Its important to note that starting from version 5.3.3, the legacy ACL 1.0 framework has been deprecated and removed. You must migrate to ACL 2.0. Additionally, ensure that the ROCKETMQ_HOME environment variable is correctly configured before starting the services.

Broker ACL 2.0 Configuration

Open the conf/broker.conf file and append the following properties to enable authentication and authorization:

# Enable Authentication
authenticationEnabled = true
authenticationMetadataProvider = org.apache.rocketmq.auth.authentication.provider.LocalAuthenticationMetadataProvider
authenticationStrategy = org.apache.rocketmq.auth.authentication.strategy.StatefulAuthenticationStrategy
# Enable Authorization
authorizationEnabled = true
authorizationMetadataProvider = org.apache.rocketmq.auth.authorization.provider.LocalAuthorizationMetadataProvider
authorizationStrategy = org.apache.rocketmq.auth.authorization.strategy.StatefulAuthorizationStrategy
# Define the initial superuser (automatically created on the first startup)
initAuthenticationUser = {"username":"rmq_admin","password":"SecureP@ss9"}
# Credentials for internal cluster communication (e.g., Broker synchronization)
innerClientAuthenticationCredentials = {"accessKey":"rmq_admin","secretKey":"SecureP@ss9"}

CLI Tools Configuration

Update the conf/tools.yml file to allow command-line tools to authenticate with the broker:

accessKey: rmq_admin
secretKey: SecureP@ss9

Launching the Services

For Windows environments, set the home directory and start the NameServer and Broker:

set ROCKETMQ_HOME=C:\software\rocketmq-5.4.0
start "NameServer" cmd /K call C:\software\rocketmq-5.4.0\bin\mqnamesrv.cmd
start "Broker" cmd /K call C:\software\rocketmq-5.4.0\bin\mqbroker.cmd -n 127.0.0.1:9876 -c C:\software\rocketmq-5.4.0\conf\broker.conf

For Linux/macOS environments:

export ROCKETMQ_HOME=/opt/rocketmq-5.4.0
nohup sh bin/mqnamesrv &
nohup sh bin/mqbroker -n localhost:9876 -c conf/broker.conf &

Spring Cloud Nacos Integration

If you are using Nacos for configuration management, add the following RocketMQ ACL properties to your global.yaml:

rocketmq:
  enable-acl: true
  producer:
    access-key: rmq_admin
    secret-key: SecureP@ss9

RocketMQ Dashboard Setup

Clone and build the dashboard from the official repository. Modify the application.yaml configuration file to include the NameServer address and ACL credentials:

rocketmq:
  config:
    namesrvAddrs:
      - 127.0.0.1:9876
    loginRequired: true
    accessKey: rmq_admin
    secretKey: SecureP@ss9

Next, configure the dashboard login credentials in the users.properties file. The format follows username=password,permissionLevel (where 0 represents a standard user and 1 represents an administrator):

dashboard_admin=SecureP@ss9,1

Start the dashboard application with the required parameters:

java -jar rocketmq-dashboard-2.1.0.jar --server.port=8082 --rocketmq.config.namesrvAddr=127.0.0.1:9876 --rocketmq.config.loginRequired=true --rocketmq.config.accessKey=rmq_admin --rocketmq.config.secretKey=SecureP@ss9

Creating Business Users and Grants (Optional)

If you require granular access control instead of relying solely on the superuser, you can create dedicated operators and assign specific privileges via the CLI:

# Register a new operator account
sh bin/mqadmin createUser -n 127.0.0.1:9876 -c DefaultCluster -u biz_operator -p OpP@ss123 -t Normal
# Grant full cluster administration rights
sh bin/mqadmin createAcl -n 127.0.0.1:9876 -c DefaultCluster -s User:biz_operator -r Cluster:DefaultCluster -a All -d Allow
# Grant management access to all topics
sh bin/mqadmin createAcl -n 127.0.0.1:9876 -c DefaultCluster -s User:biz_operator -r Topic:* -a All -d Allow
# Grant management access to all consumer groups
sh bin/mqadmin createAcl -n 127.0.0.1:9876 -c DefaultCluster -s User:biz_operator -r Group:* -a All -d Allow