ActiveMQ Authorization - How To Read Authorization Entries from Database - authorization

Question

I am in a process of deploying ActiveMQ with custom Authentication and Authorization. I have a query regarding custom authorization map.
Question
I want to have the authorization entries read from database rather than activemq.xml. We don't want to write our authorization entries in activemq.xml file. I don't want to change the wildcard queue name hierarchies as provided in default authorization plugin.
What code components do I need to re-write ?

Answer 1

I have figured out the answer to my above question. I only need to interface my custom class so that I am able to load authorization entries from a source other than activemq.xml. And I can also re-load my authorization every 1 minute so that If a new role or authorization entry is made, it gets reloaded in to the system without restarting.
Solution Configurations
Create a class that interface AuthorizationMap.
In my case I extended my class from DefaultAuthorizationMap.java. I
want similar functionality and want to change only the input of authorization entries. My code reads roles from a database. Refer to section "Code-CustomAuthorizationMap" below.
Configure CustomAuthorizationMap class as bean in activemq.xml
<plugins>
<jaasAuthenticationPlugin configuration="activemq"/>
<authorizationPlugin>
<map>
<bean xmlns="" class="com.test.CustomAuthorizationMap"
</map>
</authorizationPlugin
</plugins>
Add lib to classpath
a. Create the jar file. Place it in "%ActiveMQ-Home%/lib" folder. E.g. custom-authorization.jar
b. Modify "%ActiveMQ-Home%/bin/activemq.bat".
**Replace**
set ACTIVEMQ_CLASSPATH=%ACTIVEMQ_CONF%;%ACTIVEMQ_BASE%/conf;%ACTIVEMQ_HOME%/conf;%ACTIVEMQ_CLASSPATH%;
**With**
set ACTIVEMQ_CLASSPATH=%ACTIVEMQ_CONF%;%ACTIVEMQ_BASE%/conf;%ACTIVEMQ_HOME%/conf;%ACTIVEMQ_CLASSPATH%;%ACTIVEMQ_HOME%/lib/custom-authorization.jar;
Code-CustomAuthorizationMap
package com.test.authorization.map;
import java.util.ArrayList;
import java.util.List;
import org.apache.activemq.command.ActiveMQQueue;
import org.apache.activemq.command.ActiveMQTempQueue;
import org.apache.activemq.command.ActiveMQTopic;
import org.apache.activemq.filter.DefaultDestinationMapEntry;
import org.apache.activemq.filter.DestinationMapEntry;
import org.apache.activemq.security.AuthorizationEntry;
import org.apache.activemq.security.DefaultAuthorizationMap;
public class SecGwAuthorizationMap extends DefaultAuthorizationMap {
public SecGwAuthorizationMap() throws Exception {
super();
List<DestinationMapEntry> authorizationEntries =
loadAuthorizationEntriesFromPropFiles();
// For information. After loading I populate
//authorization entries like below
// AuthorizationEntry entry = new AuthorizationEntry();
// entry.setTopic(">");
// entry.setAdmin("admins");
// entry.setRead("admins");
// entry.setWrite("admins");
// authorizationEntries.add(entry);
// entry = new AuthorizationEntry();
// entry.setQueue(">");
// entry.setAdmin("admins");
// entry.setRead("admins");
// entry.setWrite("admins");
// authorizationEntries.add(entry);
// entry= new AuthorizationEntry();
// entry.setTopic("ActiveMQ.Advisory.>");
// entry.setAdmin("gcabrokerusers,admins,users");
// entry.setRead("gcabrokerusers");
// entry.setWrite("gcabrokerusers");
// authorizationEntries.add(entry);
// entry = new AuthorizationEntry();
// entry.setQueue("gcaa.test.jms.>");
// entry.setAdmin("gcabrokerusers");
// entry.setRead("gcabrokerusers");
// entry.setWrite("gcabrokerusers");
// authorizationEntries.add(entry);
setAuthorizationEntries(authorizationEntries);
}
public SecGwAuthorizationMap(List<DestinationMapEntry>
authorizationEntries) {
super(authorizationEntries);
// TODO Auto-generated constructor stub
}
}
Note:- Below is a sample roles.properties files to tell how we are creating authorization roles.
roles.properties file
//commentedLine Destination Read-ACLs Write-ACLs AdminAcls Type
ActiveMQ.Advisory.>::admins,appUsr::admins,appusr::admins,appUsr::TOPIC
test.accounts.queue::appClientId::appClientId::admins::QUEUE
>::admins::admins::admins::QUEUE
>::admins::admins::admins::TOPIC