How to split permissions by addresses in Artemis web console

Faringot 0
Viewed 27

Good day, A task: For each user, give the rights to operations (list, get, browse, etc.) only on their addresses. Rights to addresses are issued in broker.xml.

Currently, any user with the browse role can read messages from any address.

Raised Artemis MQ cluster with domain authentication. We issue rights through broker.xml to addresses of domain users. We want to enable domain users to manage their addresses/queues via the web GUI. Granted rights to the Domain Users group in the artemis.profile config and all domain users got access to the web GUI.

Gave rights to the Domain Users group on the methods in the management.xml file and ALL domain users can use the allowed methods on ALL queues, including the browse method (allows you to read messages).

Is it possible to restrict access in the web GUI so that domain users can use allowed methods only on THEIR queues (the rights are granted in broker.xml) or do you need to prescribe blocks with methods for each queue in management.xml (you can use a mask) and give rights to methods separate groups?

activemq-artemis
1 Answers

Generally speaking ActiveMQ Artemis supports role-based access control (i.e. RBAC) so each user who needs unique permissions will need to be in a unique role.

The web console in ActiveMQ Artemis is based on Hawtio which uses Jolokia (a JMX-HTTP bridge) to communicate with the JMX MBeans in the broker. Authorization for Jolokia is configured in etc/management.xml. Here is the default contents:

<management-context xmlns="http://activemq.apache.org/schema">
   <!--<connector connector-port="1099"/>-->
   <authorisation>
      <allowlist>
         <entry domain="hawtio"/>
      </allowlist>
      <default-access>
         <access method="list*" roles="amq"/>
         <access method="get*" roles="amq"/>
         <access method="is*" roles="amq"/>
         <access method="set*" roles="amq"/>
         <access method="*" roles="amq"/>
      </default-access>
      <role-access>
         <match domain="org.apache.activemq.artemis">
            <access method="list*" roles="amq"/>
            <access method="get*" roles="amq"/>
            <access method="is*" roles="amq"/>
            <access method="set*" roles="amq"/>
            <!-- Note count and browse are need to access the browse tab in the console-->
            <access method="browse*" roles="amq"/>
            <access method="count*" roles="amq"/>
            <access method="*" roles="amq"/>
         </match>
         <!--example of how to configure a specific object-->
         <!--<match domain="org.apache.activemq.artemis" key="subcomponent=queues">
            <access method="list*" roles="view,update,amq"/>
            <access method="get*" roles="view,update,amq"/>
            <access method="is*" roles="view,update,amq"/>
            <access method="set*" roles="update,amq"/>
            <access method="*" roles="amq"/>
         </match>-->
      </role-access>
   </authorisation>
</management-context>

The domain and key are based on the name of the JMX MBean on the broker. For example the name of the MBean for an anycast queue named "myQueue" on the address "myAddress" on the broker "myBroker" would be:

org.apache.activemq.artemis:broker=myBroker,component=addresses,address="myAddress",subcomponent=queues,routing-type="anycast",queue="myQueue"

Therefore, if you only wanted users in the role "myRole" to be able to browse messages on the queue "myQueue" then you'd have a match like this:

         <match domain="org.apache.activemq.artemis" key="queue=myQueue">
            <access method="list*" roles="myRole"/>
            <access method="get*" roles="myRole"/>
            <access method="is*" roles="myRole"/>
            <access method="set*" roles="myRole"/>
            <access method="browse*" roles="myRole"/>
            <access method="count*" roles="myRole"/>
            <access method="*" roles="myRole"/>
         </match>

Keep in mind that by default access to the console is only allow via users with the amq role. This is configured in the etc/artemis.profile via the system property -Dhawtio.role=amq. You can configure multiple roles by changing this to -Dhawtio.roles=amq,myRole.

You can find more details in the documentation.

Justin Bertram0
Related