diff --git a/acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionChecker.java b/acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionChecker.java index 549c9fdce9..8e6c317b23 100644 --- a/acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionChecker.java +++ b/acl/src/main/java/org/apache/rocketmq/acl/plain/PlainPermissionChecker.java @@ -27,9 +27,15 @@ public class PlainPermissionChecker implements PermissionChecker { public void check(AccessResource checkedAccess, AccessResource ownedAccess) { PlainAccessResource checkedPlainAccess = (PlainAccessResource) checkedAccess; PlainAccessResource ownedPlainAccess = (PlainAccessResource) ownedAccess; - if (Permission.needAdminPerm(checkedPlainAccess.getRequestCode()) && !ownedPlainAccess.isAdmin()) { + + if (ownedPlainAccess.isAdmin()) { + // admin user don't need verification + return; + } + if (Permission.needAdminPerm(checkedPlainAccess.getRequestCode())) { throw new AclException(String.format("Need admin permission for request code=%d, but accessKey=%s is not", checkedPlainAccess.getRequestCode(), ownedPlainAccess.getAccessKey())); } + Map needCheckedPermMap = checkedPlainAccess.getResourcePermMap(); Map ownedPermMap = ownedPlainAccess.getResourcePermMap(); @@ -38,11 +44,6 @@ public class PlainPermissionChecker implements PermissionChecker { return; } - if (ownedPermMap == null && ownedPlainAccess.isAdmin()) { - // If the ownedPermMap is null and it is an admin user, then return - return; - } - for (Map.Entry needCheckedEntry : needCheckedPermMap.entrySet()) { String resource = needCheckedEntry.getKey(); Byte neededPerm = needCheckedEntry.getValue(); @@ -58,7 +59,7 @@ public class PlainPermissionChecker implements PermissionChecker { continue; } if (!Permission.checkPermission(neededPerm, ownedPermMap.get(resource))) { - throw new AclException(String.format("No default permission for %s", PlainAccessResource.printStr(resource, isGroup))); + throw new AclException(String.format("No permission for %s", PlainAccessResource.printStr(resource, isGroup))); } } }