ActiveMQ Artemis JMX连接账号密码认证失效问题排查

我编写了一个通过JMX协议连接ActiveMQ Artemis broker的方法，传入用户名与密码参数，但认证功能未生效。即使将用户名和密码留空，仍能成功建立连接，我期望在用户凭证错误时，连接能抛出异常。

public static MBeanServerConnection connectBroker(String brokerUrl, String user, String password) {
    try {
        Map<String, String[]> env = new HashMap();
        String[] creds = {user, password};
        env.put(JMXConnector.CREDENTIALS, creds);
        JMXConnector connector = JMXConnectorFactory.connect(new JMXServiceURL("service:jmx:rmi:///jndi/rmi://" + brokerUrl + ":13682/jmxrmi"), env);
        return connector.getMBeanServerConnection();
    } catch (IOException e) {
        throw new RuntimeException(e);
    }
}

奇怪的是，即使传入CREDENTIALS仍能正常连接，我希望在用户不存在时触发错误。

broker.xml #

<configuration xmlns="urn:activemq" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:activemq /schema/artemis-configuration.xsd">
   <core xmlns="urn:activemq:core">
        <name>localhost</name>
      <bindings-directory>./data/messaging/bindings</bindings-directory>

      <journal-directory>./data/messaging/journal</journal-directory>

      <large-messages-directory>./data/messaging/largemessages</large-messages-directory>

      <paging-directory>./data/messaging/paging</paging-directory>


      <!-- true to expose ActiveMQ Artemis resources through JMX -->
      <jmx-management-enabled>true</jmx-management-enabled>

      <!-- Acceptors -->
      <acceptors>
         <acceptor name="netty">tcp://localhost:61616</acceptor>
      </acceptors>

      <!-- Other config -->

      <security-settings>
         <!--security for example queue-->
         <security-setting match="exampleQueue">
            <permission roles="amq" type="createDurableQueue"/>
            <permission roles="amq" type="deleteDurableQueue"/>
            <permission roles="amq" type="createNonDurableQueue"/>
            <permission roles="amq" type="deleteNonDurableQueue"/>
            <permission roles="amq" type="consume"/>
            <permission roles="amq" type="send"/>
            <permission roles="amq" type="browse"/>
         </security-setting>
         <security-setting match="TestQueue">
            <permission roles="amq" type="createDurableQueue"/>
            <permission roles="amq" type="deleteDurableQueue"/>
            <permission roles="amq" type="createNonDurableQueue"/>
            <permission roles="amq" type="deleteNonDurableQueue"/>
            <permission roles="amq" type="consume"/>
            <permission roles="amq" type="send"/>
         </security-setting>
         <security-setting match="TestQueueSecond">
            <permission roles="amq" type="createDurableQueue"/>
            <permission roles="amq" type="deleteDurableQueue"/>
            <permission roles="amq" type="createNonDurableQueue"/>
            <permission roles="amq" type="deleteNonDurableQueue"/>
            <permission roles="amq" type="consume"/>
            <permission roles="amq" type="send"/>
         </security-setting>
      </security-settings>

      <addresses>
         <address name="exampleQueue">
            <anycast>
               <queue name="exampleQueue"/>
            </anycast>
         </address>
         <address name="TestQueue">
            <anycast>
               <queue name="TestQueue"/>
            </anycast>
         </address>
         <address name="TestQueueSecond">
            <anycast>
               <queue name="TestQueueSecond"/>
            </anycast>
         </address>
      </addresses>
   </core>
</configuration>

management.xml #

<management-context xmlns="http://activemq.apache.org/schema">
   <connector connector-port="13682" connector-host="localhost"/>
   <authorisation>
      <allowlist>
         <entry domain="hawtio"/>
      </allowlist>
      <default-access>
         <access method="list*" roles="view,update,amq,guest"/>
         <access method="get*" roles="view,update,amq,guest"/>
         <access method="is*" roles="view,update,amq,guest"/>
         <access method="set*" roles="update,amq,guest"/>
         <access method="*" roles="amq,guest"/>
      </default-access>
      <role-access>
         <match domain="org.apache.activemq.artemis">
            <access method="list*" roles="view,update,amq,guest"/>
            <access method="get*" roles="view,update,amq,guest"/>
            <access method="is*" roles="view,update,amq,guest"/>
            <access method="set*" roles="update,amq,guest"/>
            <access method="*" roles="amq,guest"/>
         </match>
         <!--example of how to configure a specific object-->
         <!--<match domain="org.apache.activemq.artemis" key="subcomponent=queues">
            <access method="list*" roles="view,update,amq"/>
            <access method="get*" roles="view,update,amq"/>
            <access method="is*" roles="view,update,amq"/>
            <access method="set*" roles="update,amq"/>
            <access method="*" roles="amq"/>
         </match>-->
      </role-access>
   </authorisation>
</management-context>

login.config #

activemq {
   org.apache.activemq.artemis.spi.core.security.jaas.PropertiesLoginModule sufficient
       debug=false
       reload=true
       org.apache.activemq.jaas.properties.user="artemis-users.properties"
       org.apache.activemq.jaas.properties.role="artemis-roles.properties";
    
   org.apache.activemq.artemis.spi.core.security.jaas.GuestLoginModule sufficient
       debug=false
       org.apache.activemq.jaas.guest.user="admin"
       org.apache.activemq.jaas.guest.role="amq";
};

问题根源在login.config的配置：GuestLoginModule被设为sufficient，意味着只要前面的PropertiesLoginModule认证失败，就会自动触发Guest登录，不管有没有提供凭证，都会用预设的admin用户和amq角色完成登录，所以不会抛出认证错误。

要实现凭证错误时触发异常，可按以下方式调整：

• 完全禁用匿名登录：直接删除GuestLoginModule相关配置，这样只有通过PropertiesLoginModule认证的合法用户才能连接：

  activemq {
     org.apache.activemq.artemis.spi.core.security.jaas.PropertiesLoginModule sufficient
         debug=false
         reload=true
         org.apache.activemq.jaas.properties.user="artemis-users.properties"
         org.apache.activemq.jaas.properties.role="artemis-roles.properties";
  };
  

• 保留匿名登录但仅在无凭证时生效：将GuestLoginModule的sufficient改为requisite，并添加org.apache.activemq.jaas.guest.onlyAuthenticated=false参数，这样只有当未提供任何凭证时才走Guest登录，若提供错误凭证则直接认证失败：

  activemq {
     org.apache.activemq.artemis.spi.core.security.jaas.PropertiesLoginModule sufficient
         debug=false
         reload=true
         org.apache.activemq.jaas.properties.user="artemis-users.properties"
         org.apache.activemq.jaas.properties.role="artemis-roles.properties";
     
     org.apache.activemq.artemis.spi.core.security.jaas.GuestLoginModule requisite
         debug=false
         org.apache.activemq.jaas.guest.user="admin"
         org.apache.activemq.jaas.guest.role="amq"
         org.apache.activemq.jaas.guest.onlyAuthenticated=false;
  };
  

调整后重启ActiveMQ Artemis broker，配置即可生效。此时传入错误用户名密码时，会直接抛出认证异常，符合预期。

内容的提问来源于stack exchange，提问作者user21871375