User with only Read-Only Console permission? - activemq-artemis

Question

I would like to know if it is possible to add a user with "read-only" access to the Artemis Web console.
Right now we are in a point that is important to check if my application's consumer is created and connected to queues, if he is the only one connected, etc. And the easier place I can think of seein this is through Artemis Console. What I want is to create a user that can only see this information, the messages in the queues, etc., but cannot create new queues, send messages, purge queues, etc.
Is that possible?
I have tried following this tutorial to create a user and play around with the roles but for some reason I can't even connect to the console with my created user. I keep getting "Forbidden".
Thanks!
Edit
What I have tried:
I have updated artemis-users.properties to have the following users:
admin = ENC(1024:5C41928065C0AED5B88F8DD66937F86F59BCF9F6BAC9097CD12C6D66FE83DC3B:DC9FCEECBBCB4849F3AE9570D83C8ABFDB1E03B0318F7B4BA128B9A174C00049C817FB2F7613D4A332BA1D1FF14C70F1E0492EECE747A6C7881E358F44CDB02C)
amqviewer = 123abc
The admin user was created when I have set up the broker. The amqviewer is the user I'm trying to have read-only permissions.
On the artemis-roles.properties I have set the amqviewer to have the viewer role (at least thats what I think after seeing how it was for the admin user):
amq = admin
viewer = amqviewer
and on the management.xml I have set the following:
<authorisation>
<whitelist>
<entry domain="hawtio"/>
</whitelist>
<default-access>
<access method="list*" roles="amq"/>
<access method="get*" roles="amq"/>
<access method="is*" roles="amq"/>
<access method="set*" roles="amq"/>
<access method="*" roles="amq"/>
</default-access>
<role-access>
<match domain="org.apache.activemq.artemis">
<access method="list*" roles="amq"/>
<access method="get*" roles="amq"/>
<access method="is*" roles="amq"/>
<access method="set*" roles="amq"/>
<access method="*" roles="amq"/>
</match>
<match domain="org.apache.activemq.artemis">
<access method="list*" roles="viewer"/>
<access method="get*" roles="viewer"/>
</match>
</role-access>
</authorisation>
The thing is, I can't even get past the login. When I try to login with the amqviewer user, I get forbidden.

Answer 1

To allow only read access in the webconsole, the role needs to be set in the management.xml and in the artemis.profile.
To configure the role readonly, Update the management.xml and artemis.profile as below.
<role-access>
<match domain="org.apache.activemq.artemis">
<access method="list*" roles="readonly,amq"/>
<access method="get*" roles="readonly,amq"/>
<access method="is*" roles="readonly,amq"/>
<access method="set*" roles="update,amq"/>
<access method="*" roles="amq"/>
</match>
</role-access>
in artemis.profile: -Dhawtio.roles=amq,readonly
Refer: https://activemq.apache.org/components/artemis/documentation/latest/management.html.
Edit (as i am not able to reply in comment):
Everything you have done so far is right. you just need to the role "readonly" in the artemis.profile for the hawtio role.
in artemis.profile: -Dhawtio.roles=amq,readonly
you can verify whether you added successfully by the broker startup log. it will display as below.
2019-05-06 10:45:24,655 INFO [io.hawt.web.AuthenticationFilter] Starting hawtio authentication filter, JAAS realm: "activemq" authorized role(s): "admin,readonly" role principal classes: "org.apache.activemq.artemis.spi.core.security.jaas.RolePrincipal"