You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@artemis.apache.org by "ASF GitHub Bot (Jira)" <ji...@apache.org> on 2026/04/09 17:40:00 UTC
[jira] [Work logged] (ARTEMIS-5949) Clarify manage permission in default broker.xml
[ https://issues.apache.org/jira/browse/ARTEMIS-5949?focusedWorklogId=1014330&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1014330 ]
ASF GitHub Bot logged work on ARTEMIS-5949:
-------------------------------------------
Author: ASF GitHub Bot
Created on: 09/Apr/26 17:39
Start Date: 09/Apr/26 17:39
Worklog Time Spent: 10m
Work Description: anmol-saxena-14 opened a new pull request, #6355:
URL: https://github.com/apache/artemis/pull/6355
Move the `manage` permission out of the wildcard `match="#"` security-setting and into a dedicated `match="activemq.management.#"` entry, along with the supporting permissions required for management operations (createNonDurableQueue, deleteNonDurableQueue, createAddress, deleteAddress, consume, send).
The old placement was imprecise: granting manage across all addresses is broader than necessary, since it is only meaningful on the management address.
The stale comment explaining the wildcard manage entry is also removed.
Changes:
- artemis-cli broker.xml template (used by `artemis create`)
- artemis-features artemis.xml
- jmx-rbac-broker-security smoke-test fixture (aligned to new default)
- ArtemisTest:add testDefaultSecuritySettings to assert the generated broker.xml has manage only on activemq.management.# and not on #
Issue Time Tracking
-------------------
Worklog Id: (was: 1014330)
Remaining Estimate: 0h
Time Spent: 10m
> Clarify manage permission in default broker.xml
> -----------------------------------------------
>
> Key: ARTEMIS-5949
> URL: https://issues.apache.org/jira/browse/ARTEMIS-5949
> Project: Artemis
> Issue Type: Task
> Reporter: Justin Bertram
> Assignee: Justin Bertram
> Priority: Major
> Labels: pull-request-available
> Time Spent: 10m
> Remaining Estimate: 0h
>
> When the {{create}} command is used to create a broker instance the {{broker.xml}} contains this:
> {code:xml}
> <security-settings>
> <security-setting match="#">
> <permission type="createNonDurableQueue" roles="amq"/>
> <permission type="deleteNonDurableQueue" roles="amq"/>
> <permission type="createDurableQueue" roles="amq"/>
> <permission type="deleteDurableQueue" roles="amq"/>
> <permission type="createAddress" roles="amq"/>
> <permission type="deleteAddress" roles="amq"/>
> <permission type="consume" roles="amq"/>
> <permission type="browse" roles="amq"/>
> <permission type="send" roles="amq"/>
> <!-- we need this otherwise ./artemis data imp wouldn't work -->
> <permission type="manage" roles="amq"/>
> </security-setting>
> </security-settings>{code}
> Applying the {{manage}} role to {{#}} works, but it is imprecise and potentially confusing. This permission should only be applied to the *management address*. We can also remove the comment as I don't believe it's necessary. Therefore, the default {{security-settings}} should look something like this:
> {code:xml}
> <security-settings>
> <security-setting match="#">
> <permission type="createNonDurableQueue" roles="amq"/>
> <permission type="deleteNonDurableQueue" roles="amq"/>
> <permission type="createDurableQueue" roles="amq"/>
> <permission type="deleteDurableQueue" roles="amq"/>
> <permission type="createAddress" roles="amq"/>
> <permission type="deleteAddress" roles="amq"/>
> <permission type="consume" roles="amq"/>
> <permission type="browse" roles="amq"/>
> <permission type="send" roles="amq"/>
> </security-setting>
> <security-setting match="activemq.management.#">
> <permission type="manage" roles="amq"/>
> <permission type="createNonDurableQueue" roles="amq"/>
> <permission type="deleteNonDurableQueue" roles="amq"/>
> <permission type="createAddress" roles="amq"/>
> <permission type="deleteAddress" roles="amq"/>
> <permission type="consume" roles="amq"/>
> <permission type="send" roles="amq"/>
> </security-setting>
> </security-settings>{code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@artemis.apache.org
For additional commands, e-mail: issues-help@artemis.apache.org