Mailing-List: contact users-help@activemq.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@activemq.apache.org
Received-SPF: pass (nike.apache.org: domain of chubrilo@gmail.com designates
 209.85.215.171 as permitted sender)
MIME-Version: 1.0
Sender: chubrilo@gmail.com
In-Reply-To: <20120618215512.GA14655@iniquitous.heresiarch.ca>
References: <20120618215512.GA14655@iniquitous.heresiarch.ca>
Date: Tue, 19 Jun 2012 16:05:27 +0200
Message-ID: 
 <CAGeh-pFZiYeOfg9pvY1TGBEiQS6zfPPAgHzDDzF7HrNcMebfew@mail.gmail.com>
Subject: Re: ldap, system user can't create a topic
From: Dejan Bosanac <dejan@nighttale.net>
To: users@activemq.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hi,

this might help

http://tmielke.blogspot.com/2011/12/activemq-ldap-based-authentication-and.=
html

also you can consider using new CachedLDAPAuthorizationModule

http://activemq.apache.org/cached-ldap-authorization-module.html

Regards
--
Dejan Bosanac
Senior Software Engineer | FuseSource Corp.
dejanb@fusesource.com | fusesource.com
skype: dejan.bosanac | twitter: @dejanb
blog: http://www.nighttale.net
ActiveMQ in Action: http://www.manning.com/snyder/


On Mon, Jun 18, 2012 at 11:55 PM, Christopher Wood
<christopher_wood@pobox.com> wrote:
> What gives the "system" user permission to create topic://ActiveMQ.Adviso=
ry.Connection? Without this ActiveMQ will not start. (Working with 5.5.1 si=
nce 5.6.0 is a jump requiring further testing.)
>
> I'm getting this error (all pasted text munged slightly to obfuscate thin=
gs):
>
> 2012-06-18 17:35:46,941 | DEBUG | Error occured while processing sync com=
mand: ConnectionInfo {commandId =3D 1, responseRequired =3D true, connectio=
nId =3D ID:upuppet-01.lab.me.ca-56804-1340055346339-2:1, clientId =3D ID:up=
uppet.me-56804-1340055346339-3:1, userName =3D system, password =3D *****, =
brokerPath =3D null, brokerMasterConnector =3D false, manageable =3D true, =
clientMaster =3D true, faultTolerant =3D false}, exception: java.lang.Secur=
ityException: User system is not authorized to create: topic://ActiveMQ.Adv=
isory.Connection | org.apache.activemq.broker.TransportConnection.Service |=
 ActiveMQ Transport: tcp:///127.0.0.1:50328
>
> The system user is in the admin and users groups.
>
> This is my plugin config:
>
>
> <authorizationPlugin>
> =A0<map>
> =A0 =A0<bean xmlns=3D"http://www.springframework.org/schema/beans" id=3D"=
lDAPAuthorizationMap"
> =A0 =A0 =A0 =A0 =A0class=3D"org.apache.activemq.security.LDAPAuthorizatio=
nMap">
> =A0 =A0 =A0<property name=3D"initialContextFactory" value=3D"com.sun.jndi=
.ldap.LdapCtxFactory"/>
> =A0 =A0 =A0<property name=3D"connectionURL" value=3D"ldap://ldap.me:389"/=
>
> =A0 =A0 =A0<property name=3D"authentication" value=3D"simple"/>
> =A0 =A0 =A0<property name=3D"connectionUsername" value=3D"cn=3Dmqbroker,o=
u=3Dservices,o=3Dme"/>
> =A0 =A0 =A0<property name=3D"connectionPassword" value=3D"me"/>
> =A0 =A0 =A0<property name=3D"connectionProtocol" value=3D"s"/>
> =A0 =A0 =A0<property name=3D"topicSearchMatchingFormat" value=3D"cn=3D{0}=
,ou=3DTopic,ou=3DDestination,ou=3DActiveMQ,ou=3Dsystems,o=3Dme"/>
> =A0 =A0 =A0<property name=3D"topicSearchSubtreeBool" value=3D"true"/>
> =A0 =A0 =A0<property name=3D"queueSearchMatchingFormat" value=3D"cn=3D{0}=
,ou=3DQueue,ou=3DDestination,ou=3DActiveMQ,ou=3Dsystems,o=3Dme"/>
> =A0 =A0 =A0<property name=3D"queueSearchSubtreeBool" value=3D"true"/>
> =A0 =A0 =A0<property name=3D"adminBase" value=3D"(cn=3Dadmin)"/>
> =A0 =A0 =A0<property name=3D"adminAttribute" value=3D"member"/>
> =A0 =A0 =A0<!-- <property name=3D"adminAttributePrefix" value=3D"cn=3D"/>=
 -->
> =A0 =A0 =A0<property name=3D"readBase" value=3D"(cn=3Dread)"/>
> =A0 =A0 =A0<property name=3D"readAttribute" value=3D"member"/>
> =A0 =A0 =A0<!-- <property name=3D"readAttributePrefix" value=3D"cn=3D"/> =
=A0-->
> =A0 =A0 =A0<property name=3D"writeBase" value=3D"(cn=3Dwrite)"/>
> =A0 =A0 =A0<property name=3D"writeAttribute" value=3D"member"/>
> =A0 =A0 =A0<!-- <property name=3D"writeAttributePrefix" value=3D"cn=3D"/>=
 =A0-->
> =A0 =A0</bean>
> =A0</map>
> </authorizationPlugin>
>
>
> These are the advisory topic configs I have right now (I thought .> meant=
 access to the namespace?):
>
>
> # ActiveMQ.Advisory.>, topic, destination, activemq, systems, me
> dn: cn=3DActiveMQ.Advisory.>,ou=3Dtopic,ou=3Ddestination,ou=3Dactivemq,ou=
=3Dsystems,o=3Dme
> cn: ActiveMQ.Advisory.>
> description: user access to advisory topics
> objectClass: applicationProcess
>
> # read, ActiveMQ.Advisory.>, topic, destination, activemq, systems, me
> dn: cn=3Dread,cn=3DActiveMQ.Advisory.>,ou=3Dtopic,ou=3Ddestination,ou=3Da=
ctivemq,ou=3Dsystems,o=3Dme
> cn: read
> member: cn=3Dusers
> objectClass: groupOfNames
>
> # write, ActiveMQ.Advisory.>, topic, destination, activemq, systems, me
> dn: cn=3Dwrite,cn=3DActiveMQ.Advisory.>,ou=3Dtopic,ou=3Ddestination,ou=3D=
activemq,ou=3Dsystems,o=3Dme
> cn: write
> member: cn=3Dusers
> objectClass: groupOfNames
>
> # admin, ActiveMQ.Advisory.>, topic, destination, activemq, systems, me
> dn: cn=3Dadmin,cn=3DActiveMQ.Advisory.>,ou=3Dtopic,ou=3Ddestination,ou=3D=
activemq,ou=3Dsystems,o=3Dme
> cn: admin
> member: cn=3Dusers
> objectClass: groupOfNames
>
> # ActiveMQ.Advisory.Connection, topic, destination, activemq, systems, me
> dn: cn=3DActiveMQ.Advisory.Connection,ou=3Dtopic,ou=3Ddestination,ou=3Dac=
tivemq,ou=3Dsystems,o=3Dme
> cn: ActiveMQ.Advisory.Connection
> description: user access to advisory topics
> objectClass: applicationProcess
>
> # read, ActiveMQ.Advisory.Connection, topic, destination, activemq, syste=
ms, me
> dn: cn=3Dread,cn=3DActiveMQ.Advisory.Connection,ou=3Dtopic,ou=3Ddestinati=
on,ou=3Dactivemq,ou=3Dsystems,o=3Dme
> cn: read
> member: cn=3Dadmin
> objectClass: groupOfNames
>
> # write, ActiveMQ.Advisory.Connection, topic, destination, activemq, syst=
ems, me
> dn: cn=3Dwrite,cn=3DActiveMQ.Advisory.Connection,ou=3Dtopic,ou=3Ddestinat=
ion,ou=3Dactivemq,ou=3Dsystems,o=3Dme
> cn: write
> member: cn=3Dadmin
> objectClass: groupOfNames
>
> # admin, ActiveMQ.Advisory.Connection, topic, destination, activemq, syst=
ems, me
> dn: cn=3Dadmin,cn=3DActiveMQ.Advisory.Connection,ou=3Dtopic,ou=3Ddestinat=
ion,ou=3Dactivemq,ou=3Dsystems,o=3Dme
> cn: admin
> member: cn=3Dadmin
> objectClass: groupOfNames
>
>