このコンテンツは選択した言語では利用できません。
8.7. Tutorial: Enable LDAP Authorization in the Broker
Overview
This section explains how to enable LDAP authorization in the broker, so that the broker obtains its authorization data from the directory server.
Compatibility with Apache Karaf principals
In order to avoid unnecessary duplication of user data, this LDAP authorization example reuses the user and role data already created for the Apache Karaf JAAS authentication plug-in (as described in Section 8.3, “Add User Entries to the Directory Server”). This affects the broker's LDAP authorization plug-in configuration, as follows:
- When you create authorization entries in the LDAP server (as described in Section 8.6, “Tutorial: Add Authorization Entries”), you must specify the full DN of the roles that are being authorized. This enables you to specify roles from any location in the LDAP tree (previously, the LDAP authorization plug-in could only read roles from a fixed location under the
ou=ActiveMQ,ou=systemnode). - To enable the use of full DNs when specifying roles, you must set the
legacyGroupMappingproperty tofalsein the LDAP authorization plug-in (the default istrue). - Because the Apache Karaf roles are of a different type from the roles natively supported by the LDAP authorization plug-in, you must also specify the type of the Karaf roles, by setting the
groupClassproperty.
Enable LDAP authorization in the broker
Perform the following steps to enable LDAP authorization:
- Shut down the JBoss A-MQ container, if it is currently running. In the console window, enter the following command:
JBossA-MQ:karaf@root> shutdown -f
- Add the LDAP authorization plug-in to the broker configuration. Open the broker configuration file,
InstallDir/etc/activemq.xml, with a text editor and add theauthorizationPluginelement, as follows:<beans ...> <broker ...> ... <plugins> ... <authorizationPlugin> <map> <cachedLDAPAuthorizationMap connectionURL="ldap://localhost:10389" connectionUsername="uid=admin,ou=system" connectionPassword="secret" queueSearchBase="ou=Queue,ou=Destination,ou=ActiveMQ,ou=system" topicSearchBase="ou=Topic,ou=Destination,ou=ActiveMQ,ou=system" tempSearchBase="ou=Temp,ou=Destination,ou=ActiveMQ,ou=system" refreshInterval="300000" legacyGroupMapping="false" groupClass="org.apache.karaf.jaas.boot.principal.RolePrincipal" /> </map> </authorizationPlugin> </plugins> ... </broker> </beans> - Ensure that the X.500 directory server is running. If necessary, manually restart the X.500 directory server—see Section 8.2, “Set-up a Directory Server and Browser”. If the server is not running, all broker connections will fail.
- Restart the JBoss A-MQ container. Open a new command prompt and start the broker by entering the following command:
amq
Install the Apache ActiveMQ kit
For testing purposes, it is useful to install the Apache ActiveMQ example producer and consumer clients. These example clients are not provided directly in the JBoss A-MQ package. But you can obtain the sample clients by installing the Apache ActiveMQ kit,
apache-activemq-5.8.0.redhat-60024-bin.zip, provided in the extras/ directory of the JBoss A-MQ installation.
Install the Apache ActiveMQ kit as follows:
- Find the Apache ActiveMQ kit at the following location:
InstallDir/extras/apache-activemq-5.8.0.redhat-60024-bin.zip
- Using a suitable archive utility on your platform, unzip the
apache-activemq-5.8.0.redhat-60024-bin.zipfile and extract it to a convenient location,ActiveMQInstallDir.
Test the new configuration
To test the new configuration, run the example consumer and producer clients as follows:
- Run the consumer client with the
jdoeuser credentials. Open a new command prompt, change directory toActiveMQInstallDir/example, and enter the following Ant command:ant consumer -Durl=tcp://localhost:61616 -Dmax=100 -Duser=jdoe -Dpassword=secret
- Run the producer client with the
jdoeuser credentials. Open a new command prompt, change directory toActiveMQInstallDir/example, and enter the following Ant command:ant producer -Durl=tcp://localhost:61616 -Dmax=100 -Duser=jdoe -Dpassword=secret
- Run a negative test, to demonstrate that unauthorized users are blocked from accessing the broker queues.Run the consumer client with the
janedoeuser credentials. Open a new command prompt, change directory toActiveMQInstallDir/example, and enter the following Ant command:ant consumer -Durl=tcp://localhost:61616 -Dmax=100 -Duser=janedoe -Dpassword=secret
This time, the consumer client fails, becausejanedoedoes not belong to theadmingroup.
