Uploaded image for project: 'WildFly'
  1. WildFly
  2. WFLY-16377

Remote Artemis queue connection requires createDurableQueue permission

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Major Major
    • 26.1.2.Final
    • 26.0.0.Final, 26.0.1.Final, 26.1.0.Final
    • JMS
    • None
    • Hide
      1. Create an empty Wildfly project with a remote artemis messaging configuration according to attached standalone-full.xml
      2. Create an address myQueue with a durable anycast queue with the same name in Active MQ Artemis
      3. Make sure that the artemis user configured in the messaging configuration does not have createDurableQueue permission on the address from step 2
      4. Create a message-driven bean that connects to the queue created in step 2
      5. Publish to Wildfly and start the server

      → Wildfly cannot establish the consumer connection to the queue. 

      Show
      Create an empty Wildfly project with a remote artemis messaging configuration according to attached standalone-full.xml Create an address  myQueue  with a durable anycast queue with the same name in Active MQ Artemis Make sure that the artemis user configured in the messaging configuration does not have createDurableQueue permission on the address from step 2 Create a message-driven bean that connects to the queue created in step 2 Publish to Wildfly and start the server → Wildfly cannot establish the consumer connection to the queue. 
    • Hide

      There are multiple workarounds for this issue:

      • In ActiveMQ Artemis add the permission createDurableQueue to the security setting for the involved user role and address
      • In ActiveMQ Artemis add a second anycast queue with prefix jms.queue to the involved address
      • In the connection factory set enable-amq1-prefix to false. This requires Wildfly 27+ (see WFLY-13793).
      Show
      There are multiple workarounds for this issue: In ActiveMQ Artemis add the permission createDurableQueue to the security setting for the involved user role and address In ActiveMQ Artemis add a second anycast queue with prefix  jms.queue  to the involved address In the connection factory set enable-amq1-prefix to false. This requires Wildfly 27+ (see WFLY-13793 ).
    • ---
    • ---

      A message-driven bean that is configured to connect to a queue of a remote ActiveMQ Artemis server requires the permission createDurableQueue. 

      The following error occurs repeatedly when the server starts:

      06:02:02,930 ERROR [org.apache.activemq.artemis.ra.ActiveMQRALogger] (default-threads - 1) AMQ154003: Unable to reconnect org.apache.activemq.artemis.ra.inflow.ActiveMQActivationSpec(ra=org.wildfly.extension.messaging.activemq.ActiveMQResourceAdapter@fb28a229 destination=myQueue destinationType=javax.jms.Queue ack=Auto-acknowledge durable=false user=null maxSession=15): ActiveMQSecurityException[errorType=SECURITY_EXCEPTION message=AMQ229213: User: myUser does not have permission='CREATE_DURABLE_QUEUE' for queue myQueue on address myQueue] 

      If auto create queue is disable in ActiveMQ Artemis for the address the following info log entry occurs repeatedly:

      2022-04-13 09:32:11,955 INFO  [org.apache.activemq.artemis.ra.ActiveMQRALogger] (default-threads - 3) [Usr#] AMQ151000: awaiting topic/queue creation java:/jms/queue/myQueue 

      In Wildfly 25 the permission createDurableQueue is not required for this scenario. This is the expected behaviour.

      Extract of the configuration :

       

      <subsystem xmlns="urn:jboss:domain:messaging-activemq:13.0">
                  <server name="default">
                      <security elytron-domain="ApplicationDomain"/>
                      <statistics enabled="${wildfly.messaging-activemq.statistics-enabled:${wildfly.statistics-enabled:false}}"/>
                      <security-setting name="#">
                          <role name="guest" send="true" consume="true" create-non-durable-queue="true" delete-non-durable-queue="true"/>
                      </security-setting>
                      <address-setting name="#" dead-letter-address="jms.queue.DLQ" expiry-address="jms.queue.ExpiryQueue" max-size-bytes="10485760" page-size-bytes="2097152" message-counter-history-day-limit="10"/>
                      <remote-connector name="remote-artemis" socket-binding="remote-artemis"/>
                      <in-vm-connector name="in-vm" server-id="0">
                          <param name="buffer-pooling" value="false"/>
                      </in-vm-connector>
                      <in-vm-acceptor name="in-vm" server-id="0">
                          <param name="buffer-pooling" value="false"/>
                      </in-vm-acceptor>
                      <jms-queue name="ExpiryQueue" entries="java:/jms/queue/ExpiryQueue"/>
                      <jms-queue name="DLQ" entries="java:/jms/queue/DLQ"/>
                      <connection-factory name="InVmConnectionFactory" entries="java:/ConnectionFactory" connectors="in-vm"/>
                      <pooled-connection-factory name="activemq-ra" entries="java:/JmsXA java:jboss/DefaultJMSConnectionFactory" connectors="remote-artemis" client-id="${jms.clientid}" transaction="xa" user="${env.ACTIVEMQ_USER:artemis}" password="${env.ACTIVEMQ_PWD:simetraehcapa}"/>
              </server>
      </subsystem>
      <outbound-socket-binding name="remote-artemis">
                  <remote-destination host="${env.ACTIVEMQ_HOST:localhost}" port="${env.ACTIVEMQ_PORT:61616}"/>
      </outbound-socket-binding> 

      Message-driven bean:

      @MessageDriven(activationConfig = { //
          @ActivationConfigProperty(propertyName = "destination", propertyValue = "myQueue"),
          @ActivationConfigProperty(propertyName = "destinationType", propertyValue = "javax.jms.Queue"))
      })
      public class MessageListenerBean implements MessageListener {
        @Inject
        Logger logger;
       
        public MessageListenerBean(){}
        @Override
        public void onMessage(Message message) {
          try {
            String id = message.getJMSMessageID();
            logger.debug("Message received: {}", id);
          } catch (JMSException e) {
            e.printStackTrace();
            mdc.setRollbackOnly();
          } catch (Throwable te) {
            logger.warn("Failed to receive message", te);
          }
        }
      } 

      It doesn't matter if the queue name is looked up with jndi or set directly with the destination config property.

       

              ehugonne1@redhat.com Emmanuel Hugonnet
              marco.studer@bison Marco Studer (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: