<div class="wiki-content maincontent"><p>ActiveMQ 4.x and greater provides pluggable security through various different providers.</p><p>The most common providers are</p><ul><li><a shape="rect" href="http://java.sun.com/products/jaas/">JAAS</a> for authentication</li><li>a default authorization mechanism using a simple XML configuration file.</li></ul><h3>Authentication</h3><p>The default <a shape="rect" href="http://java.sun.com/products/jaas/">JAAS</a> plugin relies on the standard JAAS mechanism for authentication. Refer to the <a shape="rect" href="http://java.sun.com/products/jaas/reference/docs/index.html">documentation</a> for more detail.</p><p>Typically you configure JAAS using a config file like <a shape="rect" href="http://svn.apache.org/repos/asf/activemq/trunk/activemq-unit-tests/src/test/resources/login.config">this one</a> and set the <strong>java.security.auth.login.config</strong> system property to point to it. If no system property is specified then by default the ActiveMQ JAAS plugin will look for <strong>login.config</strong> on the classpath and use that.</p><h4>Authentication Example</h4><p>Here is an example <a shape="rect" href="http://svn.apache.org/repos/asf/activemq/trunk/activemq-unit-tests/src/test/resources/login.config">login.config</a> which then points to these files</p><ul><li><a shape="rect" href="http://svn.apache.org/repos/asf/activemq/trunk/activemq-unit-tests/src/test/resources/org/apache/activemq/security/users.properties">users.properties</a></li><li><a shape="rect" href="http://svn.apache.org/repos/asf/activemq/trunk/activemq-unit-tests/src/test/resources/org/apache/activemq/security/groups.properties">groups.properties</a></li></ul><p><strong>Note:</strong> Until version 5.11.1, these property files got reloaded on every authentication request by default. So updates to users, password and groups were loaded immediately. From 5.12 onward they only get reloaded if reload=true is set in your LoginModule configuration, e.g.</p><plain-text-body>activemq {
    org.apache.activemq.jaas.PropertiesLoginModule required
        org.apache.activemq.jaas.properties.user="users.properties"
        org.apache.activemq.jaas.properties.group="groups.properties"
        reload=true;
};
</plain-text-body><p>If reload=true is not set, these property files get loaded on broker startup only!! See AMQ-5876 for details.</p><h4>Simple Authentication Plugin</h4><p>If you have modest authentication requirements (or just want to quickly set up your testing environment) you can use SimpleAuthenticationPlugin. With this plugin you can define users and groups directly in the broker's XML configuration. Take a look at the following snippet for example:</p><parameter ac:name="">xml</parameter><plain-text-body>&lt;simpleAuthenticationPlugin&gt;
	&lt;users&gt;
		&lt;authenticationUser username="system" password="manager"
			groups="users,admins"/&gt;
		&lt;authenticationUser username="user" password="password"
			groups="users"/&gt;
		&lt;authenticationUser username="guest" password="password" groups="guests"/&gt;
	&lt;/users&gt;
&lt;/simpleAuthenticationPlugin&gt;
</plain-text-body><p>Users and groups defined in this way can be later used with the appropriate authorization plugin.</p><h5>Anonymous access</h5><p>From version 5.4.0 onwards, you can configure simple authentication plugin to allow anonymous access to the broker.</p><parameter ac:name="">xml</parameter><plain-text-body>&lt;simpleAuthenticationPlugin anonymousAccessAllowed="true"&gt;
    &lt;users&gt;
        &lt;authenticationUser username="system" password="manager"
            groups="users,admins"/&gt;
        &lt;authenticationUser username="user" password="password"
            groups="users"/&gt;
        &lt;authenticationUser username="guest" password="password" groups="guests"/&gt;
    &lt;/users&gt;
&lt;/simpleAuthenticationPlugin&gt;
</plain-text-body><p>To allow anonymous access to the broker, use <code>anonymousAccessAllowed</code> attribute and set it to <code>true</code> as shown above. Now, when the client connects without username and password provided, a default username (<code>anonymous</code>) and group (<code>anonymous</code>) will be assigned to its security context. You can use this username and password to authorize client's access to appropriate broker resources (see the next section). You can also change username and group that will be assigned to <em>anonymous</em> users by using <code>anonymousUser</code> and <code>anonymousGroup</code> attributes.</p><h3>Authorization</h3><p>In ActiveMQ we use a number of operations which you can associate with user roles and either individual queues or topics or you can use wildcards to attach to hierarchies of topics and queues.</p><table><tbody><tr><th colspan="1" rowspan="1"><p>Operation</p></th><th colspan="1" rowspan="1"><p>Description</p></th></tr><tr><td colspan="1" rowspan="1"><p>read</p></td><td colspan="1" rowspan="1"><p>You can browse and consume from the destination</p></td></tr><tr><td colspan="1" rowspan="1"><p>write</p></td><td colspan="1" rowspan="1"><p>You can send messages to the destination</p></td></tr><tr><td colspan="1" rowspan="1"><p>admin</p></td><td colspan="1" rowspan="1"><p>You can lazily create the destination if it does not yet exist. This allows you fine grained control over which new destinations can be dynamically created in what part of the queue/topic hierarchy</p></td></tr></tbody></table><p>Queues/Topics can specified using the ActiveMQ <link><page ri:content-title="Wildcards"></page></link> syntax.</p><h4>Authorization Example</h4><p>The following <a shape="rect" href="http://svn.apache.org/repos/asf/activemq/trunk/activemq-unit-tests/src/test/resources/org/apache/activemq/security/jaas-broker.xml">example</a> shows these 2 plugins in operation. Though note its very easy to write your own plugin.<plain-text-body>{snippet:id=example|lang=xml|url=activemq/trunk/activemq-unit-tests/src/test/resources/org/apache/activemq/security/jaas-broker.xml}</plain-text-body><strong>Note</strong> that full access rights should generally be given to the ActiveMQ.Advisory destinations because by default an ActiveMQConnection uses destination advisories to get early knowledge of temp destination creation and deletion. In addition, dynamic network connectors use advisories to determine consumer demand.<br clear="none"> If necessary, the use of advisories in this manner can be disabled via the <em>watchTopicAdvisories</em> boolean attribute of ActiveMQConnectionFactory and for a networkConnector, via the network connector <em>staticBridge</em>(5.6) boolean attribute.</p><h3>Broker-to-Broker Authentication and Authorization</h3><p>If you have enabled authentication for a particular message broker, then other brokers that wish to connect to that broker must provide the proper authentication credentials via their &lt;networkConnector&gt; element. For example, suppose that we have a network of brokers with the following configuration:</p><ul class="alternate"><li>The network of brokers comprises two brokers (BrokerA and BrokerB)</li><li>Authentication for BrokerA has been enabled via the example &lt;simpleAuthenticationPlugin&gt; element.</li><li>Authentication for BrokerB has not been enabled.</li><li>BrokerA only listens for connections. In other words, BrokerA has a &lt;transportConnector&gt; element, but no &lt;networkConnector&gt; elements.</li></ul><p>In order for BrokerB to connect to BrokerA, the corresponding &lt;networkConnector&gt; element in BrokerB's XML configuration file must be set up as follows.</p><parameter ac:name="">xml</parameter><plain-text-body>&lt;networkConnectors&gt;
   &lt;networkConnector name="brokerAbridge"
                     userName="user"
                     password="password"
                     uri="static://(tcp://brokerA:61616)"/&gt;
   &lt;/networkConnectors&gt;
</plain-text-body><p>Note how BrokerB's &lt;networkConnector&gt; element must provide the proper credentials in order to connect to BrokerA. If authorization has been enabled on BrokerA, then the userName assigned to the &lt;networkConnector&gt; element must also have the proper authorization credentials. Messages cannot be forwarded from BrokerB to BrokerA if BrokerA has authorization enabled and BrokerB's corresponding &lt;networkConnector&gt; element's userName has not been given the proper authorization credentials.</p><p>Also, if BrokerA is given a &lt;networkConnector&gt; element so that it can initiate a connection to BrokerB, then that &lt;networkConnector&gt; must be given a userName/password combination that is defined in the &lt;simpleAuthenticationPlugin&gt; element; this is required even though BrokerB does not have authentication services enabled.</p><h3>Controlling Access To Temporary Destinations</h3><p>To control access to temporary destinations, you will need to add a &lt;tempDestinationAuthorizationEntry&gt; element to the authorizationMap. Through this element, you control access to all temporary destinations. If this element is not present, read, write, and admin privileges for temporary destinations will be granted to all. In the example below, read, write, and admin privileges for temporary destinations are only granted to those clients that have been assigned to the 'admin' group.</p><parameter ac:name="">xml</parameter><plain-text-body>&lt;broker&gt;
  ..
   &lt;plugins&gt;
      ..
   &lt;authorizationPlugin&gt;
       &lt;map&gt;
         &lt;authorizationMap&gt;
           &lt;authorizationEntries&gt;
             &lt;authorizationEntry queue="TEST.Q" read="users" write="users" admin="users" /&gt;
             &lt;authorizationEntry topic="ActiveMQ.Advisory.&gt;" read="all" write="all" admin="all"/&gt;
           &lt;/authorizationEntries&gt;
           &lt;tempDestinationAuthorizationEntry&gt;
             &lt;tempDestinationAuthorizationEntry read="admin" write="admin" admin="admin"/&gt;
           &lt;/tempDestinationAuthorizationEntry&gt;
        &lt;/authorizationMap&gt;
      &lt;/map&gt;
   &lt;/authorizationPlugin&gt;
     ..
  &lt;/plugins&gt;
  ..
&lt;/broker&gt;
</plain-text-body><h3>LDAP Authentication Using the JAAS Plugin</h3><parameter ac:name="">New module</parameter><rich-text-body><p>A new/better ldap authorization module is available since 5.6. See <link><page ri:content-title="Cached LDAP Authorization Module"></page></link> for more info.</p></rich-text-body><p>1. Configure the JAAS LDAPLoginModule and the LDAPAuthorizationMap in activemq.xml:</p><parameter ac:name="">xml</parameter><plain-text-body>    &lt;plugins&gt; 
      &lt;!--  use JAAS to authenticate using the login.config file on the classpath to configure JAAS --&gt; 
      &lt;jaasAuthenticationPlugin configuration="LdapConfiguration" /&gt; 
      &lt;!--  lets configure a destination based role/group authorization mechanism --&gt; 
      &lt;authorizationPlugin&gt; 
        &lt;map&gt; 
          &lt;bean xmlns="http://www.springframework.org/schema/beans" id="lDAPAuthorizationMap" 
                class="org.apache.activemq.security.LDAPAuthorizationMap"&gt; 
            &lt;property name="initialContextFactory" value="com.sun.jndi.ldap.LdapCtxFactory"/&gt; 
            &lt;property name="connectionURL" value="ldap://ldap.acme.com:389"/&gt; 
            &lt;property name="authentication" value="simple"/&gt; 
            &lt;property name="connectionUsername" value="cn=mqbroker,ou=Services,dc=acme,dc=com"/&gt; 
            &lt;property name="connectionPassword" value="password"/&gt; 
            &lt;property name="connectionProtocol" value="s"/&gt; 
            &lt;property name="topicSearchMatching" value="cn={0},ou=Topic,ou=Destination,ou=ActiveMQ,ou=systems,dc=acme,dc=com"/&gt; 
            &lt;property name="topicSearchSubtreeBool" value="true"/&gt; 
            &lt;property name="queueSearchMatching" value="cn={0},ou=Queue,ou=Destination,ou=ActiveMQ,ou=systems,dc=acme,dc=com"/&gt; 
            &lt;property name="queueSearchSubtreeBool" value="true"/&gt; 
            &lt;property name="adminBase" value="(cn=admin)"/&gt; 
            &lt;property name="adminAttribute" value="member"/&gt; 
            &lt;property name="adminAttributePrefix" value="cn="/&gt; 
            &lt;property name="readBase" value="(cn=read)"/&gt; 
            &lt;property name="readAttribute" value="member"/&gt; 
            &lt;property name="readAttributePrefix" value="cn="/&gt; 
            &lt;property name="writeBase" value="(cn=write)"/&gt; 
            &lt;property name="writeAttribute" value="member"/&gt; 
            &lt;property name="writeAttributePrefix" value="cn="/&gt; 
          &lt;/bean&gt; 
        &lt;/map&gt; 
      &lt;/authorizationPlugin&gt; 
    &lt;/plugins&gt; 
</plain-text-body><p>2. Configure the JAAS login.config (I haven't de-duplicated the config yet):</p><plain-text-body> 
LdapConfiguration { 
   org.apache.activemq.jaas.LDAPLoginModule required 
       debug=true 
       initialContextFactory=com.sun.jndi.ldap.LdapCtxFactory 
       connectionURL="ldap://ldap.acme.com:389" 
       connectionUsername="cn=mqbroker,ou=Services,dc=acme,dc=com" 
       connectionPassword=password 
       connectionProtocol=s 
       authentication=simple 
       userBase="ou=User,ou=ActiveMQ,ou=systems,dc=acme,dc=com" 
       userRoleName=dummyUserRoleName 
       userSearchMatching="(uid={0})" 
       userSearchSubtree=false 
       roleBase="ou=Group,ou=ActiveMQ,ou=systems,dc=acme,dc=com" 
       roleName=cn 
       roleSearchMatching="(member:=uid={1})" 
       roleSearchSubtree=true 
       ; 
}; 
</plain-text-body><p>3. Import the following LDIF file into the LDAP server:</p><plain-text-body>version: 1

#
# Sample LDIF for ActiveMQ LDAP authentication and authorisation
# Passwords are defaulted to "password" - it is your responsibility to change them!
#
# Sets up:
# 1. Bind user
# 2. A sample queue with admin,read,write permission assignments
# 3. ActiveMQ advisory topics
# 4. Two groups - admin and webapp
# 5. Two users - admin and webapp
# 6. Role assignments - admin-&gt;admin, webapp-&gt;webapp
#
# (c) Robin Bramley 2008
# Provided as is without any warranty of any kind
# 

dn: dc=acme,dc=com
dc: acme
objectClass: domain
objectClass: top

dn: ou=Services,dc=acme,dc=com
ou: Services
objectClass: organizationalUnit
objectClass: top

dn: cn=mqbroker,ou=Services,dc=acme,dc=com
cn: mqbroker
objectClass: organizationalRole
objectClass: top
objectClass: simpleSecurityObject
userPassword: {SSHA}j0NpveEO0YD5rgI5kY8OxSRiN5KQ/kE4
description: Bind user for MQ broker

dn: ou=systems,dc=acme,dc=com
ou: systems
objectClass: organizationalUnit
objectClass: top

dn: ou=ActiveMQ,ou=systems,dc=acme,dc=com
objectClass: organizationalUnit
objectClass: top
ou: ActiveMQ

dn: ou=Destination,ou=ActiveMQ,ou=systems,dc=acme,dc=com
objectClass: organizationalUnit
objectClass: top
ou: Destination

dn: ou=Queue,ou=Destination,ou=ActiveMQ,ou=systems,dc=acme,dc=com
objectClass: organizationalUnit
objectClass: top
ou: Queue

dn: cn=com.acme.myfirstrealqueue,ou=Queue,ou=Destination,ou=ActiveMQ,ou=syst
 ems,dc=acme,dc=com
cn: com.acme.myfirstrealqueue
description: A queue
objectClass: applicationProcess
objectClass: top

dn: cn=admin,cn=com.acme.myfirstrealqueue,ou=Queue,ou=Destination,ou=ActiveM
 Q,ou=systems,dc=acme,dc=com
cn: admin
description: Admin privilege group, members are roles
member: cn=admin
member: cn=webapp
objectClass: groupOfNames
objectClass: top

dn: cn=read,cn=com.acme.myfirstrealqueue,ou=Queue,ou=Destination,ou=ActiveMQ
 ,ou=systems,dc=acme,dc=com
cn: read
member: cn=webapp
objectClass: groupOfNames
objectClass: top

dn: cn=write,cn=com.acme.myfirstrealqueue,ou=Queue,ou=Destination,ou=ActiveM
 Q,ou=systems,dc=acme,dc=com
cn: write
objectClass: groupOfNames
objectClass: top
member: cn=webapp

dn: ou=Topic,ou=Destination,ou=ActiveMQ,ou=systems,dc=acme,dc=co
 m
objectClass: organizationalUnit
objectClass: top
ou: Topic

dn: cn=ActiveMQ.Advisory.Consumer,ou=Topic,ou=Destination,ou=ActiveMQ,ou=sys
 tems,dc=acme,dc=com
cn: ActiveMQ.Advisory.Consumer
objectClass: applicationProcess
objectClass: top
description: Advisory topic about consumers

dn: cn=read,cn=ActiveMQ.Advisory.Consumer,ou=Topic,ou=Destination,ou=ActiveM
 Q,ou=systems,dc=acme,dc=com
cn: read
member: cn=webapp
objectClass: groupOfNames
objectClass: top

dn: cn=ActiveMQ.Advisory.TempQueue,ou=Topic,ou=Destination,ou=ActiveMQ,ou=sy
 stems,dc=acme,dc=com
cn: ActiveMQ.Advisory.TempQueue
description: Advisory topic about temporary queues
objectClass: applicationProcess
objectClass: top

dn: cn=read,cn=ActiveMQ.Advisory.TempQueue,ou=Topic,ou=Destination,ou=Active
 MQ,ou=systems,dc=acme,dc=com
cn: read
member: cn=webapp
objectClass: groupOfNames
objectClass: top

dn: cn=ActiveMQ.Advisory.TempTopic,ou=Topic,ou=Destination,ou=ActiveMQ,ou=sy
 stems,dc=acme,dc=com
cn: ActiveMQ.Advisory.TempTopic
objectClass: applicationProcess
objectClass: top
description: Advisory topic about temporary topics

dn: cn=read,cn=ActiveMQ.Advisory.TempTopic,ou=Topic,ou=Destination,ou=Active
 MQ,ou=systems,dc=acme,dc=com
cn: read
member: cn=webapp
objectClass: groupOfNames
objectClass: top

dn: ou=Group,ou=ActiveMQ,ou=systems,dc=acme,dc=com
objectClass: organizationalUnit
objectClass: top
ou: Group

dn: cn=admin,ou=Group,ou=ActiveMQ,ou=systems,dc=acme,dc=com
cn: admin
member: uid=admin
objectClass: groupOfNames
objectClass: top

dn: cn=webapp,ou=Group,ou=ActiveMQ,ou=systems,dc=acme,dc=com
cn: webapp
member: uid=webapp
objectClass: groupOfNames
objectClass: top

dn: ou=User,ou=ActiveMQ,ou=systems,dc=acme,dc=com
objectClass: organizationalUnit
objectClass: top
ou: User

dn: uid=admin,ou=User,ou=ActiveMQ,ou=systems,dc=acme,dc=com
uid: admin
userPassword: {SSHA}j0NpveEO0YD5rgI5kY8OxSRiN5KQ/kE4
objectClass: account
objectClass: simpleSecurityObject
objectClass: top

dn: uid=webapp,ou=User,ou=ActiveMQ,ou=systems,dc=acme,dc=com
uid: webapp
userPassword: {SSHA}j0NpveEO0YD5rgI5kY8OxSRiN5KQ/kE4
objectClass: account
objectClass: simpleSecurityObject
objectClass: top
</plain-text-body><p>4. Start up ActiveMQ</p><p>5. Test it out</p><h3>Security and ActiveMQ Components</h3><p>Along with the message broker, you can optionally execute several additional "components", such as Camel and/or the Web console. These components establish connections with the broker; therefore, if you have secured your broker (i.e., enabled authentication), you will have to configure these components in order to have them provide the required security credentials (username, password) when they connect to the broker.</p><h4>Camel</h4><p>You may have the following Camel context defined in your broker's XML configuration file.</p><parameter ac:name="">xml</parameter><plain-text-body>&lt;!--
  ** Lets deploy some Enterprise Integration Patterns inside the ActiveMQ Message Broker
  ** For more details see
  **
  ** http://activemq.apache.org/enterprise-integration-patterns.html --&gt;

  &lt;camelContext id="camel" xmlns="http://activemq.apache.org/camel/schema/spring"&gt;
       &lt;package&gt;org.foo.bar&lt;/package&gt;
        &lt;route&gt;
            &lt;from uri="activemq:example.A"/&gt;
            &lt;to uri="activemq:example.B"/&gt;
        &lt;/route&gt;
  &lt;/camelContext&gt;
</plain-text-body><p>The above configuration is not set up to work within a secure environment.</p><p>If the application is running in an OSGi container, add the following line before the CamelContext definition:</p><parameter ac:name="">xml</parameter><plain-text-body>&lt;osgi:reference id="activemq" interface="org.apache.camel.Component" /&gt;
</plain-text-body><p>This allows any pre-configured instance of the ActiveMQComponent deployed in the container to take precedence on the default ActiveMQComponent.</p><p>That is, with the above configuration, Camel will establish a connection with ActiveMQ, but will not provide a username and password. Therefore, when ActiveMQ security is enabled, the above configuration results in a security exception. The exception will be thrown multiple times, because Camel will continue to retry the connection. If you're not using Camel, comment out the above XML code. If you are using Camel, add the following bean definition to your broker's XML configuration:</p><parameter ac:name="">xml</parameter><plain-text-body>&lt;!-- configure the camel activemq component to use the current broker --&gt;
    &lt;bean id="activemq" class="org.apache.activemq.camel.component.ActiveMQComponent" &gt;
        &lt;property name="connectionFactory"&gt;
          &lt;bean class="org.apache.activemq.ActiveMQConnectionFactory"&gt;
            &lt;property name="brokerURL" value="vm://localhost?create=false&amp;amp;waitForStart=10000" /&gt;
            &lt;property name="userName" value="system"/&gt;
            &lt;property name="password" value="manager"/&gt;
          &lt;/bean&gt;
        &lt;/property&gt;
    &lt;/bean&gt;
</plain-text-body><p>With the above bean definition, Camel will pass the specified security credentials when it connects to the broker.</p><p>If the broker is running in an OSGi container, add the following line after the ActiveMQComponent bean definition:</p><parameter ac:name="">xml</parameter><plain-text-body>&lt;service ref="activemq" interface="org.apache.camel.Component"/&gt;
</plain-text-body><h4>Web Console</h4><p>If you want to use the Web Console with a secured broker, you have to change <code>connectionFactory</code> bean in your <code>webapps/admin/WEB-INF/webconsole-embeded.xml</code> to something like this:</p><parameter ac:name="">xml</parameter><plain-text-body>&lt;bean id="connectionFactory" class="org.apache.activemq.ActiveMQConnectionFactory"&gt;
    &lt;property name="brokerURL" value="vm://localhost"/&gt;
    &lt;property name="userName" value="system"/&gt;
    &lt;property name="password" value="manager"/&gt;
  &lt;/bean&gt;
</plain-text-body><h4>Default Credentials</h4><p>Starting with version 5.3, all of the above configuration details are included in the default ActiveMQ configuration. Also, there is a central place where you can set credentials that these components will use to connect to the broker. Just set your desired username and password in the <code>conf/credentials.properties</code> file, which by default looks like this:</p><plain-text-body>activemq.username=system
activemq.password=manager
</plain-text-body><h4>Encrypted Passwords</h4><p>As of version 5.4.1 you can also use <link><page ri:content-title="Encrypted passwords"></page></link> with your broker</p><h3>Message level Authorization</h3><p>It's also possible to authorize each single message using some content based authorization policy of your choosing. In comparison to the other security options described before, Message level Authorization requires a bit more than just some configuration. You have to start with creating a new maven project and add the&#160;<a shape="rect" href="https://mvnrepository.com/artifact/org.apache.activemq/activemq-all">activemq-all</a> maven dependency (in the same version as your activemq installation) to the pom.xml of your new project.<br clear="none">In the next step you have to create a new Java class and let it implement the org.apache.activemq.security.MessageAuthorizationPolicy interface. After that, simply add a method with signature:</p><p>public boolean isAllowedToConsume(ConnectionContext context, Message message){...}</p><p>to the new Java class. For usage of your own Message level Authorization policy, the Java class has to be packaged as jar and added to the /lib folder of ActiveMQ to make it available for ActiveMQ. In the last step, it has to be configured on the broker directly by using the * messageAuthorizationPolicy* property or add it to the XML as follows</p><parameter ac:name="">xml</parameter><plain-text-body>&lt;broker&gt;
  ..
  &lt;messageAuthorizationPolicy&gt;
    &lt;bean class="com.acme.MyMessageAuthorizationPolicy" xmlns=""/&gt;
  &lt;/messageAuthorizationPolicy&gt;
  ..
&lt;/broker&gt;
</plain-text-body><h2>Implementing your own custom Security Plugin</h2><p>All of the various security implementations are implemented as <link><page ri:content-title="Interceptors"></page></link> so its very easy to add your own custom implementation. Its probably easier to start with one of the <a shape="rect" href="http://activemq.apache.org/maven/apidocs/org/apache/activemq/security/package-summary.html">simple implementations</a> though if you are using JAAS you could derive from the <a shape="rect" href="http://activemq.apache.org/maven/apidocs/org/apache/activemq/jaas/package-summary.html">JAAS implementation</a>.</p><h3>Third Party Tools</h3><ul><li><a shape="rect" href="http://www.ttmsolutions.com/Apache_Software/ActiveMQ_LDAP_JDBC_Security_Plugins.php">ActiveMQ LDAP and JDBC Security Plugins from TTM Solutions</a></li></ul></div>