You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@activemq.apache.org by Shine <ac...@club.webhop.org> on 2013/09/18 15:27:12 UTC

Secure all queues start with a 't'

Hi,

is it possible to secure all queues start with a "t" with the Simple
Authentication Plug-In?

Only one special defined user (authenticationUser) needs to get access to
all queues with a name like "test1", "test2", "testX".

I tried something like
<authorizationEntry queue=&quot;t*&quot; ...
&lt;authorizationEntry queue=&quot;t*>" ...
<authorizationEntry queue="t>" ...





--
View this message in context: http://activemq.2283324.n4.nabble.com/Secure-all-queues-start-with-a-t-tp4671602.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.

Re: Secure all queues start with a 't'

Posted by Shine <ac...@club.webhop.org>.
Hi,

it does not work. the configuration:

            <simpleAuthenticationPlugin>
                <users>
                    <authenticationUser username="WWUser"
password="1234567890" groups="wwclients"/>
                    <authenticationUser username="system"
password="${activemq.password}" groups="users,admins"/>
					
                </users>
            </simpleAuthenticationPlugin>
    
          
          <authorizationPlugin>
            <map>
              <authorizationMap>
                <authorizationEntries>
                  <authorizationEntry queue="t*" read="wwclients"
write="wwclients" admin="wwclients" />
					
                  
                  <authorizationEntry topic=">" read="admins" write="admins"
admin="admins" />
                  
                  <authorizationEntry topic="ActiveMQ.Advisory.>"
read="guests,users,wwclients" write="guests,users,wwclients"
admin="guests,users,wwclients"/>
                </authorizationEntries>
              </authorizationMap>
            </map>
          </authorizationPlugin>


if you use "WWUser" and try to write into the queue "testX", you get "User
xxx is not authorized to write to: queue://testX" 



--
View this message in context: http://activemq.2283324.n4.nabble.com/Secure-all-queues-start-with-a-t-tp4671602p4671702.html
Sent from the ActiveMQ - User mailing list archive at Nabble.com.

Re: Secure all queues start with a 't'

Posted by Torsten Mielke <tm...@redhat.com>.
Hello,

Well, you generally secure the entire broker for authentication (using the simple auth plugin).
You can however enable authorization in the broker as well and then configure authorization in a way that only your special user has access to this destination. 
Authorization is role based so you need to assign a unique role to your special user and grant read/write/admin rights to that role on your destination t*.
This should work.

Regards,

Torsten Mielke
tmielke@redhat.com
tmielke.blogspot.com

On Sep 18, 2013, at 3:27 PM, Shine wrote:

> Hi,
> 
> is it possible to secure all queues start with a "t" with the Simple
> Authentication Plug-In?
> 
> Only one special defined user (authenticationUser) needs to get access to
> all queues with a name like "test1", "test2", "testX".
> 
> I tried something like
> <authorizationEntry queue=&quot;t*&quot; ...
> &lt;authorizationEntry queue=&quot;t*>" ...
> <authorizationEntry queue="t>" ...
> 
> 
> 
> 
> 
> --
> View this message in context: http://activemq.2283324.n4.nabble.com/Secure-all-queues-start-with-a-t-tp4671602.html
> Sent from the ActiveMQ - User mailing list archive at Nabble.com.