Introduce dummy user for direct connections without users.

2 files changed, 62 insertions, 15 deletions

diff --git a/src/rabbit_auth_backend_dummy.erl b/src/rabbit_auth_backend_dummy.erl
new file mode 100644
index 00000000..1a3db732
--- /dev/null
+++ b/src/rabbit_auth_backend_dummy.erl
@@ -0,0 +1,49 @@
+%% The contents of this file are subject to the Mozilla Public License
+%% Version 1.1 (the "License"); you may not use this file except in
+%% compliance with the License. You may obtain a copy of the License
+%% at http://www.mozilla.org/MPL/
+%%
+%% Software distributed under the License is distributed on an "AS IS"
+%% basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+%% the License for the specific language governing rights and
+%% limitations under the License.
+%%
+%% The Original Code is RabbitMQ.
+%%
+%% The Initial Developer of the Original Code is GoPivotal, Inc.
+%% Copyright (c) 2007-2013 GoPivotal, Inc.  All rights reserved.
+%%
+
+-module(rabbit_auth_backend_dummy).
+-include("rabbit.hrl").
+
+-behaviour(rabbit_auth_backend).
+
+-export([description/0]).
+-export([user/0]).
+-export([check_user_login/2, check_vhost_access/2, check_resource_access/3]).
+
+-ifdef(use_specs).
+
+-spec(user/0 :: () -> rabbit_types:user()).
+
+-endif.
+
+%% A user to be used by the direct client when permission checks are
+%% not needed. This user can do anything AMQPish.
+user() -> #user{username     = <<"dummy">>,
+                tags         = [],
+                auth_backend = ?MODULE,
+                impl         = none}.
+
+%% Implementation of rabbit_auth_backend
+
+description() ->
+    [{name, <<"Dummy">>},
+     {description, <<"Database for the dummy user">>}].
+
+check_user_login(_, _) ->
+    {refused, "cannot log in conventionally as dummy user", []}.
+
+check_vhost_access(#user{}, _VHostPath) -> true.
+check_resource_access(#user{}, #resource{}, _Permission) -> true.
diff --git a/src/rabbit_direct.erl b/src/rabbit_direct.erl
index 5a004792..267b581d 100644
--- a/src/rabbit_direct.erl
+++ b/src/rabbit_direct.erl
@@ -31,7 +31,7 @@
 -spec(force_event_refresh/0 :: () -> 'ok').
 -spec(list/0 :: () -> [pid()]).
 -spec(list_local/0 :: () -> [pid()]).
--spec(connect/5 :: ((rabbit_types:username() | rabbit_types:user() |
+-spec(connect/5 :: (('nouser' |
                      {rabbit_types:username(), rabbit_types:password()}),
                     rabbit_types:vhost(), rabbit_types:protocol(), pid(),
                     rabbit_event:event_props()) ->
@@ -67,37 +67,35 @@ list() ->
 
 %%----------------------------------------------------------------------------
 
-connect(User = #user{}, VHost, Protocol, Pid, Infos) ->
-    try rabbit_access_control:check_vhost_access(User, VHost) of
-        ok -> ok = pg_local:join(rabbit_direct, Pid),
-              rabbit_event:notify(connection_created, Infos),
-              {ok, {User, rabbit_reader:server_properties(Protocol)}}
-    catch
-        exit:#amqp_error{name = access_refused} ->
-            {error, access_refused}
-    end;
-
 connect({Username, Password}, VHost, Protocol, Pid, Infos) ->
     connect0(fun () -> rabbit_access_control:check_user_pass_login(
                          Username, Password) end,
              VHost, Protocol, Pid, Infos);
 
-connect(Username, VHost, Protocol, Pid, Infos) ->
-    connect0(fun () -> rabbit_access_control:check_user_login(
-                         Username, []) end,
+connect(nouser, VHost, Protocol, Pid, Infos) ->
+    connect0(fun () -> {ok, rabbit_auth_backend_dummy:user()} end,
              VHost, Protocol, Pid, Infos).
 
 connect0(AuthFun, VHost, Protocol, Pid, Infos) ->
     case rabbit:is_running() of
         true  -> case AuthFun() of
                      {ok, User} ->
-                         connect(User, VHost, Protocol, Pid, Infos);
+                         connect1(User, VHost, Protocol, Pid, Infos);
                      {refused, _M, _A} ->
                          {error, {auth_failure, "Refused"}}
                  end;
         false -> {error, broker_not_found_on_node}
     end.
 
+connect1(User, VHost, Protocol, Pid, Infos) ->
+    try rabbit_access_control:check_vhost_access(User, VHost) of
+        ok -> ok = pg_local:join(rabbit_direct, Pid),
+              rabbit_event:notify(connection_created, Infos),
+              {ok, {User, rabbit_reader:server_properties(Protocol)}}
+    catch
+        exit:#amqp_error{name = access_refused} ->
+            {error, access_refused}
+    end.
 
 start_channel(Number, ClientChannelPid, ConnPid, ConnName, Protocol, User,
               VHost, Capabilities, Collector) ->