Re: Native Oauth/OIDC integration in ActiveMQ

2023-10-31 Thread barry haycock
I've been trying to get the jetty implementation working with keycloak for a while now. It would be good to get that side working with Oidc On Wed, 1 Nov 2023, 06:17 SCOTT FIELDS, wrote: > To my knowledge, there is no native ActiveMQ integration for > Authorization/Authentication via Oauth/OIDC

Re: CVE-2023-46604: Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack

2023-10-31 Thread Scott Weikart
UNSUBSCRIBE On Fri, Oct 27, 2023 at 2:08 PM Christopher L. Shannon wrote: > Affected versions: > > - Apache ActiveMQ 5.18.0 before 5.18.3 > - Apache ActiveMQ 5.17.0 before 5.17.6 > - Apache ActiveMQ 5.16.0 before 5.16.7 > - Apache ActiveMQ before 5.15.16 > - Apache ActiveMQ Legacy OpenWire Modul

Re: Native Oauth/OIDC integration in ActiveMQ

2023-10-31 Thread Łukasz Dywicki
Have a look on https://github.com/apifocal/activemix/tree/master/jaas/activemix-auth-token. I've wrote this code a long time ago, it didn't change much since it simply works. ;) It does rely on JWT/OIDC and can stick with external JWK (i.e. hosted by keycloak) to verify token signatures. Che

RE: Native Oauth/OIDC integration in ActiveMQ

2023-10-31 Thread SCOTT FIELDS
Yes, using certificate based authentication/authorization is a secondary approved method if OIDC isn't supported for this customer. But...I wanted to pursue the OIDC mechanism, since that's the customer's primary solution. -Original Message- From: Matt Pavlovich Sent: Tuesday, October

Re: Native Oauth/OIDC integration in ActiveMQ

2023-10-31 Thread Matt Pavlovich
Hi Scott- There is interest in adding this to Apache ActiveMQ. A DRAFT RP was started using JWT: https://github.com/apache/activemq/pull/1035 In general, using OAuth/OIDC may not be desirable as having background threads refreshing tokens can have negative side effects. The OAuth2 "AppAuth pat

Re: Native Oauth/OIDC integration in ActiveMQ

2023-10-31 Thread Justin Bertram
What messaging client implementation(s) and protocol(s) will your customer be using? What's their use-case? Justin On Tue, Oct 31, 2023 at 2:34 PM SCOTT FIELDS wrote: > Only that our customer is migrating to cloud solutions and their desired > authentication/authorization service will be desir

RE: Native Oauth/OIDC integration in ActiveMQ

2023-10-31 Thread SCOTT FIELDS
Only that our customer is migrating to cloud solutions and their desired authentication/authorization service will be desired to use OIDC (OpenID Connect). -Original Message- From: Justin Bertram Sent: Tuesday, October 31, 2023 2:29 PM To: users@activemq.apache.org Subject: [EXTERNAL

Re: Native Oauth/OIDC integration in ActiveMQ

2023-10-31 Thread Justin Bertram
As far as I'm aware, using JAAS *is* the "native" way to integrate with security providers in both "Classic" and Artemis. I don't believe an Oauth JAAS login module is being developed in the community. For what it's worth, most messaging protocols and/or clients don't support Oauth anyway. Is the

Native Oauth/OIDC integration in ActiveMQ

2023-10-31 Thread SCOTT FIELDS
To my knowledge, there is no native ActiveMQ integration for Authorization/Authentication via Oauth/OIDC. Is there any plan, if not, to include this, besides requiring an external JAAS method provided either by an external vendor or require a custom coding front-end from the end-use provider?