Subscribe to JMS Messages

Unpack the ActiveMQ binary. For example:

tar -zxvf ~/Downloads/apache-activemq-5.15.13-bin.tar.gz

Create a temporary directory, move the ActiveMQ Client, and bnd JAR files to that directory, then change to that directory:

mkdir ~/Downloads/tmp
mv activemq-client-5.15.13.jar ~/Downloads/tmp/
mv biz.aQute.bnd-version.jar ~/Downloads/tmp/
cd ~/Downloads/tmp/

Create an OSGi bundle as follows:

1. In a text editor, create a BND file named activemq.bnd and save it to the current directory. The file should have the following contents:

   version=5.15.13
   Export-Package: *;version=${version}
   Bundle-Name: ActiveMQ :: Client
   Bundle-SymbolicName: org.apache.activemq
   Bundle-Version: ${version}

   Your tmp/ directory should now contain the following files:

   ls ~/Downloads/tmp/
   activemq-client-5.15.13.jar	activemq.bnd			biz.aQute.bnd-version.jar

2. In that same directory, create the OSGi bundle archive file as follows:

   java -jar biz.aQute.bnd-version.jar \
   wrap --properties activemq.bnd \
   --output activemq-client-5.15.13-osgi.jar \
   activemq-client-5.15.13.jar

Copy the resulting activemq-client-5.15.13-osgi.jar file to the openidm/bundle directory:

cp activemq-client-5.15.13-osgi.jar /path/to/openidm/bundle/

Copy the Apache Geronimo, hawtbuf, and JmDNS JAR files to the openidm/bundle directory:

cp ~/Downloads/geronimo-j2ee-management_1.1_spec-1.0.1.jar /path/to/openidm/bundle/
cp ~/Downloads/hawtbuf-1.11.jar /path/to/openidm/bundle/
cp ~/Downloads/jmdns-3.4.1.jar /path/to/openidm/bundle

Your IDM instance is now ready for you to configure the JMS audit event handler.

In the directory where you unpacked ActiveMQ, edit the conf/activemq.xml file as follows:

Delete the existing self-signed server certificate from the ActiveMQ keystore and truststore:

keytool \
-delete \
-keystore /path/to/activeMQ/conf/broker.ts \
-alias broker-localhost
Enter keystore password: password
keytool \
-delete \
-keystore /path/to/activeMQ/conf/broker.ks \
-alias broker-localhost
Enter keystore password: password

Generate a new self-signed server certificate for ActiveMQ:

keytool \
-genkey \
-keyalg RSA \
-alias broker-localhost \
-keystore /path/to/activeMQ/conf/broker.ks \
-storepass password \
-validity 360 \
-keysize 2048

Export the ActiveMQ server certificate:

keytool \
-export \
-alias broker-localhost \
-file broker-localhost.key \
-keystore /path/to/activeMQ/conf/broker.ks
Enter keystore password: password
Certificate stored in file <broker-localhost.key>

Import the ActiveMQ server certificate into the IDM truststore:

keytool \
-import \
-alias activemq \
-keystore /path/to/openidm/security/truststore \
-file broker-localhost.key
Enter keystore password: changeit
Owner: CN=localhost, OU=Unknown, O=example.com, L=Unknown, ST=Unknown, C=Unknown
Issuer: CN=localhost, OU=Unknown, O=example.com, L=Unknown, ST=Unknown, C=Unknown
...
Trust this certificate? [no]: yes
Certificate was added to keystore

Edit /path/to/openidm/samples/scripted-jms-subscriber/conf/audit.json, as follows:

"java.naming.provider.url" : "ssl://localhost:61617?daemon=true"

Edit /path/to/openidm/samples/scripted-jms-subscriber/conf/messaging.json, as follows:

"java.naming.provider.url" : "ssl://localhost:61617?daemon=true"

Navigate to the directory where you unpacked the ActiveMQ binary and run the following command to start the ActiveMQ broker:

cd ~/Downloads/apache-activemq-5.15.13
bin/activemq start
INFO: Loading '/path/to/Downloads/apache-activemq-5.15.13/bin/env'
INFO: Using java '/usr/bin/java'
INFO: Starting - inspect logfiles specified in logging.properties and log4j.properties to get details
INFO: pidfile created : '/path/to/Downloads/apache-activemq-5.15.13/data/activemq.pid' (pid '69627')

Start IDM, with the configuration for this sample:

cd /path/to/openidm/
./startup.sh -p samples/scripted-jms-subscriber

Go to the ActiveMQ Console at http://localhost:8161/admin/topics.jsp, and verify audit messages are being created and sent to the forgerock.idm.audit audit topic.

Access the ActiveMQ web console, at http://localhost:8161/admin. Log in as an administrator; the default administrative user and password are admin and admin.

In the ActiveMQ web console, in the Queue Name text box, enter the value of idmQ from the conf/messaging.json file. The default value for queue.idmQ and destinationName is idmQ. Enter that value and select Create.

In the Queues window for the idmQ queue, select the Send To link under Operations.

You should see a Send a JMS Message window, with a Message body text box towards the bottom.

Copy the following text, a payload to create a new user with a user ID of mgr1, to the Message body text box:

{
  "operation" : "CREATE",
  "resourceName" : "/managed/user",
  "newResourceId" : "mgr1",
  "content" : {
    "mail" : "mgr1@example.com",
    "sn" : "Sanchez",
    "givenName" : "Jane",
    "password" : "Password1",
    "employeenumber" : 100,
    "accountStatus" : "active",
    "roles" : [ ],
    "userName" : "mgr1"
  },
  "params" : {},
  "fields" : [ "*", "*_ref" ]
}

For comparison, note the following equivalent REST call to create the same user:

curl \
--header "X-OpenIDM-Username: openidm-admin" \
--header "X-OpenIDM-Password: openidm-admin" \
--header "Accept-API-Version: resource=1.0" \
--header "Content-Type: application/json" \
--request POST \
--data '{
  "mail" : "mgr1@example.com",
  "sn" : "Sanchez",
  "givenName" : "Jane",
  "password" : "Password1",
  "employeenumber" : 100,
  "accountStatus" : "active",
  "roles" : [ ],
  "userName" : "mgr1",
  "params" : {},
  "fields" : [ "*", "*_ref" ]
}' \
"http://localhost:8080/openidm/managed/user?_action=create"

Observe the OSGi console. You should see output in two parts. The first part starts with:

*****request received******
Parsed JMS JSON =
... 

The first part should include a JSON-formatted replay of the request that you entered in the Message body text box.

The second part of the output includes information for that same user, as written to the managed user repository.

Confirm that user either in the Admin UI, or using the following REST call:

curl \
--header "X-OpenIDM-Username: openidm-admin" \
--header "X-OpenIDM-Password: openidm-admin" \
--header "Accept-API-Version: resource=1.0" \
--request GET \
"http://localhost:8080/openidm/managed/user/mgr1"

Repeat the process to create additional users. Try a different REST function. For example, you can enter the following payload in the ActiveMQ UI Message body text box, to change the first name (givenName) of the mgr1 user to Donna:

{
  "operation": "PATCH",
  "resourceName": "/managed/user/mgr1",
  "value": [
    {
      "operation": "replace",
      "field": "/givenName",
      "value": "Donna"
    }
  ]
}