SecurityException raised when broker tries to move expired message to DLQ

[concombremasqué]

Hi,

I have enabled authentication + authorization in my broker configuration file as follows:

If I send a message with an expiration time into the queue (using a client configured with the right username and password) and then try to look after the message in the DLQ (after it expired) I got the following exception:

"Caught an exception sending to DLQ: Message ID:PC198829-1539-1259168148838-0:1:1:1:1 dropped=false locked=false

java.lang.SecurityException: User is not authenticated."

This only occurs when the broker has to deal with the DLQ. I can successfully read/write in any queue from either my client or the ActiveMQ Web Console.

Any idea?

Oh and I have this issue on both FUSE Message Broker 5.3.0.3 and 5.3.0.5.

Find attached activemq.log and my configuration (activemq.xml)

Thanks

[joe.luo]

I guess what was happening was that you sent a message to a queue successfully and the message expired after a while on the queue. A cleanup thread woke up and tried to find those expired messages then move them to DLQ queue but failed because either the DLQ queue was not properly authorized with the user or the cleanup thread somehow did not have right securityContext.

You might want to explicitely to add DLQ queue into "authorizationEntry" instead of ">" wildcard to see if it works.

If not, then it looks like a bug to me since the cleanup thread somehow did not have right securityContext. In this case, you might want to raise an ActiveMQ JIRA at Apache with a reproducible test case.

Just my 2c.

/Joe

[concombremasqué]

Hi Joe,

You have perfectly understood my issue. I tried what you suggested (explicit declaration of my DLQ queue in the authorizationEntry section) but I still end up with the same security exception.

So maybe it could be a bug. I will try to gather all the needed stuff to easily reproduce that and fill a JIRA.

Thanks.

[concombremasqué]

I've just opened a JIRA:

https://issues.apache.org/activemq/browse/AMQ-2516

Edit:

This issue has been confirmed to be a bug. It will be fixed in ActiveMQ 5.3.1/5.4.0 (refer to JIRA details).

Edited by: concombre masqué on Nov 27, 2009 8:45 AM

[selikoff]

Did you happen to find a work-around for 5.3.0?  Since 5.3.1 for fuse is not out, it would be helpful if I had a way to move messages to the DLQ without this error occurring.

[joe.luo]

It was just one line fix, so I guess you could just build your own version with the fix to work around the issue. for more details, please have a look at the AMQ-2516.

[concombremasqué]

FYI, the fix for this issue is included in FUSE Message Broker 5.3.0-psc-01-00RC1 (see release notes here: http://fusesource.com/wiki/display/ProdInfo/FUSE+Message+Broker+v5.3.0-psc-01+Release+Notes).

Moreover this release of FUSE Message Broker is provided with the latest FUSE ESB release (FUSE ESB 4.1.0-psc-01-00RC1).

[selikoff]

Great, now if they just add a fix for  AMQ-1112 I'll be all set.  Thanks!