Read-only web console access in ActiveMQ

Question

I'm using ActiveMQ 5.10 and would like to create a user that has read-only access through the web console.

Red Hat published this article, mentioning that it's not really read only due to a bug in ActiveMQ. According to the bug report AMQ-4567, the bug is fixed as of ActiveMQ 5.9. However, I'm not seeing it work appropriately.

I have tried a number of different configurations, with the most recent being two separate JAAS implementations, one for Jetty and one for ActiveMQ. The relevant property files are excerpted below.

I can mostly log in to the web console using the "system" user. But the guest user doesn't work at all. The application user (appuser) doesn't need access to the web console at all.

My authN/authZ needs are pretty trivial: one admin user, one application account, and one read-only monitoring account.

Is there any good way to get this working with a recent version of ActiveMQ (>= 5.9.0)?

groups.properties

admins=system

users=appuser,admin

guests=guest

users.properties

system={password redacted}

appuser=appuser

guest=guest

jetty-realm.properties

system: MD5:46cf1b5451345f5176cd70713e0c9e07,user,admin

guest: guest,guest

As an aside, I used the Jetty tutorial and the Rundeck instructions to figure out the jetty-realm.properties file and chapter 6 of ActiveMQ in Action to work out the ActiveMQ JAAS.

Answer 1

I was finally able to get to what I wanted by deploying the web console to an external Tomcat instance. I assume that when it runs out of process, it can't bypass security and so has to use whatever credentials you provide. In this case, I gave the Tomcat instance the read-only JMX user credentials.

It's not great, as there is no security trimmed UI. You can still attempt to create new destinations, delete destinations, etc. When you try with a read-only user, you get an error. That gets a "D" for UX, but a "B" for security.