I'm trying to configure user based authentication for ActiveMQ, and I'm pretty confused about the many different files involved in this process. I've read ActiveMQ's security page, but I still have several questions.
Just to be clear, my goals is to make it so only a specified user can read or write to ActiveMQ or access the web console. These can be local ActiveMQ users, LDAP is not needed.
I have successfully realized that in order to configure access to the web console I need to configure the users in conf/jetty-realm.properties
, but beyond that I'm stuck.
Ok, so the files that seem to be related to authentication in the conf
folder are...
credentials.properties
credentials-enc.properties
groups.properties
login.config
users.properties
On top of that, the security pages recommends using the "simpleAuthenticationPlugin
"
<simpleAuthenticationPlugin>
<users>
<authenticationUser username="system" password="manager"
groups="users,admins"/>
<authenticationUser username="user" password="password"
groups="users"/>
<authenticationUser username="guest" password="password" groups="guests"/>
</users>
</simpleAuthenticationPlugin>
In the broker
So my understanding is..
users.properties
seems like where the users should go, but I don't see the point thesimpleAuthenticationPlugin
if this file exists.group.properties
seems like a place to configure the groups, ok.login.config
seems like it just points tousers.properties
andgroups.properties
, ok.credentials.properties
seems redundant. It looks like users are being configured in here. Not sure why this exists ifusers.properties
exists.credentials-enc.properites
seems like a place for encrypted passwords, but again why does this exist ifusers.properties
exists?
My questions are...
What is the proper way to configure a local user on ActiveMQ and make it so they are the only ones who can read or write to the queues?
What is the purpose of each of the following files?
credentials.properties
credentials-enc.properties
groups.properties
login.config
users.properties
Does the
simpleAuthenticationPlugin
make these files obsolete?