Uploaded image for project: 'AMQ Broker'
  1. AMQ Broker
  2. ENTMQBR-1061

Exception when using LegacyLDAPSecuritySettingsPlugin

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Major
    • AMQ 7.2.4.GA
    • AMQ 7.1.0.GA
    • security
    • None
    • Hide
      Previously, when using LegacyLDAPSecuritySettingsPlugin, if you specified authorization settings with non-standard, but still valid syntax, you saw an exception. This is because the broker interpreted LDAP search results based on hard-coded key names, not on order. This issue is corrected.
      Show
      Previously, when using LegacyLDAPSecuritySettingsPlugin, if you specified authorization settings with non-standard, but still valid syntax, you saw an exception. This is because the broker interpreted LDAP search results based on hard-coded key names, not on order. This issue is corrected.
    • Hide

      1) Import the attached amq.ldif file into a LDAP Server.
      2) Configure the etc/login.config settings to point to LDAP for authentication. 

      activemq {
    org.apache.activemq.artemis.spi.core.security.jaas.LDAPLoginModule required
        debug=true
        initialContextFactory=com.sun.jndi.ldap.LdapCtxFactory
        connectionURL="ldap://localhost:10389"
        connectionUsername="cn=Directory Manager"
        connectionPassword=password
        connectionProtocol=s
        authentication=simple
        userBase="ou=User,ou=ActiveMQ,dc=activemq,dc=vizuri,dc=com"
        userSearchMatching="(uid={0})"
        userSearchSubtree=true
        roleBase="ou=Group,ou=ActiveMQ,dc=activemq,dc=vizuri,dc=com"
        roleName=cn
        roleSearchMatching="(member=uid={1})"
        roleSearchSubtree=true
        ;
};

      3) Update broker.xml file to and set the security-setting-plugin as follows.

            <security-settings>
       <security-setting-plugin class-name="org.apache.activemq.artemis.core.server.impl.LegacyLDAPSecuritySettingPlugin">
          <setting name="initialContextFactory" value="com.sun.jndi.ldap.LdapCtxFactory"/>
          <setting name="connectionURL" value="ldap://localhost:10389"/>
          <setting name="connectionUsername" value="cn=Directory Manager"/>
          <setting name="connectionPassword" value="password"/>
          <setting name="destinationBase" value="ou=Destination,ou=ActiveMQ,dc=activemq,dc=vizuri,dc=com"/>
          <setting name="authentication" value="simple"/>
          <setting name="roleAttribute" value="member"/>
          <setting name="connectionProtocol" value="s"/>
        </security-setting-plugin>

      Start the server and you will get the exception.

      Show
      1) Import the attached amq.ldif file into a LDAP Server. 2) Configure the etc/login.config settings to point to LDAP for authentication. activemq { org.apache.activemq.artemis.spi.core.security.jaas.LDAPLoginModule required debug= true initialContextFactory=com.sun.jndi.ldap.LdapCtxFactory connectionURL= "ldap: //localhost:10389" connectionUsername= "cn=Directory Manager" connectionPassword=password connectionProtocol=s authentication=simple userBase= "ou=User,ou=ActiveMQ,dc=activemq,dc=vizuri,dc=com" userSearchMatching= "(uid={0})" userSearchSubtree= true roleBase= "ou=Group,ou=ActiveMQ,dc=activemq,dc=vizuri,dc=com" roleName=cn roleSearchMatching= "(member=uid={1})" roleSearchSubtree= true ; }; 3) Update broker.xml file to and set the security-setting-plugin as follows. <security-settings> <security-setting-plugin class- name= "org.apache.activemq.artemis.core.server.impl.LegacyLDAPSecuritySettingPlugin" > <setting name= "initialContextFactory" value= "com.sun.jndi.ldap.LdapCtxFactory" /> <setting name= "connectionURL" value= "ldap: //localhost:10389" /> <setting name= "connectionUsername" value= "cn=Directory Manager" /> <setting name= "connectionPassword" value= "password" /> <setting name= "destinationBase" value= "ou=Destination,ou=ActiveMQ,dc=activemq,dc=vizuri,dc=com" /> <setting name= "authentication" value= "simple" /> <setting name= "roleAttribute" value= "member" /> <setting name= "connectionProtocol" value= "s" /> </security-setting-plugin> Start the server and you will get the exception.

    Description

      An exception is seen when configuring LegacyLDAPSecuritySettingPlugin.

      2018-02-27 16:07:04,806 INFO  [org.apache.activemq.artemis.core.server] AMQ221051: Populating security roles from LDAP at: ldap://localhost:10389
2018-02-27 16:07:04,846 ERROR [org.apache.activemq.artemis.core.server] AMQ224000: Failure in initialisation: java.lang.IllegalArgumentException: AMQ119070: match can not be null
	at org.apache.activemq.artemis.core.settings.impl.Match.verify(Match.java:106) [artemis-server-2.4.0.amq-710004-redhat-1.jar:2.4.0.amq-710004-redhat-1]
	at org.apache.activemq.artemis.core.settings.impl.HierarchicalObjectRepository.addMatch(HierarchicalObjectRepository.java:172) [artemis-server-2.4.0.amq-710004-redhat-1.jar:2.4.0.amq-710004-redhat-1]
	at org.apache.activemq.artemis.core.settings.impl.HierarchicalObjectRepository.addMatch(HierarchicalObjectRepository.java:161) [artemis-server-2.4.0.amq-710004-redhat-1.jar:2.4.0.amq-710004-redhat-1]
	at org.apache.activemq.artemis.core.server.impl.ActiveMQServerImpl.deploySecurityFromConfiguration(ActiveMQServerImpl.java:2415) [artemis-server-2.4.0.amq-710004-redhat-1.jar:2.4.0.amq-710004-redhat-1]
	at org.apache.activemq.artemis.core.server.impl.ActiveMQServerImpl.initialisePart1(ActiveMQServerImpl.java:2297) [artemis-server-2.4.0.amq-710004-redhat-1.jar:2.4.0.amq-710004-redhat-1]
	at org.apache.activemq.artemis.core.server.impl.SharedNothingLiveActivation.run(SharedNothingLiveActivation.java:112) [artemis-server-2.4.0.amq-710004-redhat-1.jar:2.4.0.amq-710004-redhat-1]
	at org.apache.activemq.artemis.core.server.impl.ActiveMQServerImpl.internalStart(ActiveMQServerImpl.java:521) [artemis-server-2.4.0.amq-710004-redhat-1.jar:2.4.0.amq-710004-redhat-1]
	at org.apache.activemq.artemis.core.server.impl.ActiveMQServerImpl.start(ActiveMQServerImpl.java:460) [artemis-server-2.4.0.amq-710004-redhat-1.jar:2.4.0.amq-710004-redhat-1]
	at org.apache.activemq.artemis.integration.FileBroker.start(FileBroker.java:111) [artemis-cli-2.4.0.amq-710004-redhat-1.jar:2.4.0.amq-710004-redhat-1]
	at org.apache.activemq.artemis.cli.commands.Run.execute(Run.java:82) [artemis-cli-2.4.0.amq-710004-redhat-1.jar:2.4.0.amq-710004-redhat-1]
	at org.apache.activemq.artemis.cli.Artemis.internalExecute(Artemis.java:149) [artemis-cli-2.4.0.amq-710004-redhat-1.jar:2.4.0.amq-710004-redhat-1]
	at org.apache.activemq.artemis.cli.Artemis.execute(Artemis.java:96) [artemis-cli-2.4.0.amq-710004-redhat-1.jar:2.4.0.amq-710004-redhat-1]
	at org.apache.activemq.artemis.cli.Artemis.execute(Artemis.java:123) [artemis-cli-2.4.0.amq-710004-redhat-1.jar:2.4.0.amq-710004-redhat-1]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) [rt.jar:1.8.0_151]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) [rt.jar:1.8.0_151]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) [rt.jar:1.8.0_151]
	at java.lang.reflect.Method.invoke(Method.java:498) [rt.jar:1.8.0_151]
	at org.apache.activemq.artemis.boot.Artemis.execute(Artemis.java:129) [artemis-boot.jar:2.4.0.amq-710004-redhat-1]
	at org.apache.activemq.artemis.boot.Artemis.main(Artemis.java:49) [artemis-boot.jar:2.4.0.amq-710004-redhat-1]

      Attachments

        Activity

          People

            rhn-support-jbertram Justin Bertram
            rhn-support-dgrove Doug Grove (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: