You are viewing a plain text version of this content. The canonical link for it is here.
Posted to gitbox@activemq.apache.org by GitBox <gi...@apache.org> on 2022/03/27 19:25:54 UTC
[GitHub] [activemq-artemis] ViliusS opened a new pull request #4001: Improve ActiveMQBasicSecurityManager documentation
ViliusS opened a new pull request #4001:
URL: https://github.com/apache/activemq-artemis/pull/4001
From the answers kindly provided by Justin on the mailing list, I have reworded some ActiveMQBasicSecurityManager configuration description. Also, added additional information which could be relevant for others.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [activemq-artemis] ViliusS commented on a change in pull request #4001: Improve ActiveMQBasicSecurityManager documentation
Posted by GitBox <gi...@apache.org>.
ViliusS commented on a change in pull request #4001:
URL: https://github.com/apache/activemq-artemis/pull/4001#discussion_r839182191
##########
File path: docs/user-manual/en/security.md
##########
@@ -1221,6 +1221,11 @@ management performed on the live broker will be reflected on the backup upon
failover. Typically LDAP would be employed for this kind of use-case, but not
everyone wants or is able to administer an independent LDAP server.
+> **Note:**
+>
+> `ActiveMQBasicSecurityManager` works only with standalone broker
+> configuration or with live/backup clusters. It won't work with multiple lives.
+
Review comment:
You mean like JAAS _PropertiesLogin_ manager? Because at least from my test PropertiesLogin module doesn't propagate credentials even to backup so it's not the same.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [activemq-artemis] ViliusS commented on a change in pull request #4001: Improve ActiveMQBasicSecurityManager documentation
Posted by GitBox <gi...@apache.org>.
ViliusS commented on a change in pull request #4001:
URL: https://github.com/apache/activemq-artemis/pull/4001#discussion_r839182191
##########
File path: docs/user-manual/en/security.md
##########
@@ -1221,6 +1221,11 @@ management performed on the live broker will be reflected on the backup upon
failover. Typically LDAP would be employed for this kind of use-case, but not
everyone wants or is able to administer an independent LDAP server.
+> **Note:**
+>
+> `ActiveMQBasicSecurityManager` works only with standalone broker
+> configuration or with live/backup clusters. It won't work with multiple lives.
+
Review comment:
You mean like JAAS _PropertiesLogin_ manager?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [activemq-artemis] jbertram commented on a change in pull request #4001: Improve ActiveMQBasicSecurityManager documentation
Posted by GitBox <gi...@apache.org>.
jbertram commented on a change in pull request #4001:
URL: https://github.com/apache/activemq-artemis/pull/4001#discussion_r839737850
##########
File path: docs/user-manual/en/security.md
##########
@@ -1221,6 +1221,11 @@ management performed on the live broker will be reflected on the backup upon
failover. Typically LDAP would be employed for this kind of use-case, but not
everyone wants or is able to administer an independent LDAP server.
+> **Note:**
+>
+> `ActiveMQBasicSecurityManager` works only with standalone broker
+> configuration or with live/backup clusters. It won't work with multiple lives.
+
Review comment:
To be clear, the `PropertiesLoginModule` is a login module used with the JAAS security manager. There is no such thing as a "JAAS PropertiesLogin manager."
Regarding the basic security manager your documentation update says, "It won't work with multiple lives." My point is that the basic security manager works _exactly_ like the JAAS security manager in regard to multiple lives. _Neither one_ will propagate credentials around the cluster. Furthermore, you say, "...works only with standalone broker configuration..." Again, this is unclear because you _can_ use the basic security manager in a cluster just like you can with the JAAS security manager. The **main use** (if not the only use) where the basic security manager makes sense is with a single live/backup pair.
The documentation already explains this fact saying:
> All user & role data is stored in the bindings journal (or bindings table if using JDBC). The advantage here is that in a live/backup use-case any user management performed on the live broker will be reflected on the backup upon failover.
Although perhaps it could be stated more strongly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [activemq-artemis] ViliusS commented on a change in pull request #4001: Improve ActiveMQBasicSecurityManager documentation
Posted by GitBox <gi...@apache.org>.
ViliusS commented on a change in pull request #4001:
URL: https://github.com/apache/activemq-artemis/pull/4001#discussion_r841233217
##########
File path: docs/user-manual/en/security.md
##########
@@ -1221,6 +1221,11 @@ management performed on the live broker will be reflected on the backup upon
failover. Typically LDAP would be employed for this kind of use-case, but not
everyone wants or is able to administer an independent LDAP server.
+> **Note:**
+>
+> `ActiveMQBasicSecurityManager` works only with standalone broker
+> configuration or with live/backup clusters. It won't work with multiple lives.
+
Review comment:
I ment JAAS security manager _when using PropertiesLogin module_. All of the security managers work in a cluster per se obviously, but it doesn't mean that the result for the end user/Artemis administrator is the same. At least during my tests credential propagation works three different ways:
1. ActiveMQBasicSecurityManager propagates credentials in live/backup pair but not on other lives.
2. JAAS security manager with PropertiesLogin module doesn't propagate credentials at all because (at least by default) properties files are stored on one node.
3. JAAS security manager with LDAP module can be used with multiple lives and backups.
All of these can be unclear for newcomers since they do not know how exactly Artemis internals work. That's why I think it is a good idea to mention this somewhere.
I will try to reword my patch a bit.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [activemq-artemis] michaelandrepearce commented on a change in pull request #4001: Improve ActiveMQBasicSecurityManager documentation
Posted by GitBox <gi...@apache.org>.
michaelandrepearce commented on a change in pull request #4001:
URL: https://github.com/apache/activemq-artemis/pull/4001#discussion_r841254404
##########
File path: docs/user-manual/en/security.md
##########
@@ -1221,6 +1221,11 @@ management performed on the live broker will be reflected on the backup upon
failover. Typically LDAP would be employed for this kind of use-case, but not
everyone wants or is able to administer an independent LDAP server.
+> **Note:**
+>
+> `ActiveMQBasicSecurityManager` works only with standalone broker
+> configuration or with live/backup clusters. It won't work with multiple lives.
+
Review comment:
Its not clustered it is a local file, but if youre using a mechanism to auto configure your brokers like ansible or use rsync then you can easily keep the files in sync. Its not different than needing to keep all other config in sync in a clustered artemis setup.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [activemq-artemis] jbertram commented on a change in pull request #4001: Improve ActiveMQBasicSecurityManager documentation
Posted by GitBox <gi...@apache.org>.
jbertram commented on a change in pull request #4001:
URL: https://github.com/apache/activemq-artemis/pull/4001#discussion_r838735438
##########
File path: docs/user-manual/en/security.md
##########
@@ -1221,6 +1221,11 @@ management performed on the live broker will be reflected on the backup upon
failover. Typically LDAP would be employed for this kind of use-case, but not
everyone wants or is able to administer an independent LDAP server.
+> **Note:**
+>
+> `ActiveMQBasicSecurityManager` works only with standalone broker
+> configuration or with live/backup clusters. It won't work with multiple lives.
+
Review comment:
This statement is unclear. The basic security manager *will* work in a cluster. It just won't propagate credentials around the cluster of live brokers like it will to its backup. It will work just like the JAAS security manager.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@activemq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org