3 Replies Latest reply on Sep 13, 2016 8:01 PM by arielcarrera

    Wildfly - Artemis MQ - Cluster - Security

    arielcarrera

      I have a wildfly 10.1.0.Final in domain mode with a full-ha profile.

      I configured an embedded activemq artemis using a shared-store-master and slave.

      When I try to connect my client using a RemoteConnection I get the following exception:

       

       

      [Server:pjn-services-one] 16:42:25,862 ERROR [org.apache.activemq.artemis.core.server] (default I/O-1) AMQ224018: Failed to create session: ActiveMQSecurityException[errorType=SECURITY_EXCEPTION message=AMQ119031: Unable to validate user: null]

      [Server:pjn-services-one]       at org.apache.activemq.artemis.core.security.impl.SecurityStoreImpl.authenticate(SecurityStoreImpl.java:135)

      [Server:pjn-services-one]       at org.apache.activemq.artemis.core.server.impl.ActiveMQServerImpl.createSession(ActiveMQServerImpl.java:988)

      [Server:pjn-services-one]       at org.apache.activemq.artemis.core.protocol.core.impl.ActiveMQPacketHandler.handleCreateSession(ActiveMQPacketHandler.java:153)

       

       

      I see that it can be a bug and it is solved at [ARTEMIS-250] Scale down fails with ActiveMQSecurityException - ASF JIRA

       

       

      When will be merged in GitHub - rh-messaging/jboss-activemq-artemis: Mirror of Apache ActiveMQ Artemis  and it will be included in Wildfly modules?

        • 1. Re: Wildfly - Artemis MQ - Cluster - Security
          jbertram

          Unless you are attempting to scale-down (which it doesn't appear that you are) then ARTEMIS-250 is not related to your problem.

           

          It looks to me like you simply aren't providing the proper credentials from your client when you attempt to connect or it could be that your server-side security is misconfigured.

          • 2. Re: Wildfly - Artemis MQ - Cluster - Security
            arielcarrera

            Hi Justin! Maybe you are right... I 've done the following steps:

            I added a role mapping to my domain controller configuration "application-roles.properties":

            mquser=guest

            I added a user to my domain controller configuration "application-users.properties":

            mquser=50d1be8.....................

             

            I changed the messaging subsytem configuration with:

                        <subsystem xmlns="urn:jboss:domain:messaging-activemq:1.0">

                            <server name="default">

                                <cluster user="${jboss.messaging.cluster.user:mquser}" password="${jboss.messaging.cluster.password:mypass}"/>

                                <shared-store-slave failover-on-server-shutdown="true"/>

                                <bindings-directory path="/home/store/journal/bindings"/>

                                <journal-directory path="/home/store/journal/journal"/>

                                <large-messages-directory path="/home/store/journal/largemessages"/>

                                <paging-directory path="/home/store/journal/paging"/>

                                <security-setting name="#">

                                    <role name="guest" send="true" consume="true" create-durable-queue="true" delete-durable-queue="true" create-non-durable-queue="true" delete-non-durable-queue="true"/>

                                </security-setting>

                                <address-setting name="#" dead-letter-address="jms.queue.DLQ" expiry-address="jms.queue.ExpiryQueue" max-size-bytes="10485760" page-size-bytes="2097152" message-counter-history-day-limit="10" redistribution-delay="1000"/>

                                <address-setting name="jms.queue.MyQueue"/>

                                <address-setting name="jms.topic.MyTopic"/>

                                <http-connector name="http-connector" socket-binding="http" endpoint="http-acceptor"/>

                                <http-connector name="http-connector-throughput" socket-binding="http" endpoint="http-acceptor-throughput">

                                    <param name="batch-delay" value="50"/>

                                </http-connector>

                                <in-vm-connector name="in-vm" server-id="0"/>

                                <http-acceptor name="http-acceptor" http-listener="default"/>

                                <http-acceptor name="http-acceptor-throughput" http-listener="default">

                                    <param name="batch-delay" value="50"/>

                                    <param name="direct-deliver" value="false"/>

                                </http-acceptor>

                                <in-vm-acceptor name="in-vm" server-id="0"/>

                                <broadcast-group name="bg-group1" jgroups-channel="activemq-cluster" connectors="http-connector"/>

                                <discovery-group name="dg-group1" jgroups-stack="udp" jgroups-channel="activemq-cluster" refresh-timeout="1000"/>

                                <cluster-connection name="my-cluster" address="jms" connector-name="http-connector" discovery-group="dg-group1"/>

                                <jms-queue name="ExpiryQueue" entries="java:/jms/queue/ExpiryQueue"/>

                                <jms-queue name="DLQ" entries="java:/jms/queue/DLQ"/>

                                <jms-queue name="MyQueue" entries="java:/jms/queue/MyQueue"/>

                                <jms-topic name="MyTopic" entries="java:/jms/queue/MyTopic"/>

                                <connection-factory name="InVmConnectionFactory" entries="java:/ConnectionFactory" connectors="in-vm" client-id="my-client"/>

                                <connection-factory name="RemoteConnectionFactory" entries="java:jboss/exported/jms/RemoteConnectionFactory" connectors="http-connector" ha="true" client-id="my-client" block-on-acknowledge="true" reconnect-attempts="-1"/>

                                <pooled-connection-factory name="activemq-ra" entries="java:/JmsXA java:jboss/DefaultJMSConnectionFactory" connectors="in-vm" client-id="my-client" transaction="xa"/>

                            </server>

                        </subsystem>

             

            And I changed my client application to produce a connection factory bean like this:

            @Produces @Named("ClusteredConnectionFactory")

            public ConnectionFactory create() {

            String url = System.getProperty("broker.url");

            String user = System.getProperty("user");

            String password = System.getProperty("password");

                try {

                    final Properties env = new Properties();

                    env.put(Context.INITIAL_CONTEXT_FACTORY, "org.jboss.naming.remote.client.InitialContextFactory");

                    env.put(Context.PROVIDER_URL, url);

                    if (user != null) {

                    env.put(Context.SECURITY_PRINCIPAL, user);

                    env.put(Context.SECURITY_CREDENTIALS, password);

                    }

                    InitialContext ic = new InitialContext(env);

                    return (ConnectionFactory) ic.lookup("jms/RemoteConnectionFactory");

                }

                catch (Exception e) {

                    e.printStackTrace();

                    return null;

                }

            }

             

            Do you know if I missed something to do?

            • 3. Re: Wildfly - Artemis MQ - Cluster - Security
              arielcarrera

              You are right the problem was that my credentials are lost when I use my connection factory with apache camel. I put it in the camel component and it works.

              Thanks.