title: Configuring authorization for activemq
body: <p>I'm writing a test application using <code>ActiveMQ embedded broker</code> on the same machine. I tried to configure it as follows:</p>
  
  <p><code>activemq.xml</code>:</p>
  
  <pre><code>&lt;amq:broker  useJmx="false" persistent="false"&gt;
      &lt;amq:transportConnectors&gt;
        &lt;amq:transportConnector uri="tcp://localhost:61616" /&gt;
      &lt;/amq:transportConnectors&gt;
  &lt;/amq:broker&gt;
  
  &lt;amq:simpleAuthenticationPlugin &gt;
      &lt;amq:users&gt;
          &lt;amq:authenticationUser username="system" password="manager"
            groups="users,admins" /&gt;
      &lt;/amq:users&gt;
  &lt;/amq:simpleAuthenticationPlugin&gt;
  </code></pre>
  
  <p>Tomcat's <code>context.xml</code>: !!The Password is deliberately incorrect!!</p>
  
  <pre><code>&lt;Resource name="jms/ConnectionFactory" auth="Container" userName="userssname" password="passwords"
      type="org.apache.activemq.ActiveMQConnectionFactory" description="JMS Connection Factory"
      factory="org.apache.activemq.jndi.JNDIReferenceFactory" brokerURL="tcp://localhost:61616"
      brokerName="LocalActiveMQBroker" /&gt;
  </code></pre>
  
  <p>But, when I try to perform injection I can easily create a <code>ConnectionFactory</code> object and send/receive messages even with incorrect password. How can I deny this?</p>