ActiveMQ Jetty with 2 authentications methods (LDAP + local) - ldap

Question

I currently having ActiveMQ jetty web server configured by using LDAP authentication for the users of the web console (admins), but I'm struggling to have at the same time HashLoginService for Rest API purpose...
I there a way to have the two authentication methods working on ActiveMQ Jetty?
Here my working config with LDAP:
<bean id="ldapLoginService" class="org.eclipse.jetty.jaas.JAASLoginService">
<property name="name" value="LDAP realm" />
<property name="loginModuleName" value="LDAPLogin" />
<property name="roleClassNames" value="org.apache.activemq.jaas.GroupPrincipal" />
<property name="identityService" ref="identityService" />
</bean>
<bean id="identityService" class="org.eclipse.jetty.security.DefaultIdentityService"/>
<bean id="securityConstraint" class="org.eclipse.jetty.util.security.Constraint">
<property name="name" value="BASIC" />
<property name="roles" value="admin_grp" />
<property name="authenticate" value="true" />
</bean>
<bean id="adminSecurityConstraint" class="org.eclipse.jetty.util.security.Constraint">
<property name="name" value="BASIC" />
<property name="roles" value="admin_grp" />
<property name="authenticate" value="true" />
</bean>
<bean id="securityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping">
<property name="constraint" ref="securityConstraint" />
<property name="pathSpec" value="/api/*,/admin/*,*.jsp" />
</bean>
<bean id="adminSecurityConstraintMapping" class="org.eclipse.jetty.security.ConstraintMapping">
<property name="constraint" ref="adminSecurityConstraint" />
<property name="pathSpec" value="*.action" />
</bean>
<bean id="securityHandler" class="org.eclipse.jetty.security.ConstraintSecurityHandler">
<property name="loginService" ref="ldapLoginService" />
<property name="realmName" value="LdapRealm" />
<property name="identityService" ref="identityService" />
<property name="authenticator">
<bean class="org.eclipse.jetty.security.authentication.BasicAuthenticator" />
</property>
<property name="constraintMappings">
<list>
<ref bean="adminSecurityConstraintMapping" />
<ref bean="securityConstraintMapping" />
</list>
</property>
<property name="handler" ref="secHandlerCollection" />
</bean>
and the ldap config:
LDAPLogin {
org.apache.activemq.jaas.LDAPLoginModule required
debug="false"
initialContextFactory=com.sun.jndi.ldap.LdapCtxFactory
connectionURL="{{ ldap_connect_url }}"
connectionUsername="{{ bind_dn }}"
connectionPassword="{{ bind_pw }}"
connectionProtocol=""
authentication=simple
userBase="{{ base_dn }}"
userSearchMatching="{{ ldap_user_search_matching }}"
userSearchSubtree="true"
roleBase="{{ ldap_role_base }}"
roleName="cn"
roleSearchMatching="{{ ldap_role_search_matching }}"
roleSearchSubtree=false
;
};

Answer 1

Why don't you add the PropertyFileLoginModule to your JAAS config file? It is similar to the HashLoginService, but works with JAAS. You would have to change your JAAS config to make the LDAPLoginModule sufficient rather than required, and make the PropertyFileLoginModule also sufficient. That way, if either of the login modules can succeed in authenticating the user. Reading more about the definitions of required/requisite/sufficient/optional may be helpful.

Answer 2

Jetty 9.x JAAS docs do not mention the ability to run multiple authentication sources, but you could implement your own custom JAAS LoginModule to support it.
If you are looking for something out-of-the-box, I know many people run ActiveMQ inside another runtime container (such as Apache Karaf) that supports single JAAS realm with multiple backends.