Red Hat JBoss Enterprise Application Platform Administration I

Red Hat JBoss Enterprise Application Platform (JBoss EAP) contains a message-oriented middleware (MOM) within the messaging-activemq subsystem. The messaging-activemq subsystem has the following security characteristics in the default configuration:

This default configuration allows developers to quickly deploy JMS applications and test them without worrying about security, and without leaving the JBoss EAP instance open to remote attacks. It also allows easy testing of remote JMS applications because the developer only needs to add users and roles to the ApplicationRealm security realm by using the add-user.sh script.

Most production environments probably require three changes:

These changes are implemented by the following commands:

/subsystem=messaging:/server=default/security-setting=#/rule=guest:remove

/subsystem=messaging:/server=default/security-setting=#:remove

After making those changes, the administrator has to either create security-setting objects granting the correct permissions to the roles associated with ActiveMQ application users, or add new roles to the existing all-destinations security-setting object.

It is important to understand that the ActiveMQ users and roles have no relationship with application users and roles. Remember that MOM is a server by itself. The ActiveMQ users and roles control application access to MOM destinations the same way that database users and roles control application access to the database tables.

The ActiveMQ MOM embedded in JBoss EAP does not configure access rules in destination objects. Access rules are configured in security-setting objects, which work much like the address-setting objects described in the Configuring the Messaging Subsystem chapter. The security-setting objects make easier configuring access rules for applications requiring multiple destinations in a consistent way.

A security-setting name is a wildcard expression that matches one or more destinations internal ActiveMQ names. Refer to the references section to learn more about the using expression wildcards for destinations.

A security-setting has child objects of type role. The name of this child object is the role name that is granted access, and its attributes are permissions. ActiveMQ understands the following permissions that loosely correspond to JMS API operations that can be performed on a destination:

There are no permissions specific for JMS Topic resources because they are implemented by ActiveMQ as a queue for each subscriber. If a client has the consume permission on the jms-topic object, then it has permission to subscribe to the object.

To grant permissions to a destination for a role, create the role object inside a security-setting object whose name matches the destination, and set the granted permission attributes to true. All other permissions are false by default.

For example, the following commands grant the send and consume permissions to the publisherAndConsumer role on the jms-topic named StockQuotes:

/subsystem=messaging-activemq/server=default/security-setting=\
jms.topic.StockQuotes.#:add()

/subsystem=messaging-activemq/server=default/security-setting=\
jms.topic.StockQuotes.#/role=publisherAndConsumer:add(\
send=true,consume=true)

If multiple security-setting objects match the same destination, then the most specific one overrides the generic ones. In the previous example, if the all-destinations (#) security-setting granted the manage permission to the publisherAndConsumer, role the jms.topic.StockQuotes.# security-setting denies it.