blob: 60ccbaf8e29b4dd04267603671384f7b6d6e47bc (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
|
<?xml version="1.0" encoding="utf-8"?>
<chapter xmlns:html="http://www.w3.org/1999/xhtml"><title>
Apache Qpid : Configuring Management Users
</title><para>
The Qpid Java broker has a single source of users for the system.
So a user can connect to the broker to send messages and via the
JMX console to check the state of the broker.
</para><para>
</para>
<section role="h2" id="ConfiguringManagementUsers-Addinganewmanagementuser"><title>
Adding
a new management user
</title>
<para>
The broker does have some minimal configuration available to
limit which users can connect to the JMX console and what they
can do when they are there.
</para><para>
There are two steps required to add a new user with rights for
the JMX console.
</para><orderedlist>
<listitem><para>Create a new user login, see HowTo:<xref linkend="qpid_Add-20New-20Users"/>
</para></listitem>
<listitem><para>Grant the new user permission to the JMX Console
</para></listitem>
</orderedlist>
<section role="h3" id="ConfiguringManagementUsers-GrantingJMXConsolePermissions"><title>
Granting
JMX Console Permissions
</title>
<para>
By default new users do not have access to the JMX console. The
access to the console is controlled via the file
<emphasis>jmxremote.access</emphasis>.
</para><para>
This file contains a mapping from user to privilege.
</para><para>
There are three privileges available:
</para><orderedlist>
<listitem><para>readonly - The user is able to log in and view queues but not
make any changes.
</para></listitem>
<listitem><para>readwrite - Grants user ability to read and write queue
attributes such as alerting values.
</para></listitem>
<listitem><para>admin - Grants the user full access including ability to edit
Users and JMX Permissions in addition to readwrite access.
</para></listitem>
</orderedlist><para>
This file is read at start up and can forcibly be reloaded by an
admin user through the management console.
</para>
<!--h3--></section>
<section role="h3" id="ConfiguringManagementUsers-AccessFileFormat"><title>
Access
File Format
</title>
<para>
The file is a standard Java properties file and has the following
format
</para>
<programlisting>
<username>=<privilege>
</programlisting>
<para>
If the username value is not a valid user (list in the specified
PrincipalDatabase) then the broker will print a warning when it
reads the file as that entry will have no meaning.
</para><para>
Only when the the username exists in both the access file and the
PrincipalDatabase password file will the user be able to login
via the JMX Console.
</para><section role="h4" id="ConfiguringManagementUsers-ExampleFile"><title>
Example File
</title>
<para>
The file will be timestamped by the management console if edited
through the console.
</para>
<programlisting>
#Generated by JMX Console : Last edited by user:admin
#Tue Jun 12 16:46:39 BST 2007
admin=admin
guest=readonly
user=readwrite
</programlisting>
<!--h4--></section>
<!--h3--></section>
<!--h2--></section>
</chapter>
|
