Mailing-List: contact users-help@activemq.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@activemq.apache.org
Date: Thu, 10 Mar 2016 17:14:48 +0100
From: Simon =?iso-8859-1?Q?Lundstr=F6m?= <simlu@su.se>
To: users@activemq.apache.org
Subject: Reloading users and groups properties on change
Message-ID: <20160310161448.GG519@kaka.it.su.se>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
User-Agent: Mutt/1.5.23 (2014-03-12)
Received-SPF: neutral (e-mailfilter01.sunet.se: 130.237.95.133 is neither
 permitted
	nor denied by domain simlu@su.se)
	receiver=e-mailfilter01.sunet.se; client-ip=130.237.95.133;
	envelope-from=<simlu@su.se>; helo=smtp.su.se;
	identity=mailfrom

Hi!

I talked to Gary Tully on IRC (and mail) and we decided it was best that
I mailed the mailinglist since he was pretty sure that someone here had
solved this.

We are running 5.13.0 and are trying to get {user,group}s.properties to
be reloaded automatically when they are changed.

In the init.d-script we've added:
ACTIVEMQ_OPTS+=" -Djava.security.auth.login.config=/local/activemq/conf/login.config "

and login.config looks like this:
activemq-domain {
  org.apache.activemq.jaas.PropertiesLoginModule required
    debug=true
    reload=true
    org.apache.activemq.jaas.properties.user="users.properties"
    org.apache.activemq.jaas.properties.group="../conf.d/approved/groups.properties"
  ;
};

users.properties:
system=manager
nagios=nagios

groups.properties:
monitoring=system

activemq.xml excerpt:
[…]
    <plugins>
      <!-- The configuration value matches the JAAS realm in login.config -->
      <jaasAuthenticationPlugin configuration="activemq-domain" />

      <!-- Enable hot reloading of the The configuration value matches the JAAS realm in login.config -->
      <runtimeConfigurationPlugin checkPeriod="0" />

      <authorizationPlugin>
         <map>
           <authorizationMap>
               <authorizationEntry
                 queue="aliveness-test"
                 read="monitoring"
                 write="monitoring"
                 admin="monitoring"
               />
             </authorizationEntries>
           </authorizationMap>
         </map>
       </authorizationPlugin>
[…]

With this configuration the user nagios should be able to access the queue aliveness-test.
To reproduce, modify groups.properties so it looks like:
monitoring=system,nagios

Check your logs (you need to enable debug logging on org.apache.activemq.jaas.ReloadableProperties):
{"thread":"ActiveMQ NIO Worker 622","level":"DEBUG","loggerName":"org.apache.activemq.jaas.ReloadableProperties","message":"Load of: PropsFile=/local/activemq/conf/../conf.d/approved/groups.properties"}
so the reloading works, but nagios still can't consume from (or produce to) the queue:
{"thread":"ActiveMQ NIO Worker 2","level":"WARN","loggerName":"org.apache.activemq.broker.TransportConnection.Service","message":"Security Error occurred on connection to: tcp://0:0:0:0:0:0:0:1:45357, User nagios is not authorized to read from: queue://aliveness-test"}

Note: If I restart ActiveMQ nagios can consume and produce from the
queue.

Is there any configuration that I've missed?
Is this a bug?

BR,
- Simon

____________________________________

Simon Lundström
Section for Infrastructure

IT Services
Stockholm University
SE-106 91 Stockholm, Sweden

www.su.se/english/staff-info/it