-
|
I read from your documentation that is possible use different security domains for SSL connections and other connections such as Jolokia ones (via user name and password). Currently I created a custom JAAS module to manage TLS but I have some question on how to configure this behaviour. and I get this value from bootstrap.xml inside Artemis broker container <broker xmlns="http://activemq.apache.org/schema">
<jaas-security domain="activemq"/>
<server configuration="file:/home/jboss/amq-broker/etc//broker.xml"/>
<!-- The web server is only bound to localhost by default -->
<web customizer="org.eclipse.jetty.server.ForwardedRequestCustomizer" path="web" rootRedirectLocation="console">
<binding uri="http://exoo-ss-0.exoo-hdls-svc.oneconnectivity.svc.cluster.local:8161">
<app url="activemq-branding" war="activemq-branding.war"/>
<app url="artemis-plugin" war="artemis-plugin.war"/>
<app url="console" war="console.war"/>
</binding>
</web>
</broker>So what I would like to do is use classic username and password for everything related to JMX (e.g Jolokia and web console) and use my custom JAAS module for TLS connections. and change my login.config file with something like Is this correct? |
Beta Was this translation helpful? Give feedback.
Answered by
brusdev
Apr 6, 2023
Replies: 2 comments 13 replies
-
|
@lordigon ActiveMQ Artemis use the jaas domain defined in the You can define TestCertificateLoginModule in the my-jaas-config |
Beta Was this translation helpful? Give feedback.
12 replies
-
|
@lordigon your config LGTM, could you try the following working config? |
Beta Was this translation helpful? Give feedback.
-
|
@brusdev Same issue. These are the logs taken from the operator POD as you can see this logs is the same error. |
Beta Was this translation helpful? Give feedback.
-
|
@lordigon you are tight, I got the same issue and I fixed it using the correct role |
Beta Was this translation helpful? Give feedback.
-
|
@brusdev It works also on my side. Can you please give me a little bit of context about this configuration? The change you made was about the amq role. |
Beta Was this translation helpful? Give feedback.
-
|
@lordigon the operator uses the credentials in the credentials secret for the JMX connections, i.e. the credential secret for a CR with the name I added the The role in the The only way to change the |
Beta Was this translation helpful? Give feedback.
Answer selected by
brusdev
-
|
Just another question: probably I would have to add another acceptor for plain connections. TLS will be used for external (to k8s cluster) client and MQTT plain for internal one something like spec:
acceptors:
- expose: false
name: tcp-mqtt
port: 61616
protocols: MQTT
sslEnabled: false
- expose: true
name: mqtt-tls
needClientAuth: true
port: 61617
protocols: MQTT
sslEnabled: true
verifyHost: falsethis new acceptor will be influenced by the configuration you suggested? |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
Yes, security roles have a global scope but you could have a security domain per acceptor using broker properties, i.e. The port 61616 is used internally, for custom acceptors use other ports. |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
@lordigon ActiveMQ Artemis use the jaas domain defined in the
bootstrap.xml(jaas-security domain="activemq") file as default jaas domain to authenticate and authorize acceptor connections and the jaas domain defined in theartemis.profilefile (-Dhawtio.realm=activemq) to authenticate and authorize console/jolokia connections.You can define TestCertificateLoginModule in the
activemqdomain and PropertiesLoginModule in another domain, in this way you don't need to change hebootstrap.xmlfile, i.emy-jaas-config