Authenticating a dockerized Spring Boot app against a dockerized & linked ActiveMQ - spring

Question

I'm starting my activemq container like so:
docker run -p 61616:61616 -p 8161:8161 --name='activemq' -d \
-e 'ACTIVEMQ_LOGLEVEL=DEBUG' \
-e 'ACTIVEMQ_ADMIN_USER=bot' \
-e 'ACTIVEMQ_ADMIN_PASSWORD=blahblah' \
-e 'ACTIVEMQ_OWNER_LOGIN=bot' \
-e 'ACTIVEMQ_OWNER_PASSWORD=blahblah' \
-e 'ACTIVEMQ_JMX_LOGIN=bot' \
-e 'ACTIVEMQ_JMX_PASSWORD=blahblah' \
-v /data/activemq:/data/activemq \
-v /var/log/activemq:/var/log/activemq \
webcenter/activemq:latest
The application.yml for my app has the following:
spring:
activemq:
broker-url: ${ACTIVEMQ_PORT_61616_TCP}
user: bot
password: blahblah
and I'm starting my app container like so:
docker run --name='myapp' \
-w /app/ -v /home/ubuntu/myapp/logs:/app/logs \
-v /home/ubuntu/myapp/config:/app/config \
-v /tmp:/tmp -p 4980:4980 \
--link activemq:activemq \
-d myapp
Note that I'm linking my app's container with the activemq container.
Finally, when I attempt to send a msg to activeMQ from my app (via a Camel route - but I don't think that's relevant), I see this in the logs:
javax.jms.JMSSecurityException: User name [bot] or password is invalid.
at org.apache.activemq.util.JMSExceptionSupport.create(JMSExceptionSupport.java:52)
at org.apache.activemq.ActiveMQConnection.syncSendPacket(ActiveMQConnection.java:1417)
at org.apache.activemq.ActiveMQConnection.ensureConnectionInfoSent(ActiveMQConnection.java:1522)
at org.apache.activemq.ActiveMQConnection.start(ActiveMQConnection.java:527)
at org.springframework.jms.listener.AbstractJmsListeningContainer.refreshSharedConnection(AbstractJmsListeningContainer.java:400)
at org.springframework.jms.listener.DefaultMessageListenerContainer.refreshConnectionUntilSuccessful(DefaultMessageListenerContainer.java:907)
at org.springframework.jms.listener.DefaultMessageListenerContainer.recoverAfterListenerSetupFailure(DefaultMessageListenerContainer.java:882)
at org.springframework.jms.listener.DefaultMessageListenerContainer$AsyncMessageListenerInvoker.run(DefaultMessageListenerContainer.java:1053)
at java.lang.Thread.run(Thread.java:745)
Caused by: java.lang.SecurityException: User name [bot] or password is invalid.
at org.apache.activemq.security.JaasAuthenticationBroker.addConnection(JaasAuthenticationBroker.java:80)
at org.apache.activemq.broker.BrokerFilter.addConnection(BrokerFilter.java:92)
at org.apache.activemq.broker.MutableBrokerFilter.addConnection(MutableBrokerFilter.java:97)
at org.apache.activemq.broker.TransportConnection.processAddConnection(TransportConnection.java:764)
at org.apache.activemq.broker.jmx.ManagedTransportConnection.processAddConnection(ManagedTransportConnection.java:79)
at org.apache.activemq.command.ConnectionInfo.visit(ConnectionInfo.java:139)
at org.apache.activemq.broker.TransportConnection.service(TransportConnection.java:294)
at org.apache.activemq.broker.TransportConnection$1.onCommand(TransportConnection.java:148)
at org.apache.activemq.transport.MutexTransport.onCommand(MutexTransport.java:50)
at org.apache.activemq.transport.WireFormatNegotiator.onCommand(WireFormatNegotiator.java:113)
at org.apache.activemq.transport.AbstractInactivityMonitor.onCommand(AbstractInactivityMonitor.java:270)
at org.apache.activemq.transport.TransportSupport.doConsume(TransportSupport.java:83)
at org.apache.activemq.transport.tcp.TcpTransport.doRun(TcpTransport.java:214)
at org.apache.activemq.transport.tcp.TcpTransport.run(TcpTransport.java:196)
... 1 common frames omitted
Caused by: javax.security.auth.login.LoginException: No LoginModules configured for activemq-domain
at javax.security.auth.login.LoginContext.init(LoginContext.java:264)
at javax.security.auth.login.LoginContext.<init>(LoginContext.java:417)
at org.apache.activemq.security.JaasAuthenticationBroker.addConnection(JaasAuthenticationBroker.java:72)
... 14 common frames omitted
Needless to say, it all 'just works' when running these components locally (i.e. not dockerized) on my dev machine. Just doesn't work inside docker containers on an EC2 instance.
Any and all help appreciated!
Thanks.

Answer 1

I have eventually got it to work by customising the docker image as follows:
Clone the git repo: git clone https://github.com/disaster37/activemq.git
Fix the URL passed to curl in this file: assets/setup/install
(the current url in that file no longer works)
Edit this file: assets/config/activemq.xml and replace the <jaasAuthenticationPlugin> and <authorizationPlugin> elements with this:
<simpleAuthenticationPlugin anonymousAccessAllowed="false">
<users>
<authenticationUser username="system" password="blubblub" groups="users,admins"/>
<authenticationUser username="bot" password="blahblah" groups="users"/>
</users>
</simpleAuthenticationPlugin>
Build my own docker image: docker build --tag="zackattack/activemq"
Run it: docker logs -f $(docker run --name='activemq' -d zackattack/activemq)
It's not pretty - but it works!

Answer 2

Judging by what I can glean from the debug logs. First, the debug log shows that 'bot' is getting across (the name), so, there does appear to be a connection between myapp and activemq. So the linkage is working. The clue for me is :
Caused by: javax.security.auth.login.LoginException: No LoginModules configured for activemq-domain
I don't know what a login module is, but, I would venture a guess that you need to tell activemq what to do with the name/password it receives? Looking at the description on the docker hub for activemq, there is an example:
-e 'ACTIVEMQ_READ_LOGIN=consumer_login' -e 'ACTIVEMQ_READ_PASSWORD=consumer_password'\
and
-e 'ACTIVEMQ_STATIC_TOPICS=topic1;topic2;topic3' -e 'ACTIVEMQ_STATIC_QUEUES=queue1;queue2;queue3'
Is it possible that either of these settings is needed to configure an activemq-domain login module? Or is that done in a configuration file somewhere? From a docker perspective I think everything is in order. I think there is a configuration issue with activemq. When this works in your regular environment, how do you start activemq (what are the command line arguments, environment variables, and configuration files)?