From dac733e6af0bde40a70f45c4d1739cf2db072f11 Mon Sep 17 00:00:00 2001
From: Nate Chadwick <263952448+natechadwick-intsof@users.noreply.github.com>
Date: Tue, 8 Sep 2026 14:59:13 -0400
Subject: [PATCH] fix(activemq): use <users>/<authenticationUser> child
 elements (XSD lies about String-typed attributes)

The activemq.xsd advertises userPasswords and userGroups as xs:string
attributes on <simpleAuthenticationPlugin>, but the actual
org.apache.activemq.security.SimpleAuthenticationPlugin class in 5.16.8
has setters that take Map<String,...>, not String:

  public void setUserPasswords(java.util.Map<java.lang.String, java.lang.String>);
  public void setUserGroups(java.util.Map<java.lang.String, java.util.Set<java.security.Principal>>);

There is no custom property editor registered, so Spring's BeanWrapper
rejects the activemq.xml bean init with:

  ConversionNotSupportedException: Failed to convert property value of
  type 'java.lang.String' to required type 'java.util.Map' for property
  'userGroups': no matching editors or conversion strategy found

PR #213 used the attribute form because that's what the XSD implied;
that form is unusable. The correct XBean syntax is the <users> /
<authenticationUser> child-element pattern (the <authenticationUser>
helper class is in the same activemq-spring-5.16.8.jar, has a 3-arg
String constructor AuthenticationUser(String username, String password,
String groups), and is declared in the same activemq.xsd as a child of
the plugin's <users> element):

  <simpleAuthenticationPlugin anonymousAccessAllowed="false">
    <users>
      <authenticationUser username="rhythmyx" password="rhythmyx" groups="users,admins"/>
    </users>
  </simpleAuthenticationPlugin>

The connection-factory changes from PR #213 (perc-mq.xml and
ear/WEB-INF/jetty-env.xml) are unchanged; the broker just needs the
correct user representation.

Refs #214

> Co-Authored by Mavis Mavis-Code using MiniMax-M3 with agent mavis.
---
 .../jetty/defaults/etc/activemq/activemq.xml  | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/system/Tools/jetty/defaults/etc/activemq/activemq.xml b/system/Tools/jetty/defaults/etc/activemq/activemq.xml
index c5fdbfbd6..6b5406fc7 100644
--- a/system/Tools/jetty/defaults/etc/activemq/activemq.xml
+++ b/system/Tools/jetty/defaults/etc/activemq/activemq.xml
@@ -113,12 +113,23 @@ http://activemq.apache.org/schema/core http://activemq.apache.org/schema/core/ac
            should change this password (and add the network-listener's
            user) before opening any <transportConnector>. The default
            password here is a placeholder, not a secret.
+
+           Note: the activemq.xsd advertises userPasswords and userGroups as
+           xs:string attributes on simpleAuthenticationPlugin, but the
+           SimpleAuthenticationPlugin setters actually take Map<String,...>
+           and there is no custom property editor to convert the String
+           attribute to a Map. The result is a ConversionNotSupportedException
+           at bean init. The correct way to express users is the
+           <users>/<authenticationUser> child-element pattern (the
+           <authenticationUser> helper is declared in the same activemq.xsd
+           and has a 3-arg String constructor). Tracked in issue #214.
       -->
       <plugins>
-          <simpleAuthenticationPlugin
-              anonymousAccessAllowed="false"
-              userPasswords="rhythmyx=rhythmyx"
-              userGroups="rhythmyx=users,admins"/>
+          <simpleAuthenticationPlugin anonymousAccessAllowed="false">
+              <users>
+                  <authenticationUser username="rhythmyx" password="rhythmyx" groups="users,admins"/>
+              </users>
+          </simpleAuthenticationPlugin>
       </plugins>
 
       <!--