Restrict access for some methods to special role in ActiveMQ Artemis web console

I have the situation that have user viewer that must have read-only access to ActiveMQ Artemis console.

1. Create group view
2. Created user viewer
3. Added to artemis profail with console access
4. Restricted operation with management.xml
5. viewer cannot use update operations in Operations tab Works.

Issue: If you open "Queues" table on the main tab then the user is able to open queue and delete messages by "Delete Messages" button.

Temporary solution: Editing file jolokia-access.xml

<?xml version="1.0" encoding="utf-8"?>
<restrict>
    <cors>
        <allow-origin>*://*</allow-origin>
        <strict-checking/>
    </cors>    
    <deny>
        <mbean>
            <name>org.apache.activemq.artemis:broker="0.0.0.0",component=addresses,address="*",subcomponent=queues,routing-type="*",queue="*"</name>
            <operation>*move*</operation>
        </mbean>
    </deny>
</restrict>

Now nobody can use any operation with move pattern.

How I can restrict the operations for viewer user only?

You should use management.xml if you want to customize management access for particular roles, e.g.:

<role-access>
   <match domain="org.apache.activemq.artemis">
      <access method="list*" roles="view,amq"/>
      <access method="get*" roles="view,amq"/>
      <access method="is*" roles="view,amq"/>
      <access method="set*" roles="amq"/>
      <!-- Note count and browse are need to access the browse tab in the console -->
      <access method="browse*" roles="view,amq"/>
      <access method="count*" roles="view,amq"/>
      <access method="*" roles="amq"/>
   </match>
</role-access>

Using this configuration anybody in the view role accessing any MBean in the org.apache.activemq.artemis domain can execute operations named with the following patterns:

• list*
• get*
• is*
• browse*
• count*

Such users will not be able to execute any other operations.

Any user in the amq role will have full access to all operations.