8.2. Example JAAS login module configurations
The following example shows a JAAS login module configuration that has both a properties login module and an LDAP login module configured. The properties login module references the default login module that contains the credentials used by the Operator to authenticate with the broker.
activemq {
org.apache.activemq.artemis.spi.core.security.jaas.LDAPLoginModule required
debug=true
initialContextFactory=com.sun.jndi.ldap.LdapCtxFactory
connectionURL="LDAP://localhost:389"
connectionUsername="CN=Administrator,CN=Users,OU=System,DC=example,DC=com"
connectionPassword=redhat.123
connectionProtocol=s
connectionTimeout="5000"
authentication=simple
userBase="dc=example,dc=com"
userSearchMatching="(CN={0})"
userSearchSubtree=true
readTimeout="5000"
roleBase="dc=example,dc=com"
roleName=cn
roleSearchMatching="(member={0})"
roleSearchSubtree=true;
org.apache.activemq.artemis.spi.core.security.jaas.PropertiesLoginModule
reload=true
org.apache.activemq.jaas.properties.user="artemis-users.properties"
org.apache.activemq.jaas.properties.role="artemis-roles.properties"
baseDir="/home/jboss/amq-broker/etc";
};The following example shows a JAAS login module configuration that has two properties login modules in separate realms.
-
The default properties login module is in a realm named
consoleand has the properties files that are used by the Operator and AMQ Management Console to authenticate with the broker. -
The login module in the
activemqrealm has new properties files, which, for example, could contain the credentials to authenticate users for messaging.
You might want to create separate realms to, for example, apply specific security controls to the realm that contains the login module used by the Operator to authenticate with the broker.
activemq {
org.apache.activemq.artemis.spi.core.security.jaas.PropertiesLoginModule
reload=true
org.apache.activemq.jaas.properties.user="new-users.properties"
org.apache.activemq.jaas.properties.role="new-roles.properties"
};
console {
org.apache.activemq.artemis.spi.core.security.jaas.PropertiesLoginModule
reload=true
org.apache.activemq.jaas.properties.user="artemis-users.properties"
org.apache.activemq.jaas.properties.role="artemis-roles.properties"
baseDir="/home/jboss/amq-broker/etc";
};
By default, AMQ Management Console uses the default properties login module in the activemq realm for authentication. If the default properties login module is configured in another realm, as in the example, you must set an environment variable in the broker CR to configure AMQ Management Console to use that realm. For example:
spec:
...
env:
- name: JAVA_ARGS_APPEND
value: --Hawtio.realm=console
...For more information about setting environment variables in a CR, see 第 4.9 节 “Setting environment variables for the broker containers”.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}