Under out CAP, we have a user, webctlmbuser, under allow users in the Normal column. This is the user that we use as the JMS Connection user Name in the outgoing http client setup in LMB. Im not completely sure were this user is created. We use the com_sct_ldi_sis_LmsSync (topic) destination for our connection, as it seems to have less un-needed traffic on it than com_sct_ldi_sis_Sync.
If you need something more specific let me know, I can poke our sys-admins who would know more about the backend setup of LMB.