Demo - Use JMS client anonymous access with Elytron

This demo shows how to use use the ANONYMOUS SASL authentication mechanism from Elytron as replacement for unauthenticatedIdentity login module option in WidlFly legacy security.

We want to send a message from JMS client without authentication, so we want to allow anonymous access and grant "guest" role (used in messaging-activemq configuration) to incoming clients.

The client code in this demo is based on helloworld-jms WildFly quickstart.

Prerequisities

WildFly 11.x

Download and install WildFly 11.x.

You can also build the server yourself:

git clone https://github.com/wildfly/wildfly.git
cd wildfly
mvn clean source:jar install -DskipTests -Dcheckstyle.skip -Denforcer.skip
cp -r dist/target/wildfly-11.*-SNAPSHOT /tmp/wildfly
export JBOSS_HOME=/tmp/wildfly

Configure the Application server

The configuration JBoss CLI script demo.cli contains commands to configure the server:

• enable Elytron across the server
• allow ANONYMOUS SASL mechanism for remoting connections
• remove part of Elytron configuration which is dropping LoginPermission from anonymous user
• add "guest" role mapper to the ApplicationDomain Elytron security domain
• add a test queue

Run the configuration script

The script starts embedded server itself, so you should not start it manually.

$JBOSS_HOME/bin/jboss-cli.sh --file=demo.cli

Client configuration

Custom wildfly-config.xml is used on classpath to allow all SASL mechanisms.

The important part is the authentication configuration which allows using of all SASL mechanisms available.

<configuration name="authn">
	<allow-all-sasl-mechanisms />
	<use-service-loader-providers />
</configuration>

Run the demo

Start the server (full profile)

$JBOSS_HOME/bin/standalone.sh -c standalone-full.xml

Run the JMS client

mvn clean package exec:java