ActiveMQ Artemis: custom login module not working from 2.17.0 - jaas

Question

I am running an ActiveMQ Artemis 2.16.0 server to which I developed a custom login module to authenticate against my own authorization server. It worked perfectly so far.
Now that I have upgraded to 2.17.0 and 2.18.0 I am getting following exception:
WARN [org.apache.activemq.artemis.core.server] AMQ222216: Security problem while authenticating: AMQ229031: Unable to validate user from /127.0.0.1:61432. Username: technical; SSL certificate subject DN: unavailable
My login.config file looks like this:
activemq {
org.apache.activemq.artemis.spi.core.security.jaas.PropertiesLoginModule sufficient
debug=false
reload=true
org.apache.activemq.jaas.properties.user="artemis-users.properties"
org.apache.activemq.jaas.properties.role="artemis-roles.properties";
com.dallmeier.asa.security.artemis.MyLoginModule sufficient
logEnabled=true
authUrl="http://localhost:5561/auth"
onSuccessRole="amq"
cacheDurationMinutes="3"
cacheSize="10000";
};
The plugin implements javax.security.auth.spi.LoginModule. It initializes a Singleton instance of a class ValidationSupplier. This executes simple http requests and caches the user for 5 minutes with:
com.google.common.cache.Cache;
com.google.common.cache.CacheBuilder;
It looks like it is something with the cache. Why it is a problem? When I am not using it it works.
public class CachingAdapter {
private Cache<String, IAuthPrincipal> tokenCache;
private ValidationSupplier coreSupplier;
public CachingAdapter (long cacheDurationMinutes, long cacheSize, ValidationSupplier coreSupplier) {
this.tokenCache = CacheBuilder.newBuilder().maximumSize(cacheSize)
.expireAfterWrite(cacheDurationMinutes, TimeUnit.MINUTES).build();
this.coreSupplier = coreSupplier;
}
public IAuthPrincipal validate(String username, String password) throws Exception {
return this.tokenCache.get(username, () -> coreSupplier.validate(username, password));
}
}
DEBUG [org.apache.activemq.artemis.spi.core.security.ActiveMQJAASSecurityManager] Couldn't validate user: javax.security.auth.login.LoginException: java.lang.NoClassDefFoundError: com/google/common/util/concurrent/internal/InternalFutureFailureAccess
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClass(ClassLoader.java:763)
at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142)
at java.net.URLClassLoader.defineClass(URLClassLoader.java:467)
at java.net.URLClassLoader.access$100(URLClassLoader.java:73)
at java.net.URLClassLoader$1.run(URLClassLoader.java:368)
at java.net.URLClassLoader$1.run(URLClassLoader.java:362)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:361)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClass(ClassLoader.java:763)
at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142)
at java.net.URLClassLoader.defineClass(URLClassLoader.java:467)
at java.net.URLClassLoader.access$100(URLClassLoader.java:73)
at java.net.URLClassLoader$1.run(URLClassLoader.java:368)
at java.net.URLClassLoader$1.run(URLClassLoader.java:362)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:361)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClass(ClassLoader.java:763)
at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:142)
at java.net.URLClassLoader.defineClass(URLClassLoader.java:467)
at java.net.URLClassLoader.access$100(URLClassLoader.java:73)
at java.net.URLClassLoader$1.run(URLClassLoader.java:368)
at java.net.URLClassLoader$1.run(URLClassLoader.java:362)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:361)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
at com.google.common.cache.LocalCache$LoadingValueReference.<init>(LocalCache.java:3472)
at com.google.common.cache.LocalCache$LoadingValueReference.<init>(LocalCache.java:3476)
at com.google.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2134)
at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2045)
at com.google.common.cache.LocalCache.get(LocalCache.java:3951)
at com.google.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4848)

Answer 1

ActiveMQ Artemis 2.17 has updated the guava version from 24.1.1-jre to 30.1-jre. Using guava version 30.1-jre to build the custom login module, should fix the issue.

Answer 2

Caching for authentication and authorization data was added in 2.16.0. Therefore, it's not clear why your login module would need its own caching. I'm not sure why you're getting the java.lang.NoClassDefFoundError, but this answer might help.
In any case, I recommend you remove your caching mechanism and simply use the broker's caching. You can read more about configuration for this caching in the documentation.