my jbm-queues.xml

<settings xmlns="urn:jboss:messaging"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="urn:jboss:messaging ../schemas/jbm-queues.xsd ">

 <!-- any user can have full control of generic topics -->
 <security match="jms.topic.#">
 <permission type="createDurableQueue" roles="user"/>
 <permission type="deleteDurableQueue" roles="user"/>
 <permission type="createTempQueue" roles="user"/>
 <permission type="deleteTempQueue" roles="user"/>
 <permission type="send" roles="user"/>
 <permission type="consume" roles="user"/>
 </security>

 <!-- only europe-user can create/delete any news.europe topics and pulish news to it. -->
 <security match="jms.topic.news.europe.#">
 <permission type="createDurableQueue" roles="user"/>
 <permission type="deleteDurableQueue" roles="user"/>
 <permission type="createTempQueue" roles="user"/>
 <permission type="deleteTempQueue" roles="user"/>
 <permission type="send" roles="europe-user"/>
 <permission type="consume" roles="news-user"/>
 </security>

 <!-- only us-user can create/delete any news.europe topics and pulish news to it. -->
 <security match="jms.topic.news.us.#">
 <permission type="createDurableQueue" roles="user"/>
 <permission type="deleteDurableQueue" roles="user"/>
 <permission type="createTempQueue" roles="user"/>
 <permission type="deleteTempQueue" roles="user"/>
 <permission type="send" roles="us-user"/>
 <permission type="consume" roles="news-user"/>
 </security>

</settings>

my jbm-users.xml

<deployment xmlns="urn:jboss:messaging" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="urn:jboss:messaging ../schemas/jbm-users.xsd ">

 <user name="bill" password="jbossmessaging">
 <role name="user"/>
 </user>

 <user name="andrew" password="jbossmessaging1">
 <role name="europe-user"/>
 <role name="user"/>
 </user>

 <user name="frank" password="jbossmessaging2">
 <role name="us-user"/>
 <role name="news-user"/>
 <role name="user"/>
 </user>

 <user name="sam" password="jbossmessaging3">
 <role name="news-user"/>
 <role name="user"/>
 </user>

</deployment>

and the jbm-jms.xml

<deployment xmlns="urn:jboss:messaging"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="urn:jboss:messaging ../schemas/jbm-jms.xsd ">
 <!--the connection factory used by the example-->
 <connection-factory name="ConnectionFactory">
 <connector-ref connector-name="netty-connector"/>
 <entries>
 <entry name="ConnectionFactory"/>
 <entry name="XAConnectionFactory"/>
 <entry name="java:/ConnectionFactory"/>
 <entry name="java:/XAConnectionFactory"/>
 </entries>
 </connection-factory>

 <topic name="genericTopic">
 <entry name="/topic/genericTopic"/>
 </topic>

 <topic name="news.europe.europeTopic">
 <entry name="/topic/europeTopic"/>
 </topic>

 <topic name="news.us.usTopic">
 <entry name="/topic/usTopic"/>
 </topic>

</deployment>

Thanks Andy, I have checked in the current work.

Hi Andy,

When you run ant, if you don't want the server output to mess the console up, you can do this:

ant | grep User

Thanks!

I tested, changing the order has no effect on the results.

Another thing is that the exceptions are thrown from a different thread than the calling thread. To check an unauthorized consume, for example, I have to send the message and check if the message is not received. But not being able to receive a message can happen with many reasons, it's not security specific.
And having the exception thrown on other thread make it harder to debug, as you cannot see from the stack trace any of your source code line numbers.

Thanks Tim. I change to blocking, the flow control seems a bit normal now. :)

Now I comment out some of the code, the example now stops at the first seemingly security violation against the configuration.
Now you will see the example shows that user frank can send messages to new.europe.europeTopic, which is against the security config, which says only 'europe-user' role can send messages, but frank doesn't belong to the role.