fix(activemq): add in-VM user credentials to simpleAuthenticationPlugin + ConnectionFactory

system/Tools/jetty/defaults/etc/activemq/activemq.xml

@@ -22,7 +22,19 @@ http://activemq.apache.org/schema/core http://activemq.apache.org/schema/core/ac
             uri="tcp://127.0.0.1:61616"
             .../>  (DO NOT use 0.0.0.0) and a matching TLS connector.
     -->
+    <!--
+         The xmlns="http://activemq.apache.org/schema/core" on <broker> is
+         required: the activemq.xsd declares <broker> (and its children
+         destinationPolicy, plugins, systemUsage, transportConnectors) in
+         that target namespace, and elementFormDefault is 'qualified'. If
+         <broker> is not in the ActiveMQ namespace, the XSD validator falls
+         back to the Spring beans XSD (because the root <beans> element is
+         in the Spring beans namespace) and rejects <broker> with
+         cvc-complex-type.2.4.a. Do NOT remove the xmlns attribute during
+         any future reformat. Tracked in issue #208.
+    -->
     <broker
+        xmlns="http://activemq.apache.org/schema/core"
         useShutdownHook="false"
         useJmx="false"
         persistent="true"
@@ -44,10 +56,23 @@ http://activemq.apache.org/schema/core http://activemq.apache.org/schema/core/ac
                              producerFlowControl="true"
                              memoryLimit="300 mb">
                     <!-- T2.2: cap pending message count per queue so a runaway
-                         producer cannot exhaust the queue store. -->
-                    <pendingQueuePolicy>
-                        <constantPendingMessageLimit value="1000"/>
-                    </pendingQueuePolicy>
+                         producer cannot exhaust the queue store.
+
+                         ActiveMQ has two superficially similar policy
+                         elements that do very different things:
+                           - <pendingQueuePolicy> selects the queue
+                             cursor (fileQueueCursor / storeCursor /
+                             vmQueueCursor) — i.e., how pending messages
+                             are *stored*. It is NOT a cap on count.
+                           - <pendingMessageLimitStrategy> is the cap on
+                             count per consumer, and its constant-form
+                             child is <constantPendingMessageLimitStrategy>
+                             with a 'limit' attribute (not 'value').
+                         The original T2.2 PR used the first pair, which
+                         the activemq.xsd rejects. Tracked in issue #210. -->
+                    <pendingMessageLimitStrategy>
+                        <constantPendingMessageLimitStrategy limit="1000"/>
+                    </pendingMessageLimitStrategy>
                 </policyEntry>
               </policyEntries>
             </policyMap>
@@ -81,9 +106,19 @@ http://activemq.apache.org/schema/core http://activemq.apache.org/schema/core/ac
            network listener inherits the secure defaults. simpleAuthenticationPlugin
            requires explicit credentials; the default <authorizationMap> denies
            access to any topic or queue not explicitly listed.
+
+           The "rhythmyx" user is the in-VM connection identity used by the
+           ActiveMQConnectionFactory configured in perc-mq.xml and
+           ear/WEB-INF/jetty-env.xml. Operators adding a network listener
+           should change this password (and add the network-listener's
+           user) before opening any <transportConnector>. The default
+           password here is a placeholder, not a secret.
       -->
       <plugins>
-          <simpleAuthenticationPlugin anonymousAccessAllowed="false"/>
+          <simpleAuthenticationPlugin
+              anonymousAccessAllowed="false"
+              userPasswords="rhythmyx=rhythmyx"
+              userGroups="rhythmyx=users,admins"/>
       </plugins>
 
       <!--

system/Tools/jetty/defaults/etc/perc-mq.xml

@@ -6,6 +6,8 @@
     <Arg>
      <New class="org.apache.activemq.ActiveMQConnectionFactory">
        <Arg>vm://localhost?brokerConfig=xbean:activemq.xml</Arg>
+       <Set name="userName"><Property name="activemq.username" default="rhythmyx"/></Set>
+       <Set name="password"><Property name="activemq.password" default="rhythmyx"/></Set>
     </New>
     </Arg>
   </New>

system/ear/WEB-INF/jetty-env.xml

@@ -6,6 +6,8 @@
         <Arg>
             <New class="org.apache.activemq.ActiveMQConnectionFactory">
                 <Arg>vm://localhost?brokerConfig=xbean:activemq.xml</Arg>
+                <Set name="userName"><Property name="activemq.username" default="rhythmyx"/></Set>
+                <Set name="password"><Property name="activemq.password" default="rhythmyx"/></Set>
             </New>
         </Arg>
     </New>