https://issues.apache.org/jira/browse/AMQ-4567 fixed a related problem in version 5.9. I added a additional SecurityConstraint in jetty.xml for createDestination like below ~~~~~~~~~ <bean id="adminSecurityConstraint1" class="org.eclipse.jetty.security.ConstraintMapping"> <property name="constraint" ref="adminSecurityConstraint" /> <property name="pathSpec" value="/admin/createDestination.action/*" /> </bean> ~~~~~~~~ By using the above configuration read-only user are not allowed to create new destination by using the create button, however by using the GET URL its possible.