Custom login module from -jaas-config extraMount doesn't working

[john9x]

Describe the bug Hi!

Custom login module from -jaas-config extraMount doesn't working. some_user and another_user can't login to Artemis and I don't understand why. I see mounted files in the pods and don't see any problems in the logs.

apiVersion: v1
kind: Secret
metadata:
  name: artemis-jaas-config
stringData:
  login.config: |
    activemq {
            // ensure the operator can connect to the broker by referencing the existing properties config
            org.apache.activemq.artemis.spi.core.security.jaas.PropertiesLoginModule sufficient
                org.apache.activemq.jaas.properties.user="artemis-users.properties"
                org.apache.activemq.jaas.properties.role="artemis-roles.properties"
                baseDir="/home/jboss/amq-broker/etc";

            org.apache.activemq.artemis.spi.core.security.jaas.PropertiesLoginModule sufficient
                reload=true
                org.apache.activemq.jaas.properties.user="users.properties"
                org.apache.activemq.jaas.properties.role="roles.properties";

    };

  users.properties: |
    some_user = pass
    another_user = pass

  roles.properties: |
    admin = admin, some_user 
    some_role = another_user 

---
apiVersion: broker.amq.io/v1beta1
kind: ActiveMQArtemis
metadata:
  name: artemis-broker
spec:
  deploymentPlan:
    size: 2
    persistenceEnabled: true
    messageMigration: true
    requireLogin: true
    extraMounts:
      - secrets:
          - artemis-jaas-config

This works fine but with deprecation warning.

---
apiVersion: broker.amq.io/v1beta1
kind: ActiveMQArtemisSecurity
metadata:
  name: artemis-security
spec:
  applyToCrNames:
    - "*"
  securityDomains:
    brokerDomain:
      name: 'activemq'
      loginModules:
        - name: "artemis-users"
          flag: sufficient
          reload: true
  loginModules:
    propertiesLoginModules:
      - name: "artemis-users"
        users:
          - name: some_user
            password: pass
            roles:
              - admin
          - name: another_user
            password: pass
            roles:
              - some_role

Also I can't find any docs how to use spec.brokerProperties to configure security settings like this

apiVersion: broker.amq.io/v1beta1
kind: ActiveMQArtemisSecurity
metadata:
  name: artemis-security
spec:
  securitySettings:
    broker:
      - match: "#"
        permissions:
          - operationType: createNonDurableQueue
            roles:
              - admin
          - operationType: deleteNonDurableQueue
            roles:
              - admin
          - operationType: createDurableQueue
            roles:
              - admin
          - operationType: deleteDurableQueue
            roles:
              - admin
          - operationType: createAddress
            roles:
              - admin
          - operationType: deleteAddress
            roles:
              - admin
          - operationType: consume
            roles:
              - admin
          - operationType: browse
            roles:
              - admin
          - operationType: send
            roles:
              - admin
          - operationType: manage
            roles:
              - admin

[!TIP] Vote this issue reacting with :+1: or :-1:

[gtully]

There are some examples in the tests that can help here, the properties provide a way to configure the broker internal configuration beans via properties. The patterns reflect the organisation of those beans which makes it tricky to figure out at first. peek at: https://github.com/artemiscloud/activemq-artemis-operator/blob/main/controllers/activemqartemissecurity_broker_properties_test.go#L113

[john9x]

closed this as completed @brusdev Hi! What does it mean? I'm doing something wrong? Can you please explain why my config doesn't work?

[brusdev]

@john9x I closed the issue because I thought you had solved it with the suggestion of @gtully

[john9x]

@brusdev I'm sorry, I forget to reply on @gtully suggestion but I think

There are some examples in the tests that can help here, the properties provide a way to configure the broker internal configuration beans via properties.

relates to the second part of my question

Also I can't find any docs how to use spec.brokerProperties to configure security settings

[brusdev]

@john9x what error do you get when you try to login with some_user and another_user?

[john9x]

@brusdev hmmmm, I need to refresh my memory and reproduce the issue.

[brusdev]

@john9x I see 2 errors in your yaml:

• secrets is a field of extraMounts so no dash is required
• the role definition has wrong whitespaces admin = admin, some_user

The user some_user can login with the following yaml on my Kubernetes cluster:

apiVersion: v1
kind: Secret
metadata:
  name: artemis-jaas-config
stringData:
  login.config: |
    activemq {
            // ensure the operator can connect to the broker by referencing the existing properties config
            org.apache.activemq.artemis.spi.core.security.jaas.PropertiesLoginModule sufficient
                org.apache.activemq.jaas.properties.user="artemis-users.properties"
                org.apache.activemq.jaas.properties.role="artemis-roles.properties"
                baseDir="/home/jboss/amq-broker/etc";

            org.apache.activemq.artemis.spi.core.security.jaas.PropertiesLoginModule sufficient
                reload=true
                org.apache.activemq.jaas.properties.user="users.properties"
                org.apache.activemq.jaas.properties.role="roles.properties";

    };

  users.properties: |
    some_user = pass
    another_user = pass

  roles.properties: |
    admin = admin,some_user
    some_role = another_user

---
apiVersion: broker.amq.io/v1beta1
kind: ActiveMQArtemis
metadata:
  name: artemis-broker
spec:
  deploymentPlan:
    size: 2
    persistenceEnabled: true
    messageMigration: true
    requireLogin: true
    extraMounts:
      secrets:
        - artemis-jaas-config

[john9x]

@brusdev Thank you! I will check. Whitespace and dash! Unbelievable! :-)

[john9x]

@brusdev My bad. YAMLs makes me cry sometimes. Thank you very much for your patience. P.S. using of spec.brokerProperties for configuring is a PAIN