diff --git a/system/Tools/jetty/defaults/etc/activemq/activemq.xml b/system/Tools/jetty/defaults/etc/activemq/activemq.xml
index c5fdbfbd6..6b5406fc7 100644
--- a/system/Tools/jetty/defaults/etc/activemq/activemq.xml
+++ b/system/Tools/jetty/defaults/etc/activemq/activemq.xml
@@ -113,12 +113,23 @@ http://activemq.apache.org/schema/core http://activemq.apache.org/schema/core/ac
            should change this password (and add the network-listener's
            user) before opening any <transportConnector>. The default
            password here is a placeholder, not a secret.
+
+           Note: the activemq.xsd advertises userPasswords and userGroups as
+           xs:string attributes on simpleAuthenticationPlugin, but the
+           SimpleAuthenticationPlugin setters actually take Map<String,...>
+           and there is no custom property editor to convert the String
+           attribute to a Map. The result is a ConversionNotSupportedException
+           at bean init. The correct way to express users is the
+           <users>/<authenticationUser> child-element pattern (the
+           <authenticationUser> helper is declared in the same activemq.xsd
+           and has a 3-arg String constructor). Tracked in issue #214.
       -->
       <plugins>
-          <simpleAuthenticationPlugin
-              anonymousAccessAllowed="false"
-              userPasswords="rhythmyx=rhythmyx"
-              userGroups="rhythmyx=users,admins"/>
+          <simpleAuthenticationPlugin anonymousAccessAllowed="false">
+              <users>
+                  <authenticationUser username="rhythmyx" password="rhythmyx" groups="users,admins"/>
+              </users>
+          </simpleAuthenticationPlugin>
       </plugins>
 
       <!--