Skip to content

fix(activemq): use <users>/<authenticationUser> child elements (XSD lies about String-typed attributes) #214

Description

@natechadwick-intsof

Summary

The activemq.xsd advertises userPasswords and userGroups as
xs:string attributes on <simpleAuthenticationPlugin>, but the
actual org.apache.activemq.security.SimpleAuthenticationPlugin
class in 5.16.8 has:

public void setUserPasswords(java.util.Map<java.lang.String, java.lang.String>);
public void setUserGroups(java.util.Map<java.lang.String, java.util.Set<java.security.Principal>>);

— i.e., the setters take Map, not String. There is no custom
property editor registered, so Spring's BeanWrapper rejects the
activemq.xml bean init with:

ConversionNotSupportedException: Failed to convert property value of type
  'java.lang.String' to required type 'java.util.Map' for property
  'userGroups': no matching editors or conversion strategy found

The XSD's <xs:attribute name='userPasswords' type='xs:string'/> is a
documentation bug in activemq-spring-5.16.8.jar. PR #213 used the
attribute form because that's what the XSD implied; that form is
unusable. The correct way to express users in XBean is the
<users> / <authenticationUser> child-element pattern:

<simpleAuthenticationPlugin anonymousAccessAllowed="false">
    <users>
        <authenticationUser username="rhythmyx" password="rhythmyx" groups="users,admins"/>
    </users>
</simpleAuthenticationPlugin>

<authenticationUser> is the helper class
org.apache.activemq.security.AuthenticationUser (3-arg constructor
String username, String password, String groups plus the matching
setters), declared in the same activemq.xsd as a child of the
plugin's <users> element.

Plan

  1. Replace the broken userPasswords="..." userGroups="..." attribute
    pair with a <users><authenticationUser .../></users> child
    element. Keep anonymousAccessAllowed="false".
  2. The connection-factory changes from PR fix(activemq): add in-VM user credentials to simpleAuthenticationPlugin + ConnectionFactory #213 (perc-mq.xml,
    ear/WEB-INF/jetty-env.xml) are unchanged — they still work.
  3. Branch bugfix/<this-issue>-activemq-users-child-element; commit,
    GPG-sign, push, open PR.

Verification

  • python3 -c "import xml.etree.ElementTree as ET; ET.parse('activemq.xml')" — well-formed.
  • xmllint --schema activemq.xsd activemq.xml --noout — exits 0.
  • After deploy + restart:
    • grep -c "Failed to load: class path resource \[activemq.xml\]" .../server.log — 0
    • grep -c "User name \[null\] or password is invalid" .../server.log — 0
    • grep -c "Failed to convert property value" .../server.log — 0
    • JMS listeners reach steady state.

Co-Authored by Mavis Mavis-Code using MiniMax-M3 with agent mavis.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions