The correct way to set up security for JMS is to go to the console, select ACLs in the tree view, then create some access control lists.

1. Set the ACL name which should be weblogic.jms.queue.QUEUENAME or weblogic.jms.topic.TOPICNAME.

2. Select Create.

3. Enter the New Permission of send or receive.

4. Select Create.

5. Enter a comma separated list of users or groups.

6. Select Grant Permission.

7. Select "saved to the realm implementation" to save your changes.

8. Select Yes.

This will update the fileRealm.properties file with lines that look like the following:

acl.send.weblogic.jms.queue.TestQueue1=user1

acl.receive.weblogic.jms.queue.TestQueue1=user1

If you don't have an ACL for a queue or topic, security is wide open.

There are also ACL's for accessing the JNDI context; the JNDI context is a requirement for initially accessing JMS. See the JNDI documentation.