QPID-4753: Add additional tests for updated AcessControlProvider config, inc creating and removing AccessControlProviders and verifying ACLs governing their creation/update/deletion. Add message to web ui to signal the user that only one access control provider of a given type will be used by the broker and they should remove others.

git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk@1471004 13f79535-47bb-0310-9956-ffa450edef68

5 files changed, 441 insertions, 1 deletions

diff --git a/qpid/java/broker-plugins/management-http/src/main/java/resources/js/qpid/authorization/checkUser.js b/qpid/java/broker-plugins/management-http/src/main/java/resources/js/qpid/authorization/checkUser.js
index 878cf9e3fe..3fc60854f6 100644
--- a/qpid/java/broker-plugins/management-http/src/main/java/resources/js/qpid/authorization/checkUser.js
+++ b/qpid/java/broker-plugins/management-http/src/main/java/resources/js/qpid/authorization/checkUser.js
@@ -28,7 +28,7 @@ var updateUI = function updateUI(data)
     if(data.user)
     {
         dom.byId("authenticatedUser").innerHTML = data.user;
-        dojo.style(dom.byId("login"), {display: 'block'});
+        dom.byId("login").style.display = "block";
     }
 };
 
diff --git a/qpid/java/broker-plugins/management-http/src/main/java/resources/js/qpid/management/Broker.js b/qpid/java/broker-plugins/management-http/src/main/java/resources/js/qpid/management/Broker.js
index eeac5b5c0b..a27e43d1b1 100644
--- a/qpid/java/broker-plugins/management-http/src/main/java/resources/js/qpid/management/Broker.js
+++ b/qpid/java/broker-plugins/management-http/src/main/java/resources/js/qpid/management/Broker.js
@@ -492,6 +492,7 @@ define(["dojo/_base/xhr",
                this.controller = controller;
                this.query = "rest/broker";
                this.attributes = attributes;
+               this.accessControlProvidersWarn = query(".broker-access-control-providers-warning", node)[0]
                var that = this;
 
                xhr.get({url: this.query, sync: properties.useSyncGet, handleAs: "json"})
@@ -647,6 +648,7 @@ define(["dojo/_base/xhr",
                                                            that.controller.show("accesscontrolprovider", name, brokerObj);
                                                        });
                                                }, gridProperties, EnhancedGrid);
+                             that.displayACLWarnMessage(aclData);
                          });
 
                xhr.get({url: "rest/logrecords", sync: properties.useSyncGet, handleAs: "json"})
@@ -715,6 +717,43 @@ define(["dojo/_base/xhr",
                }
            };
 
+           BrokerUpdater.prototype.displayACLWarnMessage = function(aclProviderData)
+           {
+             var message = "";
+             if (aclProviderData.length > 1)
+             {
+               var aclProviders = {};
+               var theSameTypeFound = false;
+               for(var d=0; d<aclProviderData.length; d++)
+               {
+                 var acl = aclProviderData[d];
+                 var aclType = acl.type;
+                 if (aclProviders[aclType])
+                 {
+                   aclProviders[aclType].push(acl.name);
+                   theSameTypeFound = true;
+                 }
+                 else
+                 {
+                   aclProviders[aclType] = [acl.name];
+                 }
+               }
+
+               if (theSameTypeFound)
+               {
+                 message = "Only one instance of a given type will be used. Please remove an instance of type(s):";
+                 for(var aclType in aclProviders)
+                 {
+                     if(aclProviders[aclType].length>1)
+                     {
+                       message +=  " " + aclType;
+                     }
+                 }
+               }
+             }
+             this.accessControlProvidersWarn.innerHTML = message;
+           }
+
            BrokerUpdater.prototype.update = function()
            {
 
@@ -749,6 +788,7 @@ define(["dojo/_base/xhr",
                                                                                        {
                                                                                          var data = that.brokerData.accesscontrolproviders ? that.brokerData.accesscontrolproviders :[];
                                                                                          that.accessControlProvidersGrid.update(data);
+                                                                                         that.displayACLWarnMessage(data);
                                                                                        }
                                                                                    });
 
diff --git a/qpid/java/broker-plugins/management-http/src/main/java/resources/showBroker.html b/qpid/java/broker-plugins/management-http/src/main/java/resources/showBroker.html
index 15f7faf318..d9991452af 100644
--- a/qpid/java/broker-plugins/management-http/src/main/java/resources/showBroker.html
+++ b/qpid/java/broker-plugins/management-http/src/main/java/resources/showBroker.html
@@ -184,6 +184,7 @@
     </div>
     <br/>
     <div data-dojo-type="dijit.TitlePane" data-dojo-props="title: 'Access Control Providers'">
+        <div class="broker-access-control-providers-warning" style="color: red"></div>
         <div class="broker-access-control-providers"></div>
         <button data-dojo-type="dijit.form.Button" class="addAccessControlProvider">Add Access Control Provider</button>
         <button data-dojo-type="dijit.form.Button" class="deleteAccessControlProvider">Delete Access Control Provider</button>
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/AccessControlProviderRestTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/AccessControlProviderRestTest.java
new file mode 100644
index 0000000000..ae7c648197
--- /dev/null
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/AccessControlProviderRestTest.java
@@ -0,0 +1,256 @@
+/*
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+package org.apache.qpid.systest.rest;
+
+import java.io.File;
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.commons.configuration.ConfigurationException;
+import org.apache.qpid.server.model.AccessControlProvider;
+import org.apache.qpid.server.security.access.FileAccessControlProviderConstants;
+import org.apache.qpid.test.utils.TestBrokerConfiguration;
+import org.apache.qpid.test.utils.TestFileUtils;
+
+public class AccessControlProviderRestTest extends QpidRestTestCase
+{
+    private static final String ALLOWED_USER = "allowed";
+    private static final String DENIED_USER = "denied";
+    private static final String OTHER_USER = "other";
+
+    private String  _aclFileContent1 =
+                          "ACL ALLOW-LOG " + ALLOWED_USER + " ACCESS MANAGEMENT\n" +
+                          "ACL ALLOW-LOG " + ALLOWED_USER + " CONFIGURE BROKER\n" +
+                          "ACL DENY-LOG ALL ALL";
+
+    private String  _aclFileContent2 =
+                          "ACL ALLOW-LOG " + ALLOWED_USER + " ACCESS MANAGEMENT\n" +
+                          "ACL ALLOW-LOG " + OTHER_USER + " ACCESS MANAGEMENT\n" +
+                          "ACL ALLOW-LOG " + ALLOWED_USER + " CONFIGURE BROKER\n" +
+                          "ACL DENY-LOG ALL ALL";
+
+    @Override
+    protected void customizeConfiguration() throws ConfigurationException, IOException
+    {
+        super.customizeConfiguration();
+        getRestTestHelper().configureTemporaryPasswordFile(this, ALLOWED_USER, DENIED_USER, OTHER_USER);
+
+        getBrokerConfiguration().setObjectAttribute(TestBrokerConfiguration.ENTRY_NAME_HTTP_MANAGEMENT,
+                "httpBasicAuthenticationEnabled", true);
+    }
+
+    public void testCreateAccessControlProvider() throws Exception
+    {
+        String accessControlProviderName = getTestName();
+
+        //verify that the access control provider doesn't exist, and
+        //in doing so implicitly verify that the 'denied' user can
+        //actually currently connect because no ACL is in effect yet
+        getRestTestHelper().setUsernameAndPassword(DENIED_USER, DENIED_USER);
+        assertAccessControlProviderExistence(accessControlProviderName, false);
+
+        //create the access control provider using the 'allowed' user
+        getRestTestHelper().setUsernameAndPassword(ALLOWED_USER, ALLOWED_USER);
+        int responseCode = createAccessControlProvider(accessControlProviderName, _aclFileContent1);
+        assertEquals("Access control provider creation should be allowed", 201, responseCode);
+
+        //verify it exists with the 'allowed' user
+        assertAccessControlProviderExistence(accessControlProviderName, true);
+
+        //verify the 'denied' user can no longer access the management interface
+        //due to the just-created ACL file now preventing it
+        getRestTestHelper().setUsernameAndPassword(DENIED_USER, DENIED_USER);
+        assertCanAccessManagementInterface(accessControlProviderName, false);
+    }
+
+    public void testRemoveAccessControlProvider() throws Exception
+    {
+        String accessControlProviderName = getTestName();
+
+        //verify that the access control provider doesn't exist, and
+        //in doing so implicitly verify that the 'denied' user can
+        //actually currently connect because no ACL is in effect yet
+        getRestTestHelper().setUsernameAndPassword(DENIED_USER, DENIED_USER);
+        assertAccessControlProviderExistence(accessControlProviderName, false);
+
+        //create the access control provider using the 'allowed' user
+        getRestTestHelper().setUsernameAndPassword(ALLOWED_USER, ALLOWED_USER);
+        int responseCode = createAccessControlProvider(accessControlProviderName, _aclFileContent1);
+        assertEquals("Access control provider creation should be allowed", 201, responseCode);
+
+        //verify it exists with the 'allowed' user
+        assertAccessControlProviderExistence(accessControlProviderName, true);
+
+        //verify the 'denied' user can no longer access the management interface
+        //due to the just-created ACL file now preventing it
+        getRestTestHelper().setUsernameAndPassword(DENIED_USER, DENIED_USER);
+        assertCanAccessManagementInterface(accessControlProviderName, false);
+
+        //remove the access control provider using the 'allowed' user
+        getRestTestHelper().setUsernameAndPassword(ALLOWED_USER, ALLOWED_USER);
+
+        responseCode = getRestTestHelper().submitRequest("/rest/accesscontrolprovider/" + accessControlProviderName, "DELETE", null);
+        assertEquals("Access control provider deletion should be allowed", 200, responseCode);
+        assertAccessControlProviderExistence(accessControlProviderName, false);
+
+        //verify it is gone again, using the 'denied' user to implicitly confirm it is
+        //now able to connect to the management interface again because the ACL was removed.
+        getRestTestHelper().setUsernameAndPassword(DENIED_USER, DENIED_USER);
+        assertAccessControlProviderExistence(accessControlProviderName, false);
+    }
+
+    public void testReplaceAccessControlProvider() throws Exception
+    {
+        String accessControlProviderName1 = getTestName() + "1";
+
+        //verify that the access control provider doesn't exist, and
+        //in doing so implicitly verify that the 'denied' user can
+        //actually currently connect because no ACL is in effect yet
+        getRestTestHelper().setUsernameAndPassword(DENIED_USER, DENIED_USER);
+        assertAccessControlProviderExistence(accessControlProviderName1, false);
+
+        //create the access control provider using the 'allowed' user
+        getRestTestHelper().setUsernameAndPassword(ALLOWED_USER, ALLOWED_USER);
+        int responseCode = createAccessControlProvider(accessControlProviderName1, _aclFileContent1);
+        assertEquals("Access control provider creation should be allowed", 201, responseCode);
+
+        //verify it exists with the 'allowed' user
+        assertAccessControlProviderExistence(accessControlProviderName1, true);
+
+        //verify the 'denied' and 'other' user can no longer access the management
+        //interface due to the just-created ACL file now preventing them
+        getRestTestHelper().setUsernameAndPassword(DENIED_USER, DENIED_USER);
+        assertCanAccessManagementInterface(accessControlProviderName1, false);
+        getRestTestHelper().setUsernameAndPassword(OTHER_USER, OTHER_USER);
+        assertCanAccessManagementInterface(accessControlProviderName1, false);
+
+        //create the replacement access control provider using the 'allowed' user.
+        String accessControlProviderName2 = getTestName() + "2";
+        getRestTestHelper().setUsernameAndPassword(ALLOWED_USER, ALLOWED_USER);
+        responseCode = createAccessControlProvider(accessControlProviderName2, _aclFileContent2);
+        assertEquals("Access control provider creation should be allowed", 201, responseCode);
+
+        //Verify that it took effect immediately, replacing the first access control provider
+
+        //verify the 'denied' user still can't access the management interface, but the 'other' user now CAN.
+        getRestTestHelper().setUsernameAndPassword(DENIED_USER, DENIED_USER);
+        assertCanAccessManagementInterface(accessControlProviderName2, false);
+        getRestTestHelper().setUsernameAndPassword(OTHER_USER, OTHER_USER);
+        assertCanAccessManagementInterface(accessControlProviderName2, true);
+
+        //remove the original access control provider using the 'allowed' user
+        getRestTestHelper().setUsernameAndPassword(ALLOWED_USER, ALLOWED_USER);
+        responseCode = getRestTestHelper().submitRequest("/rest/accesscontrolprovider/" + accessControlProviderName1, "DELETE", null);
+        assertEquals("Access control provider deletion should be allowed", 200, responseCode);
+        assertAccessControlProviderExistence(accessControlProviderName1, false);
+
+        //verify the 'denied' user still can't access the management interface, the 'other' user still can, thus
+        //confirming that the second access control provider is still in effect
+        getRestTestHelper().setUsernameAndPassword(DENIED_USER, DENIED_USER);
+        assertCanAccessManagementInterface(accessControlProviderName2, false);
+        getRestTestHelper().setUsernameAndPassword(OTHER_USER, OTHER_USER);
+        assertCanAccessManagementInterface(accessControlProviderName2, true);
+    }
+
+
+    public void testAddAndRemoveSecondAccessControlProviderReinstatesOriginal() throws Exception
+    {
+        String accessControlProviderName1 = getTestName() + "1";
+
+        //verify that the access control provider doesn't exist, and
+        //in doing so implicitly verify that the 'denied' user can
+        //actually currently connect because no ACL is in effect yet
+        getRestTestHelper().setUsernameAndPassword(DENIED_USER, DENIED_USER);
+        assertAccessControlProviderExistence(accessControlProviderName1, false);
+
+        //create the access control provider using the 'allowed' user
+        getRestTestHelper().setUsernameAndPassword(ALLOWED_USER, ALLOWED_USER);
+        int responseCode = createAccessControlProvider(accessControlProviderName1, _aclFileContent1);
+        assertEquals("Access control provider creation should be allowed", 201, responseCode);
+
+        //verify it exists with the 'allowed' user
+        assertAccessControlProviderExistence(accessControlProviderName1, true);
+
+        //verify the 'denied' and 'other' user can no longer access the management
+        //interface due to the just-created ACL file now preventing them
+        getRestTestHelper().setUsernameAndPassword(DENIED_USER, DENIED_USER);
+        assertCanAccessManagementInterface(accessControlProviderName1, false);
+        getRestTestHelper().setUsernameAndPassword(OTHER_USER, OTHER_USER);
+        assertCanAccessManagementInterface(accessControlProviderName1, false);
+
+        //create the replacement access control provider using the 'allowed' user.
+        String accessControlProviderName2 = getTestName() + "2";
+        getRestTestHelper().setUsernameAndPassword(ALLOWED_USER, ALLOWED_USER);
+        responseCode = createAccessControlProvider(accessControlProviderName2, _aclFileContent2);
+        assertEquals("Access control provider creation should be allowed", 201, responseCode);
+
+        //Verify that it took effect immediately, replacing the first access control provider
+
+        //verify the 'denied' user still can't access the management interface, but the 'other' user now CAN.
+        getRestTestHelper().setUsernameAndPassword(DENIED_USER, DENIED_USER);
+        assertCanAccessManagementInterface(accessControlProviderName2, false);
+        getRestTestHelper().setUsernameAndPassword(OTHER_USER, OTHER_USER);
+        assertCanAccessManagementInterface(accessControlProviderName2, true);
+
+        //remove the second access control provider using the 'allowed' user
+        getRestTestHelper().setUsernameAndPassword(ALLOWED_USER, ALLOWED_USER);
+        responseCode = getRestTestHelper().submitRequest("/rest/accesscontrolprovider/" + accessControlProviderName2, "DELETE", null);
+        assertEquals("Access control provider deletion should be allowed", 200, responseCode);
+        assertAccessControlProviderExistence(accessControlProviderName2, false);
+
+        //verify the 'denied' user still can't access the management interface, the
+        //'other' now CANT again, the 'allowed' still can, thus confirming that the
+        //first access control provider is now in effect once again
+        getRestTestHelper().setUsernameAndPassword(DENIED_USER, DENIED_USER);
+        assertCanAccessManagementInterface(accessControlProviderName2, false);
+        getRestTestHelper().setUsernameAndPassword(OTHER_USER, OTHER_USER);
+        assertCanAccessManagementInterface(accessControlProviderName2, false);
+        getRestTestHelper().setUsernameAndPassword(ALLOWED_USER, ALLOWED_USER);
+        assertCanAccessManagementInterface(accessControlProviderName2, true);
+    }
+
+    private void assertCanAccessManagementInterface(String accessControlProviderName, boolean canAccess) throws Exception
+    {
+        int expected = canAccess ? 200 : 403;
+        int responseCode = getRestTestHelper().submitRequest("/rest/accesscontrolprovider/" + accessControlProviderName, "GET", null);
+        assertEquals("Unexpected response code", expected, responseCode);
+    }
+
+    private void assertAccessControlProviderExistence(String accessControlProviderName, boolean exists) throws Exception
+    {
+        String path = "/rest/accesscontrolprovider/" + accessControlProviderName;
+        List<Map<String, Object>> providers = getRestTestHelper().getJsonAsList(path);
+        assertEquals("Unexpected result", exists, !providers.isEmpty());
+    }
+
+    private int createAccessControlProvider(String accessControlProviderName, String content) throws Exception
+    {
+        File file = TestFileUtils.createTempFile(this, ".acl", content);
+        Map<String, Object> attributes = new HashMap<String, Object>();
+        attributes.put(AccessControlProvider.NAME, accessControlProviderName);
+        attributes.put(AccessControlProvider.TYPE, FileAccessControlProviderConstants.ACL_FILE_PROVIDER_TYPE);
+        attributes.put(FileAccessControlProviderConstants.PATH, file.getAbsoluteFile());
+
+        return getRestTestHelper().submitRequest("/rest/accesscontrolprovider/" + accessControlProviderName, "PUT", attributes);
+    }
+}
diff --git a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/BrokerACLTest.java b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/BrokerACLTest.java
index c8225b37e4..220d2bc574 100644
--- a/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/BrokerACLTest.java
+++ b/qpid/java/systests/src/main/java/org/apache/qpid/systest/rest/acl/BrokerACLTest.java
@@ -28,6 +28,7 @@ import java.util.List;
 import java.util.Map;
 
 import org.apache.commons.configuration.ConfigurationException;
+import org.apache.qpid.server.model.AccessControlProvider;
 import org.apache.qpid.server.model.AuthenticationProvider;
 import org.apache.qpid.server.model.Broker;
 import org.apache.qpid.server.model.GroupProvider;
@@ -36,6 +37,7 @@ import org.apache.qpid.server.model.Port;
 import org.apache.qpid.server.model.Protocol;
 import org.apache.qpid.server.model.TrustStore;
 import org.apache.qpid.server.model.VirtualHost;
+import org.apache.qpid.server.security.access.FileAccessControlProviderConstants;
 import org.apache.qpid.server.security.acl.AbstractACLTestCase;
 import org.apache.qpid.server.security.auth.manager.AnonymousAuthenticationManagerFactory;
 import org.apache.qpid.server.security.auth.manager.PlainPasswordFileAuthenticationManagerFactory;
@@ -51,6 +53,7 @@ public class BrokerACLTest extends QpidRestTestCase
 {
     private static final String ALLOWED_USER = "user1";
     private static final String DENIED_USER = "user2";
+    private String _secondaryAclFileContent = "";
 
     @Override
     protected void customizeConfiguration() throws ConfigurationException, IOException
@@ -64,6 +67,12 @@ public class BrokerACLTest extends QpidRestTestCase
                 "ACL DENY-LOG " + DENIED_USER + " CONFIGURE BROKER",
                 "ACL DENY-LOG ALL ALL");
 
+        _secondaryAclFileContent =
+                "ACL ALLOW-LOG ALL ACCESS MANAGEMENT\n" +
+                "ACL ALLOW-LOG " + ALLOWED_USER + " CONFIGURE BROKER\n" +
+                "ACL DENY-LOG " + DENIED_USER + " CONFIGURE BROKER\n" +
+                "ACL DENY-LOG ALL ALL";
+
         getBrokerConfiguration().setObjectAttribute(TestBrokerConfiguration.ENTRY_NAME_HTTP_MANAGEMENT,
                 "httpBasicAuthenticationEnabled", true);
     }
@@ -754,6 +763,122 @@ public class BrokerACLTest extends QpidRestTestCase
         assertEquals("Setting of group provider attributes should be denied", 403, responseCode);
     }
 
+    /* === AccessControlProvider === */
+
+    public void testCreateAccessControlProviderAllowed() throws Exception
+    {
+        getRestTestHelper().setUsernameAndPassword(ALLOWED_USER, ALLOWED_USER);
+
+        String accessControlProviderName = getTestName();
+
+        assertAccessControlProviderExistence(accessControlProviderName, false);
+
+        int responseCode = createAccessControlProvider(accessControlProviderName);
+        assertEquals("Access control provider creation should be allowed", 201, responseCode);
+
+        assertAccessControlProviderExistence(accessControlProviderName, true);
+    }
+
+    public void testCreateAccessControlProviderDenied() throws Exception
+    {
+        getRestTestHelper().setUsernameAndPassword(DENIED_USER, DENIED_USER);
+
+        String accessControlProviderName = getTestName();
+
+        assertAccessControlProviderExistence(accessControlProviderName, false);
+
+        int responseCode = createAccessControlProvider(accessControlProviderName);
+        assertEquals("Access control provider creation should be denied", 403, responseCode);
+
+        assertAccessControlProviderExistence(accessControlProviderName, false);
+    }
+
+    public void testDeleteAccessControlProviderDenied() throws Exception
+    {
+        getRestTestHelper().setUsernameAndPassword(ALLOWED_USER, ALLOWED_USER);
+
+        String accessControlProviderName = getTestName();
+
+        assertAccessControlProviderExistence(accessControlProviderName, false);
+
+        int responseCode = createAccessControlProvider(accessControlProviderName);
+        assertEquals("Access control provider creation should be allowed", 201, responseCode);
+
+        assertAccessControlProviderExistence(accessControlProviderName, true);
+
+        getRestTestHelper().setUsernameAndPassword(DENIED_USER, DENIED_USER);
+
+        responseCode = getRestTestHelper().submitRequest("/rest/accesscontrolprovider/" + accessControlProviderName, "DELETE", null);
+        assertEquals("Access control provider deletion should be denied", 403, responseCode);
+
+        assertAccessControlProviderExistence(accessControlProviderName, true);
+    }
+
+    public void testDeleteAccessControlProviderAllowed() throws Exception
+    {
+        getRestTestHelper().setUsernameAndPassword(ALLOWED_USER, ALLOWED_USER);
+
+        String accessControlProviderName = getTestName();
+
+        assertAccessControlProviderExistence(accessControlProviderName, false);
+
+        int responseCode = createAccessControlProvider(accessControlProviderName);
+        assertEquals("Access control provider creation should be allowed", 201, responseCode);
+
+        assertAccessControlProviderExistence(accessControlProviderName, true);
+
+        responseCode = getRestTestHelper().submitRequest("/rest/accesscontrolprovider/" + accessControlProviderName, "DELETE", null);
+        assertEquals("Access control provider deletion should be allowed", 200, responseCode);
+
+        assertAccessControlProviderExistence(accessControlProviderName, false);
+    }
+
+    public void testSetAccessControlProviderAttributesAllowedButUnsupported() throws Exception
+    {
+        getRestTestHelper().setUsernameAndPassword(ALLOWED_USER, ALLOWED_USER);
+
+        String accessControlProviderName = getTestName();
+
+        assertAccessControlProviderExistence(accessControlProviderName, false);
+
+        int responseCode = createAccessControlProvider(accessControlProviderName);
+        assertEquals("Access control provider creation should be allowed", 201, responseCode);
+
+        assertAccessControlProviderExistence(accessControlProviderName, true);
+
+        Map<String, Object> attributes = new HashMap<String, Object>();
+        attributes.put(GroupProvider.NAME, accessControlProviderName);
+        attributes.put(GroupProvider.TYPE, FileGroupManagerFactory.GROUP_FILE_PROVIDER_TYPE);
+        attributes.put(FileGroupManagerFactory.PATH, "/path/to/file");
+        responseCode = getRestTestHelper().submitRequest("/rest/accesscontrolprovider/" + accessControlProviderName, "PUT", attributes);
+        assertEquals("Setting of access control provider attributes should be allowed but not supported", 409, responseCode);
+    }
+
+    public void testSetAccessControlProviderAttributesDenied() throws Exception
+    {
+        getRestTestHelper().setUsernameAndPassword(ALLOWED_USER, ALLOWED_USER);
+
+        String accessControlProviderName = getTestName();
+
+        assertAccessControlProviderExistence(accessControlProviderName, false);
+
+        int responseCode = createAccessControlProvider(accessControlProviderName);
+        assertEquals("Access control provider creation should be allowed", 201, responseCode);
+
+        assertAccessControlProviderExistence(accessControlProviderName, true);
+
+        getRestTestHelper().setUsernameAndPassword(DENIED_USER, DENIED_USER);
+
+        Map<String, Object> attributes = new HashMap<String, Object>();
+        attributes.put(GroupProvider.NAME, accessControlProviderName);
+        attributes.put(GroupProvider.TYPE, FileGroupManagerFactory.GROUP_FILE_PROVIDER_TYPE);
+        attributes.put(FileGroupManagerFactory.PATH, "/path/to/file");
+        responseCode = getRestTestHelper().submitRequest("/rest/accesscontrolprovider/" + accessControlProviderName, "PUT", attributes);
+        assertEquals("Setting of access control provider attributes should be denied", 403, responseCode);
+    }
+
+    /* === Utility Methods === */
+
     private int createPort(String portName) throws Exception
     {
         Map<String, Object> attributes = new HashMap<String, Object>();
@@ -888,4 +1013,22 @@ public class BrokerACLTest extends QpidRestTestCase
 
         return getRestTestHelper().submitRequest("/rest/groupprovider/" + groupProviderName, "PUT", attributes);
     }
+
+    private void assertAccessControlProviderExistence(String accessControlProviderName, boolean exists) throws Exception
+    {
+        String path = "/rest/accesscontrolprovider/" + accessControlProviderName;
+        List<Map<String, Object>> providers = getRestTestHelper().getJsonAsList(path);
+        assertEquals("Unexpected result", exists, !providers.isEmpty());
+    }
+
+    private int createAccessControlProvider(String accessControlProviderName) throws Exception
+    {
+        File file = TestFileUtils.createTempFile(this, ".acl", _secondaryAclFileContent);
+        Map<String, Object> attributes = new HashMap<String, Object>();
+        attributes.put(AccessControlProvider.NAME, accessControlProviderName);
+        attributes.put(AccessControlProvider.TYPE, FileAccessControlProviderConstants.ACL_FILE_PROVIDER_TYPE);
+        attributes.put(FileAccessControlProviderConstants.PATH, file.getAbsoluteFile());
+
+        return getRestTestHelper().submitRequest("/rest/accesscontrolprovider/" + accessControlProviderName, "PUT", attributes);
+    }
 }