This class represents a JAAS based implementation of the JMXAuthenticator interface.

Authentication is performed by passing the supplied user's credentials to one or more authentication mechanisms (LoginModule) for verification. An authentication mechanism acquires the user's credentials by calling NameCallback and/or PasswordCallback. If authentication is successful then an authenticated Subject filled in with a Principal is returned. Authorization checks will then be performed based on this Subject.

By default, a single file-based authentication mechanism FileLoginModule is configured (FileLoginConfig).

To override the default configuration use the com.sun.management.jmxremote.login.config management property described in the JRE/conf/management/management.properties file. Set this property to the name of a JAAS configuration entry and ensure that the entry is loaded by the installed Configuration. In addition, ensure that the authentication mechanisms specified in the entry acquire the user's credentials by calling NameCallback and PasswordCallback and that they return a Subject filled-in with a Principal, for those users that are successfully authenticated.

Nested and Inner Type Summary

Modifier and Type	Class and Description
private static class	JMXPluggableAuthenticator.FileLoginConfig This class defines the JAAS configuration for file-based authentication.
private class	JMXPluggableAuthenticator.JMXCallbackHandler This callback handler supplies the username and password (which was originally supplied by the JMX user) to the JAAS login module performing the authentication.

Field Summary

Modifier and Type	Field and Description
private static final String	HASH_PASSWORDS
private static final ClassLogger	logger
private static final String	LOGIN_CONFIG_NAME
private static final String	LOGIN_CONFIG_PROP
private LoginContext	loginContext
private String	password
private static final String	PASSWORD_FILE_PROP
private String	username

Access	Constructor and Description
public	JMXPluggableAuthenticator(Map<?, ?> the environment containing configuration properties for the authenticator. Can be null, which is equivalent to an empty Map. env) Creates an instance of `JMXPluggableAuthenticator` and initializes it with a `LoginContext`.

Method Summary

Modifier and Type	Method and Description
public Subject	Returns: the authenticated subject containing a `JMXPrincipal(username)`. authenticate(Object the user-defined credentials to be passed in to the server in order to authenticate the user before creating the `MBeanServerConnection`. This parameter must be a two-element `String[]` containing the client's username and password in that order. credentials) Implements javax.management.remote.JMXAuthenticator.authenticate. Authenticate the `MBeanServerConnection` client with the given client credentials.
private static void	authenticationFailure(String method, String message)
private static void	authenticationFailure(String method, Exception exception)
private static void	logException(String method, String message, Exception e)

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

HASH_PASSWORDS	back to summary
private static final String HASH_PASSWORDS

logger	back to summary
private static final ClassLogger logger

LOGIN_CONFIG_NAME	back to summary
private static final String LOGIN_CONFIG_NAME

LOGIN_CONFIG_PROP	back to summary
private static final String LOGIN_CONFIG_PROP

loginContext	back to summary
private LoginContext loginContext

password	back to summary
private String password

PASSWORD_FILE_PROP	back to summary
private static final String PASSWORD_FILE_PROP

username	back to summary
private String username

JMXPluggableAuthenticator	back to summary
public JMXPluggableAuthenticator(Map<?, ?> env) Creates an instance of `JMXPluggableAuthenticator` and initializes it with a `LoginContext`. Parameters env:Map<?, ?> the environment containing configuration properties for the authenticator. Can be null, which is equivalent to an empty Map. Exceptions SecurityException: if the authentication mechanism cannot be initialized.

Method Detail

authenticate back to summary

authenticate	back to summary
public Subject authenticate(Object credentials) Implements javax.management.remote.JMXAuthenticator.authenticate. Authenticate the `MBeanServerConnection` client with the given client credentials. Parameters credentials:Object the user-defined credentials to be passed in to the server in order to authenticate the user before creating the `MBeanServerConnection`. This parameter must be a two-element `String[]` containing the client's username and password in that order. Returns:Subject the authenticated subject containing a `JMXPrincipal(username)`. Exceptions SecurityException: if the server cannot authenticate the user with the provided credentials.

public Subject authenticate(Object credentials)

Implements javax.management.remote.JMXAuthenticator.authenticate.

Authenticate the MBeanServerConnection client with the given client credentials.

Parameters

credentials:Object: the user-defined credentials to be passed in to the server in order to authenticate the user before creating the MBeanServerConnection. This parameter must be a two-element String[] containing the client's username and password in that order.

Returns:Subject

the authenticated subject containing a JMXPrincipal(username).

Exceptions

SecurityException:: if the server cannot authenticate the user with the provided credentials.

authenticationFailure	back to summary
private static void authenticationFailure(String method, String message) throws SecurityException

authenticationFailure	back to summary
private static void authenticationFailure(String method, Exception exception) throws SecurityException

logException	back to summary
private static void logException(String method, String message, Exception e)

com.sun.jmx.remote.security back to summary

private Class JMXPluggableAuthenticator.FileLoginConfig

Class Inheritance

extends Configuration

java.lang.Object
javax.security.auth.login.Configuration
com.sun.jmx.remote.security.JMXPluggableAuthenticator.FileLoginConfig

This class defines the JAAS configuration for file-based authentication. It is equivalent to the following textual configuration entry:

    JMXPluggableAuthenticator {
        com.sun.jmx.remote.security.FileLoginModule required;
    };

Field Summary

Modifier and Type	Field and Description
private AppConfigurationEntry[]	entries
private static final String	FILE_LOGIN_MODULE
private static final String	HASH_PASSWORDS
private static final String	PASSWORD_FILE_OPTION

Constructor Summary

Access	Constructor and Description
public	FileLoginConfig(String A filepath that identifies the password file to use. If null then the default password file is used. passwordFile, String Flag to indicate if the password file needs to be hashed hashPasswords) Creates an instance of `FileLoginConfig`

Method Summary

Modifier and Type	Method and Description
public AppConfigurationEntry[]	getAppConfigurationEntry(String name) Implements abstract javax.security.auth.login.Configuration.getAppConfigurationEntry. Gets the JAAS configuration for file-based authentication
public void	refresh() Overrides javax.security.auth.login.Configuration.refresh. Refreshes the configuration.

Inherited from javax.security.auth.login.Configuration:: getConfiguration getInstance getInstance getInstance getParameters getProvider getType setConfiguration

Field Detail

entries	back to summary
private AppConfigurationEntry[] entries

FILE_LOGIN_MODULE	back to summary
private static final String FILE_LOGIN_MODULE

HASH_PASSWORDS	back to summary
private static final String HASH_PASSWORDS

PASSWORD_FILE_OPTION	back to summary
private static final String PASSWORD_FILE_OPTION

Constructor Detail

FileLoginConfig back to summary

FileLoginConfig	back to summary
public FileLoginConfig(String passwordFile, String hashPasswords) Creates an instance of `FileLoginConfig` Parameters passwordFile:String A filepath that identifies the password file to use. If null then the default password file is used. hashPasswords:String Flag to indicate if the password file needs to be hashed

public FileLoginConfig(String passwordFile, String hashPasswords)

Creates an instance of FileLoginConfig

Parameters

passwordFile:String: A filepath that identifies the password file to use. If null then the default password file is used.
hashPasswords:String: Flag to indicate if the password file needs to be hashed

Method Detail

getAppConfigurationEntry	back to summary
public AppConfigurationEntry[] getAppConfigurationEntry(String name) Implements abstract javax.security.auth.login.Configuration.getAppConfigurationEntry. Gets the JAAS configuration for file-based authentication

getAppConfigurationEntry

back to summary

public AppConfigurationEntry[] getAppConfigurationEntry(String name)

Implements abstract javax.security.auth.login.Configuration.getAppConfigurationEntry.

Gets the JAAS configuration for file-based authentication

refresh	back to summary
public void refresh() Overrides javax.security.auth.login.Configuration.refresh. Refreshes the configuration.

refresh

back to summary

public void refresh()

Overrides javax.security.auth.login.Configuration.refresh.

Refreshes the configuration.

com.sun.jmx.remote.security back to summary

private final Class JMXPluggableAuthenticator.JMXCallbackHandler

Class Inheritance

extends Object
implements CallbackHandler

java.lang.Object
com.sun.jmx.remote.security.JMXPluggableAuthenticator.JMXCallbackHandler

All Implemented Interfaces

javax.security.auth.callback.CallbackHandler

This callback handler supplies the username and password (which was originally supplied by the JMX user) to the JAAS login module performing the authentication. No interactive user prompting is required because the credentials are already available to this class (via its enclosing class).

Constructor Summary

Access	Constructor and Description
private	JMXCallbackHandler()

Method Summary

Modifier and Type	Method and Description
public void	handle(Callback[] callbacks) Implements javax.security.auth.callback.CallbackHandler.handle. Sets the username and password in the appropriate Callback object.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Constructor Detail

JMXCallbackHandler	back to summary
private JMXCallbackHandler()

Method Detail

handle back to summary

handle	back to summary
public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException Implements javax.security.auth.callback.CallbackHandler.handle. Sets the username and password in the appropriate Callback object. Exceptions IOException: Doc from javax.security.auth.callback.CallbackHandler.handle. if an input or output error occurs. UnsupportedCallbackException: Doc from javax.security.auth.callback.CallbackHandler.handle. if the implementation of this method does not support one or more of the Callbacks specified in the `callbacks` parameter.