A customer was facing this issue while configuring the Authorization plugin based on JAAS user groups. I tried to replicate it at my end and could observe the issue.

We want to group roles in JAAS groups, then configure Authorization ( broker.xml/ ssl-broker.xml file ) plugin based on users groups. We created 2 users "user1" and "user2" and assigned them two roles roles "role1" and "role2" respectively. Now we created a group "mygroup" having "role1" and "role2"

JBossFuse:karaf@root> jaas:users
User Name Group Role
admin admin admin
admin admin manager
admin admin viewer
admin admin Operator
admin admin Maintainer
admin admin Deployer
admin admin Auditor
admin admin Administrator
admin admin SuperUser
admin Monitor
user1 role1
user2 role2

role1 and role2 have been added to Mygroup using command

JBossFuse:karaf@root> jaas:grouproleadd myGroup role1
JBossFuse:karaf@root> jaas:grouproleadd myGroup role2

JBossFuse:karaf@root> jaas:groups
Group Roles
admin admin,admin,manager,viewer,Operator,Maintainer,Deployer,Auditor,Administrator,SuperUser
myGroup

,role1,role2

We configured the "authorizationPlugin" in "ssl-broker.xml" file as follows:

<authorizationPlugin>
			<map>
          <authorizationMap groupClass="org.apache.karaf.jaas.boot.principal.RolePrincipal">
			
            <authorizationEntries>
              <authorizationEntry queue=">" read="admin" write="admin" admin="admin,myGroup" />
              <authorizationEntry queue="QUEUE.REFE.NOTIFICATION.>" read="admin,refeconsumer,myGroup" write="admin,refeproducer,myGroup" admin="admin,myGroup" />
			  
			 <authorizationEntry topic=">" read="admin" write="admin" admin="admin,myGroup" />
			 <authorizationEntry topic="ActiveMQ.Advisory.>" read="role1,myGroup,refeconsumer,refeproducer,admin" write="role1,refeproducer,myGroup,admin"  admin="role1,myGroup,refeproducer,admin"/>


			</authorizationEntries>
	
			
			<tempDestinationAuthorizationEntry>
            	 <tempDestinationAuthorizationEntry read="refeconsumer,refeproducer,myGroup,admin" write="refeproducer,myGroup,admin" admin="admin,myGroup"/>
           	</tempDestinationAuthorizationEntry>

But when we are trying to access the queues with the users having the proper permissions we are getting:
javax.jms.JMSSecurityException: User user1 is not authorized to read from: ActiveMQ.Advisory.TempQueue,ActiveMQ.Advisory.TempTopic

But we noticed a strange behavior there. When we give the full name of the topic/queue in the authorization plugin, it works fine but if we use wildcard character it throws the error.
For example :

<authorizationMap groupClass="org.apache.karaf.jaas.boot.principal.RolePrincipal">
			
            <authorizationEntries>
              <!--authorizationEntry queue=">" read="admin,mygroup" write="admin,mygroup" admin="admin,mygroup" /-->
              <authorizationEntry queue="QUEUE.REFE.NOTIFICATION.>" read="mygroup,admin,refeconsumer" write="mygroup,admin,refeproducer" admin="admin" />

<authorizationEntry topic="ActiveMQ.Advisory.>" read="mygroup,refeconsumer,refeproducer,admin" write="mygroup,refeproducer,admin"  admin="mygroup,refeproducer,admin"/>
			   <authorizationEntry topic="ActiveMQ.Advisory.>" read="mygroup" write="mygroup" admin="mygroup" />

With this configuration, the user "user1" present in "mygroup" is not able to access the "ActiveMQ.Advisory.*>" topic, but if I give the full name of the topic without the wildcard character "ActiveMQ.Advisory.Connection" , it works fine. In this case, for wildcard character worked for queues not topics. But another strange thing which happened was that my user created a queue for which it doesn't have the rights.

Scenario 2:
When I changed the authorization map to GroupPrincipal instead of RolePrincipal, the opposite happened for queues and topics. Wildcard did not work for queues this time but worked for topics. And my user created a topic for which it did not have access to.