User: XYZ does not have permission='SEND' on address - activemq-artemis

Question

I am able to authenticate via web console as well as via the bin/artemis producer command with credentials from my LDAP server. When I use the same credentials with mosquitto_pub to the same topic the log says
User: $username does not have permission='SEND' on address $address"
I've verified the resolved roles in the logs as well - they are the same for mosquitto_pub as for artemis producer. In my case they resolve a producer role which has admin privileges.
Is there any difference in authorization depending on the protocols? As it seems the authorization works for the CORE protocol and also for AMQP (I've tested both via artemis producer).
Unfortunately I cannot cross-check that with the artemis producer --protocol MQTT - this fails with "protocol MQTT not supported".

Answer 1

As noted in the documentation, the legacy admin permission is not mapped to the send permission:
ActiveMQ 5.x only has 3 permission types - read, write, and admin. These permission types are described on their website. However, as described previously, ActiveMQ Artemis has 9 permission types - createAddress, deleteAddress, createDurableQueue, deleteDurableQueue, createNonDurableQueue, deleteNonDurableQueue, send, consume, browse, and manage. Here's how the old types are mapped to the new types:
read - consume, browse
write - send
admin - createAddress, deleteAddress, createDurableQueue, deleteDurableQueue, createNonDurableQueue, deleteNonDurableQueue, manage (if mapAdminToManage is true)
Therefore, your producer role needs the write permission.
It's not clear why the producer command is working for other protocols (i.e. core & AMQP), but based on what you've provided I believe this is why it isn't working for MQTT.