Embedded ActiveMQ SimpleAuthenticationPlugin not working; queue allows all connections

It Grunt 0
Viewed 16

I'm using the spring-boot-activemq-starter to set up an embedded broker with a queue. Since I'm using an embedded broker with this project, I have a feeling that spring boot is not properly picking up the SimpleAuthentication plugin that i have in my resources folder as well as the /conf folder normally found in the standalone ActiveMQ

<plugins>
   <simpleAuthenticationPlugin anonymousAccessAllowed="false">
     <users>
         <authenticationUser username="myUser" password="myPassword" groups="users,admins"/>
     </users>
   </simpleAuthenticationPlugin>
</plugins>

I'm finding that the broker is allowing any connection regardless of the username/password being sent on the request. This will make people angry if my app gets DOXXED. I will also be angry. I do not like it when people are angry with me.

Since the guides I'm following generally use a standalone instance of ActiveMQ, I'm hoping someone can guide me to the corresponding configs I may need to set in a properties file for Spring Boot. Or if there is an alternative approach I should take, please let me know.

spring-jms activemq spring-boot-starter
1 Answers

You need to add authorization plugin entries as well.

Sample from the docs:

<authorizationPlugin> 
    <map> 
      <authorizationMap> 
        <authorizationEntries> 
          <authorizationEntry queue="TEST.Q" read="users" write="users" admin="users" /> 
          <authorizationEntry topic="ActiveMQ.Advisory.>" read="*" write="*" admin="*"/> 
        </authorizationEntries> 
        <tempDestinationAuthorizationEntry> 
          <tempDestinationAuthorizationEntry read="admins" write="admins" admin="admins"/> 
        </tempDestinationAuthorizationEntry> 
      </authorizationMap> 
    </map> 
  </authorizationPlugin>

ref: https://activemq.apache.org/security

Matt Pavlovich0
Related