[
https://issues.apache.org/jira/browse/AMQ-9300?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17762351#comment-17762351
]
Nicolas Filotto edited comment on AMQ-9300 at 9/6/23 11:31 AM:
---------------------------------------------------------------
Actually, this problem is due to the fact that the default
{{jolokia-access.xml}} has been modified between 5.17.3 and 5.17.4 by AMQ-9201
for something more restrictive than it used to be indeed, the commands
{{write}} and {{exec}} are now forbidden by default. To fix your problem, you
will need to add at least {{exec}} to the list of commands allowed or simply
remove the restrictions on the list of commands allowed by removing it as next:
{code:xml}
<restrict>
<!-- Enforce that an Origin/Referer header is present to prevent CSRF -->
<cors>
<strict-checking/>
</cors>
<!-- By default don't allow write or exec operations -->
<!--commands>
<command>read</command>
<command>list</command>
<command>version</command>
<command>search</command>
</commands-->
<allow>
<!-- Allow all operations for the broker itself -->
<mbean>
<name>org.apache.activemq:*</name>
<attribute>*</attribute>
<operation>*</operation>
</mbean>
<!-- Allow all operations for Jolokia Config -->
<mbean>
<name>jolokia:type=Config</name>
<operation>*</operation>
</mbean>
</allow>
<!-- deny all operations or getting attributes from these mbeans -->
<deny>
<mbean>
<name>org.apache.logging.log4j2:*</name>
<attribute>*</attribute>
<operation>*</operation>
</mbean>
<mbean>
<name>com.sun.management:type=DiagnosticCommand</name>
<attribute>*</attribute>
<operation>*</operation>
</mbean>
<mbean>
<name>com.sun.management:type=HotSpotDiagnostic</name>
<attribute>*</attribute>
<operation>*</operation>
</mbean>
<mbean>
<name>jdk.management.jfr:type=FlightRecorder</name>
<attribute>*</attribute>
<operation>*</operation>
</mbean>
</deny>
</restrict>
{code}
was (Author: JIRAUSER285918):
Actually, this problem is due to the fact that the default
{{jolokia-access.xml}} has been modified between 5.17.3 and 5.17.4 by AMQ-9201
for something more restrictive than it used to be indeed, the commands
{{write}} and {{exec}} are now forbidden by default. To fix your problem, you
will need to add at least {{exec}} to the list of commands allowed or simply
remove the restrictions on the list of commands allowed by removing it as next:
{code:xml}
<restrict>
<!-- Enforce that an Origin/Referer header is present to prevent CSRF -->
<cors>
<strict-checking/>
</cors>
<allow>
<!-- Allow all operations for the broker itself -->
<mbean>
<name>org.apache.activemq:*</name>
<attribute>*</attribute>
<operation>*</operation>
</mbean>
<!-- Allow all operations for Jolokia Config -->
<mbean>
<name>jolokia:type=Config</name>
<operation>*</operation>
</mbean>
</allow>
<!-- deny all operations or getting attributes from these mbeans -->
<deny>
<mbean>
<name>org.apache.logging.log4j2:*</name>
<attribute>*</attribute>
<operation>*</operation>
</mbean>
<mbean>
<name>com.sun.management:type=DiagnosticCommand</name>
<attribute>*</attribute>
<operation>*</operation>
</mbean>
<mbean>
<name>com.sun.management:type=HotSpotDiagnostic</name>
<attribute>*</attribute>
<operation>*</operation>
</mbean>
<mbean>
<name>jdk.management.jfr:type=FlightRecorder</name>
<attribute>*</attribute>
<operation>*</operation>
</mbean>
</deny>
</restrict>
{code}
> hawtio console embedded in ActiveMQ classic showing only connect button
> -----------------------------------------------------------------------
>
> Key: AMQ-9300
> URL: https://issues.apache.org/jira/browse/AMQ-9300
> Project: ActiveMQ
> Issue Type: Bug
> Components: Web Console
> Affects Versions: 5.17.4, 5.17.5, 5.18.2
> Reporter: Gianandrea Rigoni
> Priority: Major
> Attachments: 260776996-d66d2565-7534-4685-8e8a-4f3704c80df3.png
>
>
> hello folks
> *what worked*
> with versions
> ActiveMQ 5.17.3 and jetty JAAS jar 9.4.49.v20220914
> HAWTIO from version 2.16.3 to 2.17.6
> I am able +flawlessly to display HAWTIO+ console with all the queues
> (long ago I started to use instructions from
> https://bennet-schulz.com/2016/07/apache-activemq-and-hawtio.html)
> (I've LDAP plugin installed for the authentication)
> *now the problem*
> since AMQ 5.17.4 (jetty JAAS jar 9.4.50.v20221201) and HAWTIO from version
> 2.16.3 to 2.17.6:
> the only thing that I get in browser is shown in attached screenshot
> i.e. the add connection button
> also AMQ versions 5.17.5 and 5.18.2 show the same behaviour
> in both cases ("hawtio working" and "hawtio non working") AMQ broker and
> jolokia are functioning as expected)
> is this a bug or I missed some breaking changes?
> thanks for any advice
> best regards
> Gianandrea
> PS: not knowing/understanding where the problem is, I've reported it in
> hawtio project(https://github.com/hawtio/hawtio/issues/2917) too
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
