecurityManager, _vhostConfig.getConfig().getString("security.acl"), _name);
+        _securityManager = parentSecurityManager;
 
         _connectionRegistry = new ConnectionRegistry();
         _connectionRegistry.addRegistryChangeListener(this);
diff --git a/qpid/java/broker-core/src/test/java/org/apache/qpid/server/security/SecurityManagerTest.java b/qpid/java/broker-core/src/test/java/org/apache/qpid/server/security/SecurityManagerTest.java
new file mode 100644
index 0000000000..e27981d22c
--- /dev/null
+++ b/qpid/java/broker-core/src/test/java/org/apache/qpid/server/security/SecurityManagerTest.java
@@ -0,0 +1,571 @@
+/*
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.qpid.server.security;
+
+import static org.apache.qpid.server.security.access.ObjectType.BROKER;
+import static org.apache.qpid.server.security.access.ObjectType.EXCHANGE;
+import static org.apache.qpid.server.security.access.Operation.ACCESS_LOGS;
+import static org.apache.qpid.server.security.access.Operation.PUBLISH;
+import static org.mockito.Matchers.any;
+import static org.mockito.Matchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.security.AccessControlException;
+
+import org.apache.qpid.server.binding.BindingImpl;
+import org.apache.qpid.server.consumer.ConsumerImpl;
+import org.apache.qpid.server.exchange.ExchangeImpl;
+import org.apache.qpid.server.model.AccessControlProvider;
+import org.apache.qpid.server.model.Broker;
+import org.apache.qpid.server.model.LifetimePolicy;
+import org.apache.qpid.server.model.State;
+import org.apache.qpid.server.model.VirtualHost;
+import org.apache.qpid.server.protocol.AMQConnectionModel;
+import org.apache.qpid.server.queue.AMQQueue;
+import org.apache.qpid.server.security.access.ObjectProperties;
+import org.apache.qpid.server.security.access.ObjectProperties.Property;
+import org.apache.qpid.server.security.access.ObjectType;
+import org.apache.qpid.server.security.access.Operation;
+import org.apache.qpid.server.security.access.OperationLoggingDetails;
+import org.apache.qpid.test.utils.QpidTestCase;
+
+public class SecurityManagerTest extends QpidTestCase
+{
+    private static final String TEST_EXCHANGE_TYPE = "testExchangeType";
+    private static final String TEST_VIRTUAL_HOST = "testVirtualHost";
+    private static final String TEST_EXCHANGE = "testExchange";
+    private static final String TEST_QUEUE = "testQueue";
+
+    private AccessControl _accessControl;
+    private SecurityManager _securityManager;
+    private VirtualHost<?> _virtualHost;
+
+    @Override
+    public void setUp() throws Exception
+    {
+        super.setUp();
+        _accessControl = mock(AccessControl.class);
+        _virtualHost = mock(VirtualHost.class);
+
+        AccessControlProvider<?> aclProvider = mock(AccessControlProvider.class);
+        when(aclProvider.getAccessControl()).thenReturn(_accessControl);
+
+        when(_virtualHost.getName()).thenReturn(TEST_VIRTUAL_HOST);
+
+        _securityManager = new SecurityManager(mock(Broker.class), false);
+        _securityManager.stateChanged(aclProvider, State.INITIALISING, State.ACTIVE);
+    }
+
+    public void testAuthoriseCreateBinding()
+    {
+        ExchangeImpl<?> exchange = mock(ExchangeImpl.class);
+        when(exchange.getParent(VirtualHost.class)).thenReturn(_virtualHost);
+        when(exchange.getName()).thenReturn(TEST_EXCHANGE);
+
+        AMQQueue<?> queue = mock(AMQQueue.class);
+        when(queue.getParent(VirtualHost.class)).thenReturn(_virtualHost);
+        when(queue.getName()).thenReturn(TEST_QUEUE);
+        when(queue.isDurable()).thenReturn(true);
+        when(queue.getLifetimePolicy()).thenReturn(LifetimePolicy.PERMANENT);
+
+        BindingImpl binding = mock(BindingImpl.class);
+        when(binding.getExchange()).thenReturn(exchange);
+        when(binding.getAMQQueue()).thenReturn(queue);
+        when(binding.getBindingKey()).thenReturn("bindingKey");
+
+        ObjectProperties properties = new ObjectProperties();
+        properties.put(Property.NAME, TEST_EXCHANGE);
+        properties.put(Property.VIRTUALHOST_NAME, TEST_VIRTUAL_HOST);
+        properties.put(Property.QUEUE_NAME, TEST_QUEUE);
+        properties.put(Property.ROUTING_KEY, "bindingKey");
+        properties.put(Property.TEMPORARY, false);
+        properties.put(Property.DURABLE, true);
+
+
+        configureAccessPlugin(Result.ALLOWED);
+        _securityManager.authoriseCreateBinding(binding);
+        verify(_accessControl).authorise(eq(Operation.BIND), eq(ObjectType.EXCHANGE), eq(properties));
+
+        configureAccessPlugin(Result.DENIED);
+        try
+        {
+            _securityManager.authoriseCreateBinding(binding);
+            fail("AccessControlException is expected");
+        }
+        catch(AccessControlException e)
+        {
+            // pass
+        }
+        verify(_accessControl, times(2)).authorise(eq(Operation.BIND), eq(ObjectType.EXCHANGE), eq(properties));
+    }
+
+
+    public void testAuthoriseMethod()
+    {
+        ObjectProperties properties = new ObjectProperties("testMethod");
+        properties.put(ObjectProperties.Property.COMPONENT, "testComponent");
+        properties.put(ObjectProperties.Property.VIRTUALHOST_NAME, TEST_VIRTUAL_HOST);
+
+         configureAccessPlugin(Result.ALLOWED);
+        _securityManager.authoriseMethod(Operation.UPDATE, "testComponent", "testMethod", TEST_VIRTUAL_HOST);
+        verify(_accessControl).authorise(eq(Operation.UPDATE), eq(ObjectType.METHOD), eq(properties));
+
+        configureAccessPlugin(Result.DENIED);
+        try
+        {
+            _securityManager.authoriseMethod(Operation.UPDATE, "testComponent", "testMethod", TEST_VIRTUAL_HOST);
+            fail("AccessControlException is expected");
+        }
+        catch(AccessControlException e)
+        {
+            // pass
+        }
+        verify(_accessControl, times(2)).authorise(eq(Operation.UPDATE), eq(ObjectType.METHOD), eq(properties));
+    }
+
+    public void testAccessManagement()
+    {
+         configureAccessPlugin(Result.ALLOWED);
+        _securityManager.accessManagement();
+        verify(_accessControl).authorise(Operation.ACCESS, ObjectType.MANAGEMENT, ObjectProperties.EMPTY);
+
+        configureAccessPlugin(Result.DENIED);
+        try
+        {
+            _securityManager.accessManagement();
+            fail("AccessControlException is expected");
+        }
+        catch(AccessControlException e)
+        {
+            // pass
+        }
+        verify(_accessControl, times(2)).authorise(Operation.ACCESS, ObjectType.MANAGEMENT, ObjectProperties.EMPTY);
+    }
+
+    public void testAuthoriseCreateConnection()
+    {
+        AMQConnectionModel<?,?> connection = mock(AMQConnectionModel.class);
+        when(connection.getVirtualHostName()).thenReturn(TEST_VIRTUAL_HOST);
+
+        ObjectProperties properties = new ObjectProperties();
+        properties.put(Property.NAME, TEST_VIRTUAL_HOST);
+        properties.put(Property.VIRTUALHOST_NAME, TEST_VIRTUAL_HOST);
+
+        configureAccessPlugin(Result.ALLOWED);
+        _securityManager.authoriseCreateConnection(connection);
+        verify(_accessControl).authorise(eq(Operation.ACCESS), eq(ObjectType.VIRTUALHOST), eq(properties));
+
+        configureAccessPlugin(Result.DENIED);
+        try
+        {
+            _securityManager.authoriseCreateConnection(connection);
+            fail("AccessControlException is expected");
+        }
+        catch(AccessControlException e)
+        {
+            // pass
+        }
+        verify(_accessControl, times(2)).authorise(eq(Operation.ACCESS), eq(ObjectType.VIRTUALHOST), eq(properties));
+    }
+
+    public void testAuthoriseCreateConsumer()
+    {
+        AMQQueue<?> queue = mock(AMQQueue.class);
+        when(queue.getParent(VirtualHost.class)).thenReturn(_virtualHost);
+        when(queue.getName()).thenReturn(TEST_QUEUE);
+        when(queue.isDurable()).thenReturn(true);
+        when(queue.getLifetimePolicy()).thenReturn(LifetimePolicy.PERMANENT);
+
+        ConsumerImpl consumer = mock(ConsumerImpl.class);
+        when(consumer.getMessageSource()).thenReturn(queue);
+
+        ObjectProperties properties = new ObjectProperties();
+        properties.put(Property.NAME, TEST_QUEUE);
+        properties.put(Property.VIRTUALHOST_NAME, TEST_VIRTUAL_HOST);
+        properties.put(Property.AUTO_DELETE, false);
+        properties.put(Property.TEMPORARY, false);
+        properties.put(Property.DURABLE, true);
+        properties.put(Property.EXCLUSIVE, false);
+
+        configureAccessPlugin(Result.ALLOWED);
+        _securityManager.authoriseCreateConsumer(consumer);
+        verify(_accessControl).authorise(eq(Operation.CONSUME), eq(ObjectType.QUEUE), eq(properties));
+
+        configureAccessPlugin(Result.DENIED);
+        try
+        {
+            _securityManager.authoriseCreateConsumer(consumer);
+            fail("AccessControlException is expected");
+        }
+        catch(AccessControlException e)
+        {
+            // pass
+        }
+        verify(_accessControl, times(2)).authorise(eq(Operation.CONSUME), eq(ObjectType.QUEUE), eq(properties));
+    }
+
+    public void testAuthoriseCreateExchange()
+    {
+        ExchangeImpl<?> exchange = mock(ExchangeImpl.class);
+        when(exchange.getParent(VirtualHost.class)).thenReturn(_virtualHost);
+        when(exchange.getName()).thenReturn(TEST_EXCHANGE);
+        when(exchange.getTypeName()).thenReturn(TEST_EXCHANGE_TYPE);
+
+        ObjectProperties properties = createExpectedExchangeObjectProperties();
+
+        configureAccessPlugin(Result.ALLOWED);
+        _securityManager.authoriseCreateExchange(exchange);
+        verify(_accessControl).authorise(eq(Operation.CREATE), eq(ObjectType.EXCHANGE), eq(properties));
+
+        configureAccessPlugin(Result.DENIED);
+        try
+        {
+            _securityManager.authoriseCreateExchange(exchange);
+            fail("AccessControlException is expected");
+        }
+        catch(AccessControlException e)
+        {
+            // pass
+        }
+        verify(_accessControl, times(2)).authorise(eq(Operation.CREATE), eq(ObjectType.EXCHANGE), eq(properties));
+    }
+
+    public void testAuthoriseCreateQueue()
+    {
+        AMQQueue<?> queue = mock(AMQQueue.class);
+        when(queue.getParent(VirtualHost.class)).thenReturn(_virtualHost);
+        when(queue.getName()).thenReturn(TEST_QUEUE);
+
+        ObjectProperties properties = createExpectedQueueObjectProperties();
+
+        configureAccessPlugin(Result.ALLOWED);
+        _securityManager.authoriseCreateQueue(queue);
+        verify(_accessControl).authorise(eq(Operation.CREATE), eq(ObjectType.QUEUE), eq(properties));
+
+        configureAccessPlugin(Result.DENIED);
+        try
+        {
+            _securityManager.authoriseCreateQueue(queue);
+            fail("AccessControlException is expected");
+        }
+        catch(AccessControlException e)
+        {
+            // pass
+        }
+        verify(_accessControl, times(2)).authorise(eq(Operation.CREATE), eq(ObjectType.QUEUE), eq(properties));
+    }
+
+    public void testAuthoriseDeleteQueue()
+    {
+        AMQQueue<?> queue = mock(AMQQueue.class);
+        when(queue.getParent(VirtualHost.class)).thenReturn(_virtualHost);
+        when(queue.getName()).thenReturn(TEST_QUEUE);
+
+        ObjectProperties properties = createExpectedQueueObjectProperties();
+
+        configureAccessPlugin(Result.ALLOWED);
+        _securityManager.authoriseDelete(queue);
+        verify(_accessControl).authorise(eq(Operation.DELETE), eq(ObjectType.QUEUE), eq(properties));
+
+        configureAccessPlugin(Result.DENIED);
+        try
+        {
+            _securityManager.authoriseDelete(queue);
+            fail("AccessControlException is expected");
+        }
+        catch(AccessControlException e)
+        {
+            // pass
+        }
+        verify(_accessControl, times(2)).authorise(eq(Operation.DELETE), eq(ObjectType.QUEUE), eq(properties));
+    }
+
+    public void testAuthoriseUpdateQueue()
+    {
+        AMQQueue<?> queue = mock(AMQQueue.class);
+        when(queue.getParent(VirtualHost.class)).thenReturn(_virtualHost);
+        when(queue.getName()).thenReturn(TEST_QUEUE);
+
+        ObjectProperties properties = createExpectedQueueObjectProperties();
+
+        configureAccessPlugin(Result.ALLOWED);
+        _securityManager.authoriseUpdate(queue);
+        verify(_accessControl).authorise(eq(Operation.UPDATE), eq(ObjectType.QUEUE), eq(properties));
+
+        configureAccessPlugin(Result.DENIED);
+        try
+        {
+            _securityManager.authoriseUpdate(queue);
+            fail("AccessControlException is expected");
+        }
+        catch(AccessControlException e)
+        {
+            // pass
+        }
+        verify(_accessControl, times(2)).authorise(eq(Operation.UPDATE), eq(ObjectType.QUEUE), eq(properties));
+    }
+
+    public void testAuthoriseUpdateExchange()
+    {
+        ExchangeImpl<?> exchange = mock(ExchangeImpl.class);
+        when(exchange.getParent(VirtualHost.class)).thenReturn(_virtualHost);
+        when(exchange.getName()).thenReturn(TEST_EXCHANGE);
+        when(exchange.getTypeName()).thenReturn(TEST_EXCHANGE_TYPE);
+
+        ObjectProperties properties = createExpectedExchangeObjectProperties();
+
+        configureAccessPlugin(Result.ALLOWED);
+        _securityManager.authoriseUpdate(exchange);
+        verify(_accessControl).authorise(eq(Operation.UPDATE), eq(ObjectType.EXCHANGE), eq(properties));
+
+        configureAccessPlugin(Result.DENIED);
+        try
+        {
+            _securityManager.authoriseUpdate(exchange);
+            fail("AccessControlException is expected");
+        }
+        catch(AccessControlException e)
+        {
+            // pass
+        }
+        verify(_accessControl, times(2)).authorise(eq(Operation.UPDATE), eq(ObjectType.EXCHANGE), eq(properties));
+    }
+
+    public void testAuthoriseDeleteExchange()
+    {
+        ExchangeImpl<?> exchange = mock(ExchangeImpl.class);
+        when(exchange.getParent(VirtualHost.class)).thenReturn(_virtualHost);
+        when(exchange.getName()).thenReturn(TEST_EXCHANGE);
+        when(exchange.getTypeName()).thenReturn(TEST_EXCHANGE_TYPE);
+
+        ObjectProperties properties = createExpectedExchangeObjectProperties();
+
+        configureAccessPlugin(Result.ALLOWED);
+        _securityManager.authoriseDelete(exchange);
+        verify(_accessControl).authorise(eq(Operation.DELETE), eq(ObjectType.EXCHANGE), eq(properties));
+
+        configureAccessPlugin(Result.DENIED);
+        try
+        {
+            _securityManager.authoriseDelete(exchange);
+            fail("AccessControlException is expected");
+        }
+        catch(AccessControlException e)
+        {
+            // pass
+        }
+        verify(_accessControl, times(2)).authorise(eq(Operation.DELETE), eq(ObjectType.EXCHANGE), eq(properties));
+    }
+
+    public void testAuthoriseGroupOperation()
+    {
+        ObjectProperties properties = new ObjectProperties("testGroup");
+
+         configureAccessPlugin(Result.ALLOWED);
+        _securityManager.authoriseGroupOperation(Operation.CREATE, "testGroup");
+        verify(_accessControl).authorise(eq(Operation.CREATE), eq(ObjectType.GROUP), eq(properties));
+
+        configureAccessPlugin(Result.DENIED);
+        try
+        {
+            _securityManager.authoriseGroupOperation(Operation.CREATE, "testGroup");
+            fail("AccessControlException is expected");
+        }
+        catch(AccessControlException e)
+        {
+            // pass
+        }
+        verify(_accessControl, times(2)).authorise(eq(Operation.CREATE), eq(ObjectType.GROUP), eq(properties));
+    }
+
+    public void testAuthoriseUserOperation()
+    {
+        ObjectProperties properties = new ObjectProperties("testUser");
+
+        configureAccessPlugin(Result.ALLOWED);
+       _securityManager.authoriseUserOperation(Operation.CREATE, "testUser");
+       verify(_accessControl).authorise(eq(Operation.CREATE), eq(ObjectType.USER), eq(properties));
+
+       configureAccessPlugin(Result.DENIED);
+       try
+       {
+           _securityManager.authoriseUserOperation(Operation.CREATE, "testUser");
+           fail("AccessControlException is expected");
+       }
+       catch(AccessControlException e)
+       {
+           // pass
+       }
+       verify(_accessControl, times(2)).authorise(eq(Operation.CREATE), eq(ObjectType.USER), eq(properties));
+    }
+
+    public void testAuthorisePublish()
+    {
+        String routingKey = "routingKey";
+        String exchangeName = "exchangeName";
+        boolean immediate = true;
+        ObjectProperties properties = new ObjectProperties(TEST_VIRTUAL_HOST, exchangeName, routingKey, immediate);
+
+        configureAccessPlugin(Result.ALLOWED);
+        _securityManager.authorisePublish(immediate, routingKey, exchangeName, TEST_VIRTUAL_HOST);
+        verify(_accessControl).authorise(eq(Operation.PUBLISH), eq(ObjectType.EXCHANGE), eq(properties));
+
+        configureAccessPlugin(Result.DENIED);
+        try
+        {
+            _securityManager.authorisePublish(immediate, routingKey, exchangeName, TEST_VIRTUAL_HOST);
+            fail("AccessControlException is expected");
+        }
+        catch(AccessControlException e)
+        {
+            // pass
+        }
+        verify(_accessControl, times(2)).authorise(eq(Operation.PUBLISH), eq(ObjectType.EXCHANGE), eq(properties));
+    }
+
+    public void testAuthorisePurge()
+    {
+        AMQQueue<?> queue = mock(AMQQueue.class);
+        when(queue.getParent(VirtualHost.class)).thenReturn(_virtualHost);
+        when(queue.getName()).thenReturn(TEST_QUEUE);
+
+        ObjectProperties properties = createExpectedQueueObjectProperties();
+
+        configureAccessPlugin(Result.ALLOWED);
+        _securityManager.authorisePurge(queue);
+        verify(_accessControl).authorise(eq(Operation.PURGE), eq(ObjectType.QUEUE), eq(properties));
+
+        configureAccessPlugin(Result.DENIED);
+        try
+        {
+            _securityManager.authorisePurge(queue);
+            fail("AccessControlException is expected");
+        }
+        catch(AccessControlException e)
+        {
+            // pass
+        }
+        verify(_accessControl, times(2)).authorise(eq(Operation.PURGE), eq(ObjectType.QUEUE), eq(properties));
+    }
+
+
+    public void testAuthoriseUnbind()
+    {
+        ExchangeImpl<?> exchange = mock(ExchangeImpl.class);
+        when(exchange.getParent(VirtualHost.class)).thenReturn(_virtualHost);
+        when(exchange.getName()).thenReturn(TEST_EXCHANGE);
+
+        AMQQueue<?> queue = mock(AMQQueue.class);
+        when(queue.getParent(VirtualHost.class)).thenReturn(_virtualHost);
+        when(queue.getName()).thenReturn(TEST_QUEUE);
+        when(queue.isDurable()).thenReturn(true);
+        when(queue.getLifetimePolicy()).thenReturn(LifetimePolicy.PERMANENT);
+
+        BindingImpl binding = mock(BindingImpl.class);
+        when(binding.getExchange()).thenReturn(exchange);
+        when(binding.getAMQQueue()).thenReturn(queue);
+        when(binding.getBindingKey()).thenReturn("bindingKey");
+
+        ObjectProperties properties = new ObjectProperties();
+        properties.put(Property.NAME, TEST_EXCHANGE);
+        properties.put(Property.VIRTUALHOST_NAME, TEST_VIRTUAL_HOST);
+        properties.put(Property.QUEUE_NAME, TEST_QUEUE);
+        properties.put(Property.ROUTING_KEY, "bindingKey");
+        properties.put(Property.TEMPORARY, false);
+        properties.put(Property.DURABLE, true);
+
+
+        configureAccessPlugin(Result.ALLOWED);
+        _securityManager.authoriseUnbind(binding);
+        verify(_accessControl).authorise(eq(Operation.UNBIND), eq(ObjectType.EXCHANGE), eq(properties));
+
+        configureAccessPlugin(Result.DENIED);
+        try
+        {
+            _securityManager.authoriseUnbind(binding);
+            fail("AccessControlException is expected");
+        }
+        catch(AccessControlException e)
+        {
+            // pass
+        }
+        verify(_accessControl, times(2)).authorise(eq(Operation.UNBIND), eq(ObjectType.EXCHANGE), eq(properties));
+    }
+
+    public void testAuthoriseConfiguringBroker()
+    {
+        OperationLoggingDetails properties = new OperationLoggingDetails("create virtualhost 'test'");
+
+        configureAccessPlugin(Result.ALLOWED);
+        assertTrue(_securityManager.authoriseConfiguringBroker("test", VirtualHost.class, Operation.CREATE));
+        verify(_accessControl).authorise(eq(Operation.CONFIGURE), eq(ObjectType.BROKER), eq(properties));
+
+        configureAccessPlugin(Result.DENIED);
+        assertFalse(_securityManager.authoriseConfiguringBroker("test", VirtualHost.class, Operation.CREATE));
+        verify(_accessControl, times(2)).authorise(eq(Operation.CONFIGURE), eq(ObjectType.BROKER), eq(properties));
+    }
+
+    public void testAuthoriseLogsAccess()
+    {
+        configureAccessPlugin(Result.ALLOWED);
+        assertTrue(_securityManager.authoriseLogsAccess());
+        verify(_accessControl).authorise(ACCESS_LOGS, BROKER, ObjectProperties.EMPTY);
+
+        configureAccessPlugin(Result.DENIED);
+        assertFalse(_securityManager.authoriseLogsAccess());
+        verify(_accessControl, times(2)).authorise(ACCESS_LOGS, BROKER, ObjectProperties.EMPTY);
+    }
+
+    private void configureAccessPlugin(Result result)
+    {
+        when(_accessControl.authorise(any(Operation.class), any(ObjectType.class), any(ObjectProperties.class))).thenReturn(result);
+    }
+
+    private ObjectProperties createExpectedExchangeObjectProperties()
+    {
+        ObjectProperties properties = new ObjectProperties();
+        properties.put(Property.NAME, TEST_EXCHANGE);
+        properties.put(Property.VIRTUALHOST_NAME, TEST_VIRTUAL_HOST);
+        properties.put(Property.AUTO_DELETE, false);
+        properties.put(Property.TEMPORARY, true);
+        properties.put(Property.DURABLE, false);
+        properties.put(Property.TYPE, TEST_EXCHANGE_TYPE);
+        return properties;
+    }
+
+    private ObjectProperties createExpectedQueueObjectProperties()
+    {
+        ObjectProperties properties = new ObjectProperties();
+        properties.put(Property.NAME, TEST_QUEUE);
+        properties.put(Property.VIRTUALHOST_NAME, TEST_VIRTUAL_HOST);
+        properties.put(Property.AUTO_DELETE, true);
+        properties.put(Property.TEMPORARY, true);
+        properties.put(Property.DURABLE, false);
+        properties.put(Property.EXCLUSIVE, false);
+        return properties;
+    }
+
+
+
+}
diff --git a/qpid/java/broker-core/src/test/java/org/apache/qpid/server/store/AbstractDurableConfigurationStoreTestCase.java b/qpid/java/broker-core/src/test/java/org/apache/qpid/server/store/AbstractDurableConfigurationStoreTestCase.java
index 650b22ff51..04c2f974c9 100644
--- a/qpid/java/broker-core/src/test/java/org/apache/qpid/server/store/AbstractDurableConfigurationStoreTestCase.java
+++ b/qpid/java/broker-core/src/test/java/org/apache/qpid/server/store/AbstractDurableConfigurationStoreTestCase.java
@@ -108,7 +108,6 @@ public abstract class AbstractDurableConfigurationStoreTestCase extends QpidTest
         _queueEntryRecoveryHandler = mock(TransactionLogRecoveryHandler.QueueEntryRecoveryHandler.class);
         _dtxRecordRecoveryHandler = mock(TransactionLogRecoveryHandler.DtxRecordRecoveryHandler.class);
         _virtualHost = mock(VirtualHost.class);
-        when(_virtualHost.getSecurityManager()).thenReturn(mock(org.apache.qpid.server.security.SecurityManager.class));
 
         when(_messageStoreRecoveryHandler.begin()).thenReturn(_storedMessageRecoveryHandler);
         when(_logRecoveryHandler.begin(any(MessageStore.class))).thenReturn(_queueEntryRecoveryHandler);
diff --git a/qpid/java/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/plugins/DefaultAccessControlTest.java b/qpid/java/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/plugins/DefaultAccessControlTest.java
index 74ea7639ff..72dadb736f 100644
--- a/qpid/java/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/plugins/DefaultAccessControlTest.java
+++ b/qpid/java/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/plugins/DefaultAccessControlTest.java
@@ -20,7 +20,9 @@
  */
 package org.apache.qpid.server.security.access.plugins;
 
-import static org.mockito.Mockito.*;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
 
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
@@ -182,7 +184,7 @@ public class DefaultAccessControlTest extends TestCase
         final RuleSet rs = new RuleSet(mock(EventLoggerProvider.class));
 
         // grant user4 access right on any method in any component
-        rs.grant(1, "user4", Permission.ALLOW, Operation.ACCESS, ObjectType.METHOD, new ObjectProperties(ObjectProperties.STAR));
+        rs.grant(1, "user4", Permission.ALLOW, Operation.ACCESS, ObjectType.METHOD, new ObjectProperties(ObjectProperties.WILD_CARD));
         configureAccessControl(rs);
         Subject.doAs(TestPrincipalUtils.createTestSubject("user4"), new PrivilegedAction<Object>()
         {
@@ -208,7 +210,7 @@ public class DefaultAccessControlTest extends TestCase
         final RuleSet rs = new RuleSet(mock(EventLoggerProvider.class));
 
         // grant user5 access right on any methods in "Test" component
-        ObjectProperties ruleProperties = new ObjectProperties(ObjectProperties.STAR);
+        ObjectProperties ruleProperties = new ObjectProperties(ObjectProperties.WILD_CARD);
         ruleProperties.put(ObjectProperties.Property.COMPONENT, "Test");
         rs.grant(1, "user5", Permission.ALLOW, Operation.ACCESS, ObjectType.METHOD, ruleProperties);
         configureAccessControl(rs);
@@ -235,6 +237,7 @@ public class DefaultAccessControlTest extends TestCase
     public void testAccess() throws Exception
     {
         final Subject subject = TestPrincipalUtils.createTestSubject("user1");
+        final String testVirtualHost = getName();
         final InetAddress inetAddress = InetAddress.getLocalHost();
         final InetSocketAddress inetSocketAddress = new InetSocketAddress(inetAddress, 1);
 
@@ -250,13 +253,12 @@ public class DefaultAccessControlTest extends TestCase
             {
                 RuleSet mockRuleSet = mock(RuleSet.class);
 
-
-
                 DefaultAccessControl accessControl = new DefaultAccessControl(mockRuleSet);
 
-                accessControl.authorise(Operation.ACCESS, ObjectType.VIRTUALHOST, ObjectProperties.EMPTY);
+                ObjectProperties properties = new ObjectProperties(testVirtualHost);
+                accessControl.authorise(Operation.ACCESS, ObjectType.VIRTUALHOST, properties);
 
-                verify(mockRuleSet).check(subject, Operation.ACCESS, ObjectType.VIRTUALHOST, ObjectProperties.EMPTY, inetAddress);
+                verify(mockRuleSet).check(subject, Operation.ACCESS, ObjectType.VIRTUALHOST, properties, inetAddress);
                 return null;
             }
         });
diff --git a/qpid/java/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/plugins/RuleSetTest.java b/qpid/java/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/plugins/RuleSetTest.java
index caf9b2fb61..32037807cd 100644
--- a/qpid/java/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/plugins/RuleSetTest.java
+++ b/qpid/java/broker-plugins/access-control/src/test/java/org/apache/qpid/server/security/access/plugins/RuleSetTest.java
@@ -21,24 +21,26 @@
 
 package org.apache.qpid.server.security.access.plugins;
 
-import java.security.Principal;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
 
 import javax.security.auth.Subject;
 
-import org.apache.qpid.server.logging.EventLogger;
+import org.apache.qpid.server.exchange.ExchangeImpl;
 import org.apache.qpid.server.logging.EventLoggerProvider;
+import org.apache.qpid.server.model.VirtualHost;
+import org.apache.qpid.server.queue.AMQQueue;
 import org.apache.qpid.server.security.Result;
 import org.apache.qpid.server.security.access.ObjectProperties;
 import org.apache.qpid.server.security.access.ObjectType;
 import org.apache.qpid.server.security.access.Operation;
 import org.apache.qpid.server.security.access.Permission;
+import org.apache.qpid.server.security.access.ObjectProperties.Property;
 import org.apache.qpid.server.security.access.config.Rule;
 import org.apache.qpid.server.security.access.config.RuleSet;
 import org.apache.qpid.server.security.auth.TestPrincipalUtils;
 import org.apache.qpid.test.utils.QpidTestCase;
 
-import static org.mockito.Mockito.mock;
-
 /**
  * This test checks that the {@link RuleSet} object which forms the core of the access control plugin performs correctly.
  *
@@ -51,6 +53,9 @@ import static org.mockito.Mockito.mock;
  */
 public class RuleSetTest extends QpidTestCase
 {
+    private static final String DENIED_VH = "deniedVH";
+    private static final String ALLOWED_VH = "allowedVH";
+
     private RuleSet _ruleSet; // Object under test
 
     private static final String TEST_USER = "user";
@@ -60,6 +65,8 @@ public class RuleSetTest extends QpidTestCase
     private String _exchangeName = "amq.direct";
     private String _exchangeType = "direct";
     private Subject _testSubject = TestPrincipalUtils.createTestSubject(TEST_USER);
+    private AMQQueue<?> _queue;
+    private VirtualHost<?> _virtualHost;
 
     @Override
     public void setUp() throws Exception
@@ -67,6 +74,11 @@ public class RuleSetTest extends QpidTestCase
         super.setUp();
 
         _ruleSet = new RuleSet(mock(EventLoggerProvider.class));
+
+        _virtualHost = mock(VirtualHost.class);
+        _queue = mock(AMQQueue.class);
+        when(_queue.getName()).thenReturn(_queueName);
+        when(_queue.getParent(VirtualHost.class)).thenReturn(_virtualHost);
     }
 
     @Override
@@ -83,10 +95,8 @@ public class RuleSetTest extends QpidTestCase
 
     public void assertDenyGrantAllow(Subject subject, Operation operation, ObjectType objectType, ObjectProperties properties)
     {
-        final Principal identity = subject.getPrincipals().iterator().next();
-
         assertEquals(Result.DENIED, _ruleSet.check(subject, operation, objectType, properties));
-        _ruleSet.grant(0, identity.getName(), Permission.ALLOW, operation, objectType, properties);
+        _ruleSet.grant(0, TEST_USER, Permission.ALLOW, operation, objectType, properties);
         assertEquals(1, _ruleSet.getRuleCount());
         assertEquals(Result.ALLOWED, _ruleSet.check(subject, operation, objectType, properties));
     }
@@ -98,17 +108,77 @@ public class RuleSetTest extends QpidTestCase
         assertEquals(_ruleSet.getDefault(), _ruleSet.check(_testSubject, Operation.ACCESS, ObjectType.VIRTUALHOST, ObjectProperties.EMPTY));
     }
 
-    public void testVirtualHostAccess() throws Exception
+    public void testVirtualHostAccessAllowPermissionWithVirtualHostName() throws Exception
     {
-        assertDenyGrantAllow(_testSubject, Operation.ACCESS, ObjectType.VIRTUALHOST);
+        _ruleSet.grant(0, TEST_USER, Permission.ALLOW, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(ALLOWED_VH));
+        assertEquals(Result.ALLOWED, _ruleSet.check(_testSubject, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(ALLOWED_VH)));
+        assertEquals(Result.DEFER, _ruleSet.check(_testSubject, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(DENIED_VH)));
     }
 
+    public void testVirtualHostAccessAllowPermissionWithNameSetToWildCard() throws Exception
+    {
+        _ruleSet.grant(0, TEST_USER, Permission.ALLOW, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(ObjectProperties.WILD_CARD));
+        assertEquals(Result.ALLOWED, _ruleSet.check(_testSubject, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(ALLOWED_VH)));
+        assertEquals(Result.ALLOWED, _ruleSet.check(_testSubject, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(DENIED_VH)));
+    }
+
+    public void testVirtualHostAccessAllowPermissionWithNoName() throws Exception
+    {
+        _ruleSet.grant(0, TEST_USER, Permission.ALLOW, Operation.ACCESS, ObjectType.VIRTUALHOST, ObjectProperties.EMPTY);
+        assertEquals(Result.ALLOWED, _ruleSet.check(_testSubject, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(ALLOWED_VH)));
+        assertEquals(Result.ALLOWED, _ruleSet.check(_testSubject, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(DENIED_VH)));
+    }
+
+    public void testVirtualHostAccessDenyPermissionWithNoName() throws Exception
+    {
+        _ruleSet.grant(0, TEST_USER, Permission.DENY, Operation.ACCESS, ObjectType.VIRTUALHOST, ObjectProperties.EMPTY);
+        assertEquals(Result.DENIED, _ruleSet.check(_testSubject, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(ALLOWED_VH)));
+        assertEquals(Result.DENIED, _ruleSet.check(_testSubject, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(DENIED_VH)));
+    }
+
+    public void testVirtualHostAccessDenyPermissionWithNameSetToWildCard() throws Exception
+    {
+        _ruleSet.grant(0, TEST_USER, Permission.DENY, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(ObjectProperties.WILD_CARD));
+        assertEquals(Result.DENIED, _ruleSet.check(_testSubject, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(ALLOWED_VH)));
+        assertEquals(Result.DENIED, _ruleSet.check(_testSubject, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(DENIED_VH)));
+    }
+
+    public void testVirtualHostAccessAllowDenyPermissions() throws Exception
+    {
+        _ruleSet.grant(0, TEST_USER, Permission.DENY, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(DENIED_VH));
+        _ruleSet.grant(1, TEST_USER, Permission.ALLOW, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(ALLOWED_VH));
+        assertEquals(Result.ALLOWED, _ruleSet.check(_testSubject, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(ALLOWED_VH)));
+        assertEquals(Result.DENIED, _ruleSet.check(_testSubject, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(DENIED_VH)));
+    }
+
+    public void testVirtualHostAccessAllowPermissionWithVirtualHostNameOtherPredicate() throws Exception
+    {
+        ObjectProperties properties = new ObjectProperties();
+        properties.put(Property.VIRTUALHOST_NAME, ALLOWED_VH);
+
+        _ruleSet.grant(0, TEST_USER, Permission.ALLOW, Operation.ACCESS, ObjectType.VIRTUALHOST, properties);
+        assertEquals(Result.ALLOWED, _ruleSet.check(_testSubject, Operation.ACCESS, ObjectType.VIRTUALHOST, properties));
+        assertEquals(Result.DEFER, _ruleSet.check(_testSubject, Operation.ACCESS, ObjectType.VIRTUALHOST, new ObjectProperties(DENIED_VH)));
+    }
+
+
     public void testQueueCreateNamed() throws Exception
     {
         assertDenyGrantAllow(_testSubject, Operation.CREATE, ObjectType.QUEUE, new ObjectProperties(_queueName));
     }
 
-    public void testQueueCreatenamedNullRoutingKey()
+    public void testQueueCreateNamedVirtualHost() throws Exception
+    {
+        _ruleSet.grant(0, TEST_USER, Permission.ALLOW, Operation.CREATE, ObjectType.QUEUE, new ObjectProperties(Property.VIRTUALHOST_NAME, ALLOWED_VH));
+
+        when(_virtualHost.getName()).thenReturn(ALLOWED_VH);
+        assertEquals(Result.ALLOWED, _ruleSet.check(_testSubject, Operation.CREATE, ObjectType.QUEUE, new ObjectProperties(_queue)));
+
+        when(_virtualHost.getName()).thenReturn(DENIED_VH);
+        assertEquals(Result.DEFER, _ruleSet.check(_testSubject, Operation.CREATE, ObjectType.QUEUE, new ObjectProperties(_queue)));
+    }
+
+    public void testQueueCreateNamedNullRoutingKey()
     {
         ObjectProperties properties = new ObjectProperties(_queueName);
         properties.put(ObjectProperties.Property.ROUTING_KEY, (String) null);
@@ -116,6 +186,21 @@ public class RuleSetTest extends QpidTestCase
         assertDenyGrantAllow(_testSubject, Operation.CREATE, ObjectType.QUEUE, properties);
     }
 
+    public void testExchangeCreateNamedVirtualHost()
+    {
+        _ruleSet.grant(0, TEST_USER, Permission.ALLOW, Operation.CREATE, ObjectType.EXCHANGE, new ObjectProperties(Property.VIRTUALHOST_NAME, ALLOWED_VH));
+
+        ExchangeImpl<?> exchange = mock(ExchangeImpl.class);
+        when(exchange.getParent(VirtualHost.class)).thenReturn(_virtualHost);
+        when(exchange.getTypeName()).thenReturn(_exchangeType);
+        when(_virtualHost.getName()).thenReturn(ALLOWED_VH);
+
+        assertEquals(Result.ALLOWED, _ruleSet.check(_testSubject, Operation.CREATE, ObjectType.EXCHANGE, new ObjectProperties(exchange)));
+
+        when(_virtualHost.getName()).thenReturn(DENIED_VH);
+        assertEquals(Result.DEFER, _ruleSet.check(_testSubject, Operation.CREATE, ObjectType.EXCHANGE, new ObjectProperties(exchange)));
+    }
+
     public void testExchangeCreate()
     {
         ObjectProperties properties = new ObjectProperties(_exchangeName);
diff --git a/qpid/java/broker-plugins/amqp-0-10-protocol/src/main/java/org/apache/qpid/server/protocol/v0_10/ServerSessionDelegate.java b/qpid/java/broker-plugins/amqp-0-10-protocol/src/main/java/org/apache/qpid/server/protocol/v0_10/ServerSessionDelegate.java
index 040be92ceb..999da2da6c 100644
--- a/qpid/java/broker-plugins/amqp-0-10-protocol/src/main/java/org/apache/qpid/server/protocol/v0_10/ServerSessionDelegate.java
+++ b/qpid/java/broker-plugins/amqp-0-10-protocol/src/main/java/org/apache/qpid/server/protocol/v0_10/ServerSessionDelegate.java
@@ -291,7 +291,7 @@ public class ServerSessionDelegate extends SessionDelegate
         final VirtualHost virtualHost = getVirtualHost(ssn);
         try
         {
-            virtualHost.getSecurityManager().authorisePublish(messageMetaData.isImmediate(), messageMetaData.getRoutingKey(), exchange.getName());
+            virtualHost.getSecurityManager().authorisePublish(messageMetaData.isImmediate(), messageMetaData.getRoutingKey(), exchange.getName(), virtualHost.getName());
         }
         catch (AccessControlException e)
         {
diff --git a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/AMQChannel.java b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/AMQChannel.java
index baf5eceef7..7bde83cc99 100644
--- a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/AMQChannel.java
+++ b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/AMQChannel.java
@@ -303,9 +303,10 @@ public class AMQChannel<T extends AMQProtocolSession<T>>
     public void setPublishFrame(MessagePublishInfo info, final MessageDestination e)
     {
         String routingKey = info.getRoutingKey() == null ? null : info.getRoutingKey().asString();
-        SecurityManager securityManager = getVirtualHost().getSecurityManager();
+        VirtualHost virtualHost = getVirtualHost();
+        SecurityManager securityManager = virtualHost.getSecurityManager();
 
-        securityManager.authorisePublish(info.isImmediate(), routingKey, e.getName());
+        securityManager.authorisePublish(info.isImmediate(), routingKey, e.getName(), virtualHost.getName());
 
         _currentMessage = new IncomingMessage(info);
         _currentMessage.setMessageDestination(e);
diff --git a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/ConnectionOpenMethodHandler.java b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/ConnectionOpenMethodHandler.java
index a29d56605a..1a29806f62 100644
--- a/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/ConnectionOpenMethodHandler.java
+++ b/qpid/java/broker-plugins/amqp-0-8-protocol/src/main/java/org/apache/qpid/server/protocol/v0_8/handler/ConnectionOpenMethodHandler.java
@@ -80,6 +80,8 @@ public class ConnectionOpenMethodHandler implements StateAwareMethodListener<Con
         }
         else
         {
+            session.setVirtualHost(virtualHost);
+
             // Check virtualhost access
             try
             {
@@ -95,7 +97,6 @@ public class ConnectionOpenMethodHandler implements StateAwareMethodListener<Con
                 throw body.getConnectionException(AMQConstant.CONNECTION_FORCED, "Virtual host '" + virtualHost.getName() + "' is not active");
             }
 
-            session.setVirtualHost(virtualHost);
 
             // See Spec (0.8.2). Section  3.1.2 Virtual Hosts
             if (session.getContextKey() == null)
diff --git a/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/MessageServlet.java b/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/MessageServlet.java
index 0947ae2a89..b23f0cb168 100644
--- a/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/MessageServlet.java
+++ b/qpid/java/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/servlet/rest/MessageServlet.java
@@ -485,10 +485,10 @@ public class MessageServlet extends AbstractServlet
 
     }
 
-    private void authorizeMethod(String methodName, VirtualHost host)
+    private void authorizeMethod(String methodName, VirtualHost<?> vhost)
     {
-        SecurityManager securityManager = host.getSecurityManager();
-        securityManager.authoriseMethod(Operation.UPDATE, "VirtualHost.Queue", methodName);
+        SecurityManager securityManager = getBroker().getSecurityManager();
+        securityManager.authoriseMethod(Operation.UPDATE, "VirtualHost.Queue", methodName, vhost.getName());
     }
 
 }
diff --git a/qpid/java/broker-plugins/management-jmx/src/main/java/org/apache/qpid/server/jmx/MBeanInvocationHandlerImpl.java b/qpid/java/broker-plugins/management-jmx/src/main/java/org/apache/qpid/server/jmx/MBeanInvocationHandlerImpl.java
index 7b0a48cac1..5a7674d4fd 100644
--- a/qpid/java/broker-plugins/management-jmx/src/main/java/org/apache/qpid/server/jmx/MBeanInvocationHandlerImpl.java
+++ b/qpid/java/broker-plugins/management-jmx/src/main/java/org/apache/qpid/server/jmx/MBeanInvocationHandlerImpl.java
@@ -60,15 +60,15 @@ public class MBeanInvocationHandlerImpl implements InvocationHandler
     private MBeanServer _mbs;
 
     private final boolean _managementRightsInferAllAccess;
-    private final Broker _broker;
+    private final Broker<?> _broker;
 
-    MBeanInvocationHandlerImpl(Broker broker)
+    MBeanInvocationHandlerImpl(Broker<?> broker)
     {
         _managementRightsInferAllAccess = Boolean.valueOf(System.getProperty(BrokerProperties.PROPERTY_MANAGEMENT_RIGHTS_INFER_ALL_ACCESS, "true"));
         _broker = broker;
     }
 
-    public static MBeanServerForwarder newProxyInstance(Broker broker)
+    public static MBeanServerForwarder newProxyInstance(Broker<?> broker)
     {
         final InvocationHandler handler = new MBeanInvocationHandlerImpl(broker);
         final Class<?>[] interfaces = new Class[] { MBeanServerForwarder.class };
@@ -195,28 +195,23 @@ public class MBeanInvocationHandlerImpl implements InvocationHandler
         String methodName;
         // Get the component, type and impact, which may be null
         String type = getType(method, args);
-        String vhost = getVirtualHost(method, args);
+        String virtualHostName = getVirtualHost(method, args);
         int impact = getImpact(method, args);
 
-        // Get the security manager for the virtual host (if set)
-        SecurityManager security;
-        if (vhost == null)
+        if (virtualHostName != null)
         {
-            security = _broker.getSecurityManager();
-        }
-        else
-        {
-            VirtualHost virtualHost = _broker.findVirtualHostByName(vhost);
+            VirtualHost<?> virtualHost = _broker.findVirtualHostByName(virtualHostName);
             if (virtualHost == null)
             {
-                throw new IllegalArgumentException("Virtual host with name '" + vhost + "' is not found.");
+                throw new IllegalArgumentException("Virtual host with name '" + virtualHostName + "' is not found.");
             }
-            security = virtualHost.getSecurityManager();
         }
 
         methodName = getMethodName(method, args);
         Operation operation = (isAccessMethod(methodName) || impact == MBeanOperationInfo.INFO) ? Operation.ACCESS : Operation.UPDATE;
-        security.authoriseMethod(operation, type, methodName);
+
+        SecurityManager security = _broker.getSecurityManager();
+        security.authoriseMethod(operation, type, methodName, virtualHostName);
 
         if (_managementRightsInferAllAccess)
         {
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/server/logging/AccessControlLoggingTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/server/logging/AccessControlLoggingTest.java
index 37f960a65a..a0188626ee 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/server/logging/AccessControlLoggingTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/server/logging/AccessControlLoggingTest.java
@@ -49,8 +49,7 @@ public class AccessControlLoggingTest extends AbstractTestLogging
     public void setUp() throws Exception
     {
         // Write out ACL for this test
-        AbstractACLTestCase.writeACLFileUtil(this, "test",
-                "ACL ALLOW client ACCESS VIRTUALHOST",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW client ACCESS VIRTUALHOST",
                 "ACL ALLOW client CREATE QUEUE name='allow'",
                 "ACL ALLOW-LOG client CREATE QUEUE name='allow-log'",
                 "ACL DENY client CREATE QUEUE name='deny'",
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/AbstractACLTestCase.java b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/AbstractACLTestCase.java
index 7a3edd316f..461670dc1e 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/AbstractACLTestCase.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/AbstractACLTestCase.java
@@ -26,7 +26,6 @@ import org.apache.qpid.client.AMQConnection;
 import org.apache.qpid.client.AMQConnectionURL;
 import org.apache.qpid.jms.ConnectionListener;
 import org.apache.qpid.protocol.AMQConstant;
-import org.apache.qpid.server.model.Broker;
 import org.apache.qpid.test.utils.QpidBrokerTestCase;
 import org.apache.qpid.url.URLSyntaxException;
 
@@ -45,12 +44,10 @@ import java.util.concurrent.TimeUnit;
 
 /**
  * Abstract test case for ACLs.
- * 
+ *
  * This base class contains convenience methods to manage ACL files and implements a mechanism that allows each
  * test method to run its own setup code before the broker starts.
- * 
- * TODO move the pre broker-startup setup method invocation code to {@link QpidBrokerTestCase}
- * 
+ *
  * @see ExternalACLTest
  * @see ExternalACLJMXTest
  * @see ExhaustiveACLTest
@@ -80,7 +77,7 @@ public abstract class AbstractACLTestCase extends QpidBrokerTestCase implements
         {
             throw (Exception) e.getTargetException();
         }
-        
+
         super.setUp();
     }
 
@@ -97,25 +94,18 @@ public abstract class AbstractACLTestCase extends QpidBrokerTestCase implements
             //that we provoked with authentication failures, where the test passes - we can ignore on con close
         }
     }
-    
-    public void writeACLFile(final String vhost, final String...rules) throws ConfigurationException, IOException
+
+    public void writeACLFile(final String...rules) throws ConfigurationException, IOException
     {
-        writeACLFileUtil(this, vhost, rules);
+        writeACLFileUtil(this, rules);
     }
 
-    public static void writeACLFileUtil(QpidBrokerTestCase testcase, String vhost, String...rules) throws ConfigurationException, IOException
+    public static void writeACLFileUtil(QpidBrokerTestCase testcase, String...rules) throws ConfigurationException, IOException
     {
         File aclFile = File.createTempFile(testcase.getClass().getSimpleName(), testcase.getName());
         aclFile.deleteOnExit();
 
-        if (vhost == null)
-        {
-            testcase.getBrokerConfiguration().addAclFileConfiguration(aclFile.getAbsolutePath());
-        }
-        else
-        {
-            testcase.setVirtualHostConfigurationProperty("virtualhosts.virtualhost." + vhost + ".security.acl", aclFile.getAbsolutePath());
-        }
+        testcase.getBrokerConfiguration().addAclFileConfiguration(aclFile.getAbsolutePath());
 
         PrintWriter out = new PrintWriter(new FileWriter(aclFile));
         out.println(String.format("# %s", testcase.getName()));
@@ -127,7 +117,7 @@ public abstract class AbstractACLTestCase extends QpidBrokerTestCase implements
     }
 
     /**
-     * Creates a connection to the broker, and sets a connection listener to prevent failover and an exception listener 
+     * Creates a connection to the broker, and sets a connection listener to prevent failover and an exception listener
      * with a {@link CountDownLatch} to synchronise in the {@link #check403Exception(Throwable)} method and allow the
      * {@link #tearDown()} method to complete properly.
      */
@@ -137,8 +127,8 @@ public abstract class AbstractACLTestCase extends QpidBrokerTestCase implements
 
         //Prevent Failover
         connection.setConnectionListener(this);
-        
-        //QPID-2081: use a latch to sync on exception causing connection close, to work 
+
+        //QPID-2081: use a latch to sync on exception causing connection close, to work
         //around the connection close race during tearDown() causing sporadic failures
         _exceptionReceived = new CountDownLatch(1);
 
@@ -195,8 +185,8 @@ public abstract class AbstractACLTestCase extends QpidBrokerTestCase implements
         assertNotNull("There was no linked exception", t);
         assertTrue("Wrong linked exception type : " + t.getClass(), t instanceof AMQException);
         assertEquals("Incorrect error code received", 403, ((AMQException) t).getErrorCode().getCode());
-    
-        //use the latch to ensure the control thread waits long enough for the exception thread 
+
+        //use the latch to ensure the control thread waits long enough for the exception thread
         //to have done enough to mark the connection closed before teardown commences
         assertTrue("Timed out waiting for conneciton to report close", _exceptionReceived.await(2, TimeUnit.SECONDS));
     }
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExhaustiveACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExhaustiveACLTest.java
index 50c80692dd..07fe88b38f 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExhaustiveACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExhaustiveACLTest.java
@@ -39,20 +39,20 @@ public class ExhaustiveACLTest extends AbstractACLTestCase
 
     /**
      * Creates a queue.
-     * 
+     *
      * Connects to the broker as a particular user and create the named queue on a virtual host, with the provided
      * parameters. Uses a new {@link Connection} and {@link Session} and closes them afterwards.
      */
 	private void createQueue(String vhost, String user, String name, boolean autoDelete, boolean durable) throws Exception
 	{
-		Connection conn = getConnection(vhost, user, "guest");	
+		Connection conn = getConnection(vhost, user, "guest");
 		Session sess = conn.createSession(true, Session.SESSION_TRANSACTED);
 		conn.start();
 		((AMQSession<?, ?>) sess).createQueue(new AMQShortString(name), autoDelete, durable, false);
 		sess.commit();
 		conn.close();
 	}
-	
+
 	/**
 	 * Calls {@link #createQueue(String, String, String, boolean, boolean)} with the provided parameters and checks that
 	 * no exceptions were thrown.
@@ -61,7 +61,7 @@ public class ExhaustiveACLTest extends AbstractACLTestCase
 	{
 		try
 		{
-			createQueue(vhost, user, name, autoDelete, durable);			
+			createQueue(vhost, user, name, autoDelete, durable);
 		}
 		catch (AMQException e)
 		{
@@ -72,7 +72,7 @@ public class ExhaustiveACLTest extends AbstractACLTestCase
 
 	/**
 	 * Calls {@link #createQueue(String, String, String, boolean, boolean)} with the provided parameters and checks that
-	 * the exception thrown was an {@link AMQConstant#ACCESS_REFUSED} or 403 error code. 
+	 * the exception thrown was an {@link AMQConstant#ACCESS_REFUSED} or 403 error code.
 	 */
 	private void createQueueFailure(String vhost, String user, String name, boolean autoDelete, boolean durable) throws Exception
 	{
@@ -87,67 +87,64 @@ public class ExhaustiveACLTest extends AbstractACLTestCase
 			assertEquals("Should be an ACCESS_REFUSED error", 403, e.getErrorCode().getCode());
 		}
 	}
-	
+
     public void setUpAuthoriseCreateQueueAutodelete() throws Exception
     {
-        writeACLFile("test",
-					 "acl allow client access virtualhost",
+        writeACLFile("acl allow client access virtualhost",
 					 "acl allow server access virtualhost",
 					 "acl allow client create queue name=\"temp.true.*\" autodelete=true",
 					 "acl allow client create queue name=\"temp.false.*\" autodelete=false",
-					 "acl deny client create queue",	
-					 "acl allow client delete queue",				 
+					 "acl deny client create queue",
+					 "acl allow client delete queue",
 					 "acl deny all create queue"
             );
     }
-    
+
     /**
      * Test creation of temporary queues, with the autodelete property set to true.
      */
     public void testAuthoriseCreateQueueAutodelete() throws Exception
 	{
-		createQueueSuccess("test", "client", "temp.true.00", true, false); 
+		createQueueSuccess("test", "client", "temp.true.00", true, false);
 		createQueueSuccess("test", "client", "temp.true.01", true, false);
 		createQueueSuccess("test", "client", "temp.true.02", true, true);
-		createQueueSuccess("test", "client", "temp.false.03", false, false); 
+		createQueueSuccess("test", "client", "temp.false.03", false, false);
 		createQueueSuccess("test", "client", "temp.false.04", false, false);
 		createQueueSuccess("test", "client", "temp.false.05", false, true);
-		createQueueFailure("test", "client", "temp.true.06", false, false); 
+		createQueueFailure("test", "client", "temp.true.06", false, false);
 		createQueueFailure("test", "client", "temp.false.07", true, false);
-		createQueueFailure("test", "server", "temp.true.08", true, false); 
+		createQueueFailure("test", "server", "temp.true.08", true, false);
 		createQueueFailure("test", "client", "temp.other.09", false, false);
     }
-	
+
     public void setUpAuthoriseCreateQueue() throws Exception
     {
-        writeACLFile("test",
-                     "acl allow client access virtualhost",
+        writeACLFile("acl allow client access virtualhost",
                      "acl allow server access virtualhost",
                      "acl allow client create queue name=\"create.*\""
             );
     }
-    
+
     /**
      * Tests creation of named queues.
      *
-     * If a named queue is specified 
+     * If a named queue is specified
      */
     public void testAuthoriseCreateQueue() throws Exception
     {
         createQueueSuccess("test", "client", "create.00", true, true);
         createQueueSuccess("test", "client", "create.01", true, false);
         createQueueSuccess("test", "client", "create.02", false, true);
-        createQueueSuccess("test", "client", "create.03", true, false); 
+        createQueueSuccess("test", "client", "create.03", true, false);
         createQueueFailure("test", "server", "create.04", true, true);
         createQueueFailure("test", "server", "create.05", true, false);
         createQueueFailure("test", "server", "create.06", false, true);
-        createQueueFailure("test", "server", "create.07", true, false); 
+        createQueueFailure("test", "server", "create.07", true, false);
     }
-	
+
     public void setUpAuthoriseCreateQueueBoth() throws Exception
     {
-        writeACLFile("test",
-                     "acl allow all access virtualhost",
+        writeACLFile("acl allow all access virtualhost",
                      "acl allow client create queue name=\"create.*\"",
                      "acl allow all create queue temporary=true"
             );
@@ -156,16 +153,16 @@ public class ExhaustiveACLTest extends AbstractACLTestCase
     /**
      * Tests creation of named queues.
      *
-     * If a named queue is specified 
+     * If a named queue is specified
      */
     public void testAuthoriseCreateQueueBoth() throws Exception
     {
         createQueueSuccess("test", "client", "create.00", true, false);
         createQueueSuccess("test", "client", "create.01", false, false);
         createQueueFailure("test", "server", "create.02", false, false);
-        createQueueFailure("test", "guest", "create.03", false, false); 
+        createQueueFailure("test", "guest", "create.03", false, false);
         createQueueSuccess("test", "client", "tmp.00", true, false);
-        createQueueSuccess("test", "server", "tmp.01", true, false); 
+        createQueueSuccess("test", "server", "tmp.01", true, false);
         createQueueSuccess("test", "guest", "tmp.02", true, false);
     }
 }
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExternalACLJMXTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExternalACLJMXTest.java
index 389ac5ff4d..7a1a6cd639 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExternalACLJMXTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExternalACLJMXTest.java
@@ -56,7 +56,7 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
         super.setUp();
         _jmx.open();
     }
-    
+
     @Override
     public void tearDown() throws Exception
     {
@@ -66,9 +66,8 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
 
     public void setUpDenyAllIsCatchAllRule() throws Exception
     {
-        writeACLFile(null,
-                "ACL ALLOW admin ACCESS MANAGEMENT",
-                "#No more rules, default catch all (deny all) should apply");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "#No more rules, default catch all (deny all) should apply");
     }
 
     public void testDenyAllIsCatchAllRule() throws Exception
@@ -107,7 +106,7 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
      */
     public void setUpAllowAll() throws Exception
     {
-        writeACLFile(null, "ACL ALLOW ALL ALL");
+        writeACLFile("ACL ALLOW ALL ALL");
     }
 
     public void testAllowAll() throws Exception
@@ -118,24 +117,17 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
         // PASS
     }
 
-    /**
-     * admin user is denied at broker level but allowed at vhost level.
-     */
-    public void setUpVhostAllowOverridesGlobalDeny() throws Exception
+    public void setUpVhostWithName() throws Exception
     {
-        writeACLFile(null,
-                "ACL ALLOW admin ACCESS MANAGEMENT",
-                "ACL DENY admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue'");
-        writeACLFile(TEST_VHOST,
-                "ACL ALLOW admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue'");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL ALLOW admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue' virtualhost_name='"+ TEST_VHOST + "'",
+                     "ACL DENY  admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue' virtualhost_name='"+ TEST2_VHOST + "'");
     }
 
-    public void testVhostAllowOverridesGlobalDeny() throws Exception
+    public void testVhostWithName() throws Exception
     {
-        //try a vhost-level method on the allowed vhost
         _jmx.createQueue(TEST_VHOST, getTestQueueName(), TEST_QUEUE_OWNER, true);
 
-        //try a vhost-level method on a different vhost
         try
         {
             _jmx.createQueue(TEST2_VHOST, getTestQueueName(), TEST_QUEUE_OWNER, true);
@@ -153,9 +145,8 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
      */
     public void setUpUpdateComponentOnlyAllow() throws Exception
     {
-        writeACLFile(null,
-                "ACL ALLOW admin ACCESS MANAGEMENT",
-                "ACL ALLOW admin UPDATE METHOD component='VirtualHost.VirtualHostManager'");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL ALLOW admin UPDATE METHOD component='VirtualHost.VirtualHostManager'");
     }
 
     public void testUpdateComponentOnlyAllow() throws Exception
@@ -172,9 +163,8 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
      */
     public void setUpUpdateMethodOnlyAllow() throws Exception
     {
-        writeACLFile(null,
-                "ACL ALLOW admin ACCESS MANAGEMENT",
-                "ACL ALLOW admin UPDATE METHOD");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL ALLOW admin UPDATE METHOD");
     }
 
     public void testUpdateMethodOnlyAllow() throws Exception
@@ -187,12 +177,12 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
 
 
     /**
-     * admin user has JMX right, AMPQ right is irrelevant.
+     * admin user has JMX right, AMQP right is irrelevant.
      */
     public void setUpCreateQueueSuccess() throws Exception
     {
-        writeACLFile(null, "ACL ALLOW admin ACCESS MANAGEMENT");
-        writeACLFile(TEST_VHOST, "ACL ALLOW admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue'");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL ALLOW admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue'");
     }
 
     public void testCreateQueueSuccess() throws Exception
@@ -202,14 +192,13 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
 
 
     /**
-     * admin user has JMX right, verifies lack of AMPQ rights is irrelevant.
+     * admin user has JMX right, verifies lack of AMQP rights is irrelevant.
      */
     public void setUpCreateQueueSuccessNoAMQPRights() throws Exception
     {
-        writeACLFile(null, "ACL ALLOW admin ACCESS MANAGEMENT");
-        writeACLFile(TEST_VHOST,
-                "ACL ALLOW admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue'",
-                "ACL DENY admin CREATE QUEUE");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL ALLOW admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue'",
+                     "ACL DENY admin CREATE QUEUE");
     }
 
     public void testCreateQueueSuccessNoAMQPRights() throws Exception
@@ -219,13 +208,12 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
 
 
     /**
-     * admin user does not have JMX right, AMPQ right is irrelevant.
+     * admin user does not have JMX right, AMQP right is irrelevant.
      */
     public void setUpCreateQueueDenied() throws Exception
     {
-        writeACLFile(null, "ACL ALLOW admin ACCESS MANAGEMENT");
-        writeACLFile(TEST_VHOST,
-                "ACL DENY admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue'");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL DENY admin UPDATE METHOD component='VirtualHost.VirtualHostManager' name='createNewQueue'");
     }
 
     public void testCreateQueueDenied() throws Exception
@@ -247,9 +235,8 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
      */
     public void setUpServerInformationUpdateDenied() throws Exception
     {
-        writeACLFile(null,
-                "ACL ALLOW admin ACCESS MANAGEMENT",
-                "ACL DENY admin UPDATE METHOD component='ServerInformation' name='resetStatistics'");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL DENY admin UPDATE METHOD component='ServerInformation' name='resetStatistics'");
     }
 
     public void testServerInformationUpdateDenied() throws Exception
@@ -272,9 +259,8 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
      */
     public void setUpServerInformationAccessGranted() throws Exception
     {
-        writeACLFile(null,
-        "ACL ALLOW admin ACCESS MANAGEMENT",
-        "ACL ALLOW-LOG admin ACCESS METHOD component='ServerInformation' name='getManagementApiMajorVersion'");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL ALLOW-LOG admin ACCESS METHOD component='ServerInformation' name='getManagementApiMajorVersion'");
     }
 
     public void testServerInformationAccessGranted() throws Exception
@@ -299,9 +285,8 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
      */
     public void setUpServerInformationUpdateMethodPermission() throws Exception
     {
-        writeACLFile(null,
-                "ACL ALLOW admin ACCESS MANAGEMENT",
-                "ACL ALLOW admin UPDATE METHOD component='ServerInformation' name='resetStatistics'");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL ALLOW admin UPDATE METHOD component='ServerInformation' name='resetStatistics'");
     }
 
     public void testServerInformationUpdateMethodPermission() throws Exception
@@ -317,9 +302,8 @@ public class ExternalACLJMXTest extends AbstractACLTestCase
      */
     public void setUpServerInformationAllMethodPermissions() throws Exception
     {
-        writeACLFile(null,
-                "ACL ALLOW admin ACCESS MANAGEMENT",
-                "ACL ALLOW admin ALL METHOD component='ServerInformation'");
+        writeACLFile("ACL ALLOW admin ACCESS MANAGEMENT",
+                     "ACL ALLOW admin ALL METHOD component='ServerInformation'");
     }
 
     public void testServerInformationAllMethodPermissions() throws Exception
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExternalACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExternalACLTest.java
index 00c85e80c8..0e8f3cb7d8 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExternalACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/server/security/acl/ExternalACLTest.java
@@ -18,12 +18,6 @@
  */
 package org.apache.qpid.server.security.acl;
 
-import org.apache.qpid.AMQException;
-import org.apache.qpid.client.AMQDestination;
-import org.apache.qpid.client.AMQSession;
-import org.apache.qpid.protocol.AMQConstant;
-import org.apache.qpid.url.URLSyntaxException;
-
 import javax.jms.Connection;
 import javax.jms.Destination;
 import javax.jms.JMSException;
@@ -37,8 +31,14 @@ import javax.jms.Topic;
 import javax.jms.TopicSubscriber;
 import javax.naming.NamingException;
 
+import org.apache.qpid.AMQException;
+import org.apache.qpid.client.AMQDestination;
+import org.apache.qpid.client.AMQSession;
+import org.apache.qpid.protocol.AMQConstant;
+import org.apache.qpid.url.URLSyntaxException;
+
 /**
- * Tests the V2 ACLs.  The tests perform basic AMQP operations like creating queues or excahnges and publishing and consuming messages, using
+ * Tests the V2 ACLs.  The tests perform basic AMQP operations like creating queues or exchanges and publishing and consuming messages, using
  * JMS to contact the broker.
  */
 public class ExternalACLTest extends AbstractACLTestCase
@@ -46,65 +46,113 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpAccessAuthorizedSuccess() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST");
     }
 
     public void testAccessAuthorizedSuccess() throws Exception
     {
+        Connection conn = getConnection("test", "client", "guest");
+        conn.close();
+    }
+
+    public void setUpAccessNoRightsFailure() throws Exception
+    {
+        writeACLFile("ACL DENY-LOG client ACCESS VIRTUALHOST");
+    }
+
+    public void testAccessNoRightsFailure() throws Exception
+    {
         try
         {
-            Connection conn = getConnection("test", "client", "guest");
-            Session sess = conn.createSession(true, Session.SESSION_TRANSACTED);
-            conn.start();
+            getConnection("test", "client", "guest");
+            fail("Connection was created.");
+        }
+        catch (JMSException e)
+        {
+            assertAccessDeniedException(e);
+        }
+    }
 
-            //Do something to show connection is active.
-            sess.rollback();
+    private void assertAccessDeniedException(JMSException e)
+    {
+        assertEquals("Unexpected exception message", "Error creating connection: Permission denied: test", e.getMessage());
+
+        // JMSException -> linkedException -> cause = AMQException (403 or 320)
+        Exception linkedException = e.getLinkedException();
+        assertNotNull("There was no linked exception", linkedException);
+        Throwable cause = linkedException.getCause();
+        assertNotNull("Cause was null", cause);
+        assertTrue("Wrong linked exception type", cause instanceof AMQException);
+        AMQConstant errorCode = isBroker010() ? AMQConstant.CONNECTION_FORCED : AMQConstant.ACCESS_REFUSED;
+        assertEquals("Incorrect error code received", errorCode, ((AMQException) cause).getErrorCode());
+    }
+
+    public void setUpAccessVirtualHostWithName() throws Exception
+    {
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST name='test'", "ACL DENY-LOG guest ACCESS VIRTUALHOST name='test'",
+                           "ACL ALLOW-LOG server ACCESS VIRTUALHOST name='*'");
+    }
 
-            conn.close();
+    public void testAccessVirtualHostWithName() throws Exception
+    {
+        Connection conn = getConnection("test", "client", "guest");
+        conn.close();
+
+        try
+        {
+            getConnection("test", "guest", "guest");
+            fail("Access should be denied");
         }
-        catch (Exception e)
+        catch (JMSException e)
         {
-            fail("Connection was not created due to:" + e);
+            assertAccessDeniedException(e);
         }
+
+        Connection conn2 = getConnection("test", "server", "guest");
+        conn2.close();
     }
 
-    public void setUpAccessNoRightsFailure() throws Exception
+    public void setUpClientCreateVirtualHostQueue() throws Exception
     {
-        writeACLFile("test", "ACL DENY-LOG client ACCESS VIRTUALHOST");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client CREATE QUEUE virtualhost_name='test'",
+                     "ACL ALLOW-LOG client CONSUME QUEUE",
+                     "ACL ALLOW-LOG client BIND EXCHANGE",
+                     "ACL ALLOW-LOG guest ACCESS VIRTUALHOST",
+                     "ACL DENY-LOG  guest CREATE QUEUE virtualhost_name='test'");
     }
 
-    public void testAccessNoRightsFailure() throws Exception
+    public void testClientCreateVirtualHostQueue() throws NamingException, JMSException, AMQException, Exception
     {
+        Connection conn = getConnection("test", "client", "guest");
+        Session sess = conn.createSession(false, Session.AUTO_ACKNOWLEDGE);
+        Destination dest = sess.createQueue(getTestQueueName());
+        sess.createConsumer(dest);
+        conn.close();
+
         try
         {
-            Connection conn = getConnection("test", "guest", "guest");
-            Session sess = conn.createSession(true, Session.SESSION_TRANSACTED);
-            conn.start();
-            sess.rollback();
+            conn = getConnection("test", "guest", "guest");
+            sess = conn.createSession(false, Session.AUTO_ACKNOWLEDGE);
+            sess.createConsumer(dest);
 
-            fail("Connection was created.");
+            fail("Queue creation for user 'guest' is denied");
         }
         catch (JMSException e)
         {
-            // JMSException -> linkedException -> cause = AMQException (403 or 320)
-            Exception linkedException = e.getLinkedException();
-            assertNotNull("There was no linked exception", linkedException);
-            Throwable cause = linkedException.getCause();
-            assertNotNull("Cause was null", cause);
-            assertTrue("Wrong linked exception type", cause instanceof AMQException);
-            AMQConstant errorCode = isBroker010() ? AMQConstant.CONNECTION_FORCED : AMQConstant.ACCESS_REFUSED;
-            assertEquals("Incorrect error code received", errorCode, ((AMQException) cause).getErrorCode());
+            check403Exception(e.getLinkedException());
         }
     }
 
+
     public void setUpClientDeleteQueueSuccess() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                             "ACL ALLOW-LOG client CREATE QUEUE durable=\"true\"" ,
-                             "ACL ALLOW-LOG client CONSUME QUEUE name=\"clientid:kipper\"",
-                             "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.topic\" durable=true routingKey=kipper",
-                             "ACL ALLOW-LOG client DELETE QUEUE durable=\"true\"",
-                             "ACL ALLOW-LOG client UNBIND EXCHANGE name=\"amq.topic\" durable=true routingKey=kipper");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client CREATE QUEUE durable=\"true\"",
+                     "ACL ALLOW-LOG client CONSUME QUEUE name=\"clientid:kipper\"" ,
+                     "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.topic\" durable=true routingKey=kipper",
+                     "ACL ALLOW-LOG client DELETE QUEUE durable=\"true\"",
+                     "ACL ALLOW-LOG client UNBIND EXCHANGE name=\"amq.topic\" durable=true routingKey=kipper");
     }
 
     public void testClientDeleteQueueSuccess() throws Exception
@@ -128,12 +176,12 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpClientDeleteQueueFailure() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                             "ACL ALLOW-LOG client CREATE QUEUE durable=\"true\"" ,
-                             "ACL ALLOW-LOG client CONSUME QUEUE name=\"clientid:kipper\"",
-                             "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.topic\" durable=true routingKey=kipper",
-                             "ACL DENY-LOG client DELETE QUEUE durable=\"true\"",
-                             "ACL DENY-LOG client UNBIND EXCHANGE name=\"amq.topic\" durable=true routingKey=kipper");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client CREATE QUEUE durable=\"true\"",
+                     "ACL ALLOW-LOG client CONSUME QUEUE name=\"clientid:kipper\"" ,
+                     "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.topic\" durable=true routingKey=kipper",
+                     "ACL DENY-LOG client DELETE QUEUE durable=\"true\"",
+                     "ACL DENY-LOG client UNBIND EXCHANGE name=\"amq.topic\" durable=true routingKey=kipper");
     }
 
     public void testClientDeleteQueueFailure() throws Exception
@@ -177,10 +225,10 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpClientConsumeFromNamedQueueValid() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                             "ACL ALLOW-LOG client CREATE QUEUE name=\"example.RequestQueue\"" ,
-                             "ACL ALLOW-LOG client CONSUME QUEUE name=\"example.RequestQueue\"",
-                             "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.direct\" routingKey=\"example.RequestQueue\"");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client CREATE QUEUE name=\"example.RequestQueue\"",
+                     "ACL ALLOW-LOG client CONSUME QUEUE name=\"example.RequestQueue\"" ,
+                     "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.direct\" routingKey=\"example.RequestQueue\"");
     }
 
 
@@ -197,10 +245,10 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpClientConsumeFromNamedQueueFailure() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                "ACL ALLOW-LOG client CREATE QUEUE" ,
-                "ACL ALLOW-LOG client BIND EXCHANGE",
-                "ACL DENY-LOG client CONSUME QUEUE name=\"IllegalQueue\"");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client CREATE QUEUE",
+                     "ACL ALLOW-LOG client BIND EXCHANGE" ,
+                     "ACL DENY-LOG client CONSUME QUEUE name=\"IllegalQueue\"");
     }
 
     public void testClientConsumeFromNamedQueueFailure() throws NamingException, Exception
@@ -224,11 +272,11 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpClientCreateTemporaryQueueSuccess() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                             "ACL ALLOW-LOG client CREATE QUEUE temporary=\"true\"" ,
-                             "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.direct\" temporary=true",
-                             "ACL ALLOW-LOG client DELETE QUEUE temporary=\"true\"",
-                             "ACL ALLOW-LOG client UNBIND EXCHANGE name=\"amq.direct\" temporary=true");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client CREATE QUEUE temporary=\"true\"",
+                     "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.direct\" temporary=true" ,
+                     "ACL ALLOW-LOG client DELETE QUEUE temporary=\"true\"",
+                     "ACL ALLOW-LOG client UNBIND EXCHANGE name=\"amq.direct\" temporary=true");
     }
 
     public void testClientCreateTemporaryQueueSuccess() throws JMSException, URLSyntaxException, Exception
@@ -243,8 +291,8 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpClientCreateTemporaryQueueFailed() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                             "ACL DENY-LOG client CREATE QUEUE temporary=\"true\"");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL DENY-LOG client CREATE QUEUE temporary=\"true\"");
     }
 
     public void testClientCreateTemporaryQueueFailed() throws NamingException, Exception
@@ -268,9 +316,8 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpClientCreateNamedQueueFailure() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                             "ACL ALLOW-LOG client CREATE QUEUE name=\"ValidQueue\"",
-                             "ACL ALLOW-LOG client CONSUME QUEUE");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client CREATE QUEUE name=\"ValidQueue\"");
     }
 
     public void testClientCreateNamedQueueFailure() throws NamingException, JMSException, AMQException, Exception
@@ -294,10 +341,10 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpClientPublishUsingTransactionSuccess() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                             "ACL ALLOW-LOG client CREATE QUEUE" ,
-                             "ACL ALLOW-LOG client BIND EXCHANGE",
-                             "ACL ALLOW-LOG client PUBLISH EXCHANGE name=\"amq.direct\" routingKey=\"example.RequestQueue\"");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client CREATE QUEUE",
+                     "ACL ALLOW-LOG client BIND EXCHANGE" ,
+                     "ACL ALLOW-LOG client PUBLISH EXCHANGE name=\"amq.direct\" routingKey=\"example.RequestQueue\"");
     }
 
     public void testClientPublishUsingTransactionSuccess() throws Exception
@@ -329,19 +376,18 @@ public class ExternalACLTest extends AbstractACLTestCase
         // We tolerate a dependency from this test to that file because its
         // contents are expected to change rarely.
 
-        writeACLFile("test", "ACL ALLOW-LOG messaging-users ACCESS VIRTUALHOST",
-                             "# Server side",
-                             "ACL ALLOW-LOG server CREATE QUEUE name=\"example.RequestQueue\"" ,
-                             "ACL ALLOW-LOG server BIND EXCHANGE",
-                             "ACL ALLOW-LOG server PUBLISH EXCHANGE name=\"amq.direct\" routingKey=\"TempQueue*\"",
-                             "ACL ALLOW-LOG server CONSUME QUEUE name=\"example.RequestQueue\"",
-                             "# Client side",
-                             "ACL ALLOW-LOG client PUBLISH EXCHANGE name=\"amq.direct\" routingKey=\"example.RequestQueue\"",
-                             "ACL ALLOW-LOG client CONSUME QUEUE temporary=true",
-                             "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.direct\" temporary=true",
-                             "ACL ALLOW-LOG client UNBIND EXCHANGE name=\"amq.direct\" temporary=true",
-                             "ACL ALLOW-LOG client CREATE QUEUE temporary=true",
-                             "ACL ALLOW-LOG client DELETE QUEUE temporary=true");
+        writeACLFile("ACL ALLOW-LOG messaging-users ACCESS VIRTUALHOST", "# Server side",
+                     "ACL ALLOW-LOG server CREATE QUEUE name=\"example.RequestQueue\"",
+                     "ACL ALLOW-LOG server BIND EXCHANGE" ,
+                     "ACL ALLOW-LOG server PUBLISH EXCHANGE name=\"amq.direct\" routingKey=\"TempQueue*\"",
+                     "ACL ALLOW-LOG server CONSUME QUEUE name=\"example.RequestQueue\"",
+                     "# Client side",
+                     "ACL ALLOW-LOG client PUBLISH EXCHANGE name=\"amq.direct\" routingKey=\"example.RequestQueue\"",
+                     "ACL ALLOW-LOG client CONSUME QUEUE temporary=true",
+                     "ACL ALLOW-LOG client BIND EXCHANGE name=\"amq.direct\" temporary=true",
+                     "ACL ALLOW-LOG client UNBIND EXCHANGE name=\"amq.direct\" temporary=true",
+                     "ACL ALLOW-LOG client CREATE QUEUE temporary=true",
+                     "ACL ALLOW-LOG client DELETE QUEUE temporary=true");
     }
 
 
@@ -386,9 +432,9 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpClientDeleteQueueSuccessWithOnlyAllPermissions() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW-LOG client ACCESS VIRTUALHOST",
-                             "ACL ALLOW-LOG client ALL QUEUE",
-                             "ACL ALLOW-LOG client ALL EXCHANGE");
+        writeACLFile("ACL ALLOW-LOG client ACCESS VIRTUALHOST",
+                     "ACL ALLOW-LOG client ALL QUEUE",
+                     "ACL ALLOW-LOG client ALL EXCHANGE");
     }
 
     public void testClientDeleteQueueSuccessWithOnlyAllPermissions() throws Exception
@@ -412,7 +458,7 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpFirewallAllow() throws Exception
     {
-        writeACLFile("test", "ACL ALLOW client ACCESS VIRTUALHOST from_network=\"127.0.0.1\"");
+        writeACLFile("ACL ALLOW client ACCESS VIRTUALHOST from_network=\"127.0.0.1\"");
     }
 
     public void testFirewallAllow() throws Exception
@@ -423,7 +469,7 @@ public class ExternalACLTest extends AbstractACLTestCase
 
     public void setUpFirewallDeny() throws Exception
     {
-        writeACLFile("test", "ACL DENY client ACCESS VIRTUALHOST from_network=\"127.0.0.1\"");
+        writeACLFile("ACL DENY client ACCESS VIRTUALHOST from_network=\"127.0.0.1\"");
     }
 
     public void testFirewallDeny() throws Exception
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/BrokerACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/BrokerACLTest.java
index 7f41a8eb2e..2d88d02ee5 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/BrokerACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/BrokerACLTest.java
@@ -63,8 +63,7 @@ public class BrokerACLTest extends QpidRestTestCase
         super.customizeConfiguration();
         getRestTestHelper().configureTemporaryPasswordFile(this, ALLOWED_USER, DENIED_USER);
 
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_USER + " CONFIGURE BROKER",
                 "ACL DENY-LOG " + DENIED_USER + " CONFIGURE BROKER",
                 "ACL DENY-LOG ALL ALL");
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/ExchangeRestACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/ExchangeRestACLTest.java
index b39d994198..3b9027fb97 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/ExchangeRestACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/ExchangeRestACLTest.java
@@ -46,8 +46,7 @@ public class ExchangeRestACLTest extends QpidRestTestCase
         super.customizeConfiguration();
         getRestTestHelper().configureTemporaryPasswordFile(this, ALLOWED_USER, DENIED_USER);
 
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_USER + " CREATE EXCHANGE",
                 "ACL DENY-LOG " + DENIED_USER + " CREATE EXCHANGE",
                 "ACL ALLOW-LOG " + ALLOWED_USER + " UPDATE EXCHANGE",
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/GroupRestACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/GroupRestACLTest.java
index 9a578d01fb..02d6e48d81 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/GroupRestACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/GroupRestACLTest.java
@@ -95,8 +95,7 @@ public class GroupRestACLTest extends QpidRestTestCase
 
     public void testCreateGroup() throws Exception
     {
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_GROUP + " CREATE GROUP",
                 "ACL DENY-LOG " + DENIED_GROUP + " CREATE GROUP");
 
@@ -122,8 +121,7 @@ public class GroupRestACLTest extends QpidRestTestCase
 
     public void testDeleteGroup() throws Exception
     {
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_GROUP + " DELETE GROUP",
                 "ACL DENY-LOG " + DENIED_GROUP + " DELETE GROUP");
 
@@ -149,8 +147,7 @@ public class GroupRestACLTest extends QpidRestTestCase
 
     public void testUpdateGroupAddMember() throws Exception
     {
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_GROUP + " UPDATE GROUP",
                 "ACL DENY-LOG " + DENIED_GROUP + " UPDATE GROUP");
 
@@ -170,8 +167,7 @@ public class GroupRestACLTest extends QpidRestTestCase
 
     public void testUpdateGroupDeleteMember() throws Exception
     {
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_GROUP + " UPDATE GROUP",
                 "ACL DENY-LOG " + DENIED_GROUP + " UPDATE GROUP");
 
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/LogViewerACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/LogViewerACLTest.java
index 96ea5c92b3..8dd3a52333 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/LogViewerACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/LogViewerACLTest.java
@@ -39,8 +39,7 @@ public class LogViewerACLTest extends QpidRestTestCase
         super.customizeConfiguration();
         getRestTestHelper().configureTemporaryPasswordFile(this, ALLOWED_USER, DENIED_USER);
 
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_USER + " ACCESS_LOGS BROKER",
                 "ACL DENY-LOG " + DENIED_USER + " ACCESS_LOGS BROKER",
                 "ACL DENY-LOG ALL ALL");
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/QueueRestACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/QueueRestACLTest.java
index b187ca955a..07206a1379 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/QueueRestACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/QueueRestACLTest.java
@@ -43,8 +43,7 @@ public class QueueRestACLTest extends QpidRestTestCase
         super.customizeConfiguration();
         getRestTestHelper().configureTemporaryPasswordFile(this, ALLOWED_USER, DENIED_USER);
 
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_USER + " CREATE QUEUE",
                 "ACL DENY-LOG " + DENIED_USER + " CREATE QUEUE",
                 "ACL ALLOW-LOG " + ALLOWED_USER + " UPDATE QUEUE",
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/UserPreferencesRestACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/UserPreferencesRestACLTest.java
index 6ed84ac95a..efde7d51b7 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/UserPreferencesRestACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/UserPreferencesRestACLTest.java
@@ -77,7 +77,7 @@ public class UserPreferencesRestACLTest extends QpidRestTestCase
         super.customizeConfiguration();
         getRestTestHelper().configureTemporaryPasswordFile(this, ALLOWED_USER, DENIED_USER);
 
-        AbstractACLTestCase.writeACLFileUtil(this, null, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT", "ACL ALLOW-LOG " + ALLOWED_USER
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT", "ACL ALLOW-LOG " + ALLOWED_USER
                 + " UPDATE USER", "ACL DENY-LOG " + DENIED_USER + " UPDATE USER", "ACL DENY-LOG ALL ALL");
 
         TestBrokerConfiguration brokerConfiguration = getBrokerConfiguration();
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/UserRestACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/UserRestACLTest.java
index 4c4e219695..b4f4d0b4dd 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/UserRestACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/UserRestACLTest.java
@@ -97,8 +97,7 @@ public class UserRestACLTest extends QpidRestTestCase
 
     public void testAddUser() throws Exception
     {
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_GROUP + " CREATE USER",
                 "ACL DENY-LOG " + DENIED_GROUP + " CREATE USER");
 
@@ -122,8 +121,7 @@ public class UserRestACLTest extends QpidRestTestCase
 
     public void testDeleteUser() throws Exception
     {
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_GROUP + " DELETE USER",
                 "ACL DENY-LOG " + DENIED_GROUP + " DELETE USER");
 
@@ -143,8 +141,7 @@ public class UserRestACLTest extends QpidRestTestCase
 
     public void testUpdateUser() throws Exception
     {
-        AbstractACLTestCase.writeACLFileUtil(this, null,
-                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
+        AbstractACLTestCase.writeACLFileUtil(this, "ACL ALLOW-LOG ALL ACCESS MANAGEMENT",
                 "ACL ALLOW-LOG " + ALLOWED_GROUP + " UPDATE USER",
                 "ACL DENY-LOG " + DENIED_GROUP + " UPDATE USER");