An object of this class implements the MBeanServerAccessController interface and, for each of its methods, calls an appropriate checking method and then forwards the request to a wrapped MBeanServer object. The checking method may throw a SecurityException if the operation is not allowed; in this case the request is not forwarded to the wrapped object.

This class implements the checkRead(), checkWrite(), checkCreate(String), and checkUnregister(ObjectName) methods based on an access level properties file containing username/access level pairs. The set of username/access level pairs is passed either as a filename which denotes a properties file on disk, or directly as an instance of the Properties class. In both cases, the name of each property represents a username, and the value of the property is the associated access level. Thus, any given username either does not exist in the properties or has exactly one access level. The same access level can be shared by several usernames.

The supported access level values are readonly and readwrite. The readwrite access level can be qualified by one or more clauses, where each clause looks like create classNamePattern or unregister. For example:

monitorRole  readonly
controlRole  readwrite \
             create javax.management.timer.*,javax.management.monitor.* \
             unregister

(The continuation lines with \ come from the parser for Properties files.)

Modifier and Type	Class and Description
private static class	MBeanServerFileAccessController.Access
private static enum	MBeanServerFileAccessController.AccessType
private static class	MBeanServerFileAccessController.Parser

Modifier and Type	Field and Description
private String	accessFileName
private Map<String, MBeanServerFileAccessController.Access>	accessMap
pack-priv static final String	CREATE
private Properties	originalProps
pack-priv static final String	READONLY
pack-priv static final String	READWRITE
pack-priv static final String	UNREGISTER

Constructor Summary

Access	Constructor and Description
public	MBeanServerFileAccessController(String name of the file which denotes a properties file on disk containing the username/access level entries. accessFileName) Create a new MBeanServerAccessController that forwards all the MBeanServer requests to the MBeanServer set by invoking the `setMBeanServer` method after doing access checks based on read and write permissions.
public	MBeanServerFileAccessController(String name of the file which denotes a properties file on disk containing the username/access level entries. accessFileName, MBeanServer the MBeanServer object to which requests will be forwarded. mbs) Create a new MBeanServerAccessController that forwards all the MBeanServer requests to `mbs` after doing access checks based on read and write permissions.
public	MBeanServerFileAccessController(Properties properties list containing the username/access level entries. accessFileProps) Create a new MBeanServerAccessController that forwards all the MBeanServer requests to the MBeanServer set by invoking the `setMBeanServer` method after doing access checks based on read and write permissions.
public	MBeanServerFileAccessController(Properties properties list containing the username/access level entries. accessFileProps, MBeanServer the MBeanServer object to which requests will be forwarded. mbs) Create a new MBeanServerAccessController that forwards all the MBeanServer requests to the MBeanServer set by invoking the `setMBeanServer` method after doing access checks based on read and write permissions.

Method Summary

Modifier and Type	Method and Description
private synchronized void	checkAccess(MBeanServerFileAccessController.AccessType requiredAccess, String arg)
public void	checkCreate(String className) Overrides com.sun.jmx.remote.security.MBeanServerAccessController.checkCreate. Check if the caller can create MBeans or instances of the given class.
private static boolean	checkCreateAccess(MBeanServerFileAccessController.Access access, String className)
public void	checkRead() Implements abstract com.sun.jmx.remote.security.MBeanServerAccessController.checkRead. Check if the caller can do read operations.
public void	checkUnregister(ObjectName name) Overrides com.sun.jmx.remote.security.MBeanServerAccessController.checkUnregister. Check if the caller can do unregister operations.
public void	checkWrite() Implements abstract com.sun.jmx.remote.security.MBeanServerAccessController.checkWrite. Check if the caller can do write operations.
private static boolean	classNameMatch(String pattern, String className)
private void	parseProperties(Properties props)
private static Properties	propertiesFromFile(String fname)
public synchronized void	refresh() Refresh the set of username/access level entries.

Field Detail

accessFileName	back to summary
private String accessFileName

accessMap	back to summary
private Map<String, MBeanServerFileAccessController.Access> accessMap

CREATE	back to summary
pack-priv static final String CREATE

originalProps	back to summary
private Properties originalProps

READONLY	back to summary
pack-priv static final String READONLY

READWRITE	back to summary
pack-priv static final String READWRITE

UNREGISTER	back to summary
pack-priv static final String UNREGISTER

Constructor Detail

MBeanServerFileAccessController back to summary

MBeanServerFileAccessController	back to summary
public MBeanServerFileAccessController(String accessFileName) throws IOException Create a new MBeanServerAccessController that forwards all the MBeanServer requests to the MBeanServer set by invoking the `setMBeanServer` method after doing access checks based on read and write permissions. This instance is initialized from the specified properties file. Parameters accessFileName:String name of the file which denotes a properties file on disk containing the username/access level entries. Exceptions IOException: if the file does not exist, is a directory rather than a regular file, or for some other reason cannot be opened for reading. IllegalArgumentException: if any of the supplied access level values differs from "readonly" or "readwrite".

public MBeanServerFileAccessController(String accessFileName) throws IOException

Create a new MBeanServerAccessController that forwards all the MBeanServer requests to the MBeanServer set by invoking the setMBeanServer method after doing access checks based on read and write permissions.

This instance is initialized from the specified properties file.

Parameters

accessFileName:String: name of the file which denotes a properties file on disk containing the username/access level entries.

Exceptions

IOException:: if the file does not exist, is a directory rather than a regular file, or for some other reason cannot be opened for reading.
IllegalArgumentException:: if any of the supplied access level values differs from "readonly" or "readwrite".

MBeanServerFileAccessController back to summary

MBeanServerFileAccessController	back to summary
public MBeanServerFileAccessController(String accessFileName, MBeanServer mbs) throws IOException Create a new MBeanServerAccessController that forwards all the MBeanServer requests to `mbs` after doing access checks based on read and write permissions. This instance is initialized from the specified properties file. Parameters accessFileName:String name of the file which denotes a properties file on disk containing the username/access level entries. mbs:MBeanServer the MBeanServer object to which requests will be forwarded. Exceptions IOException: if the file does not exist, is a directory rather than a regular file, or for some other reason cannot be opened for reading. IllegalArgumentException: if any of the supplied access level values differs from "readonly" or "readwrite".

public MBeanServerFileAccessController(String accessFileName, MBeanServer mbs) throws IOException

Create a new MBeanServerAccessController that forwards all the MBeanServer requests to mbs after doing access checks based on read and write permissions.

This instance is initialized from the specified properties file.

Parameters

accessFileName:String: name of the file which denotes a properties file on disk containing the username/access level entries.
mbs:MBeanServer: the MBeanServer object to which requests will be forwarded.

Exceptions

IOException:: if the file does not exist, is a directory rather than a regular file, or for some other reason cannot be opened for reading.
IllegalArgumentException:: if any of the supplied access level values differs from "readonly" or "readwrite".

MBeanServerFileAccessController back to summary

MBeanServerFileAccessController	back to summary
public MBeanServerFileAccessController(Properties accessFileProps) throws IOException Create a new MBeanServerAccessController that forwards all the MBeanServer requests to the MBeanServer set by invoking the `setMBeanServer` method after doing access checks based on read and write permissions. This instance is initialized from the specified properties instance. This constructor makes a copy of the properties instance and it is the copy that is consulted to check the username and access level of an incoming connection. The original properties object can be modified without affecting the copy. If the `refresh` method is then called, the `MBeanServerFileAccessController` will make a new copy of the properties object at that time. Parameters accessFileProps:Properties properties list containing the username/access level entries. Exceptions IllegalArgumentException: if `accessFileProps` is `null` or if any of the supplied access level values differs from "readonly" or "readwrite".

public MBeanServerFileAccessController(Properties accessFileProps) throws IOException

This instance is initialized from the specified properties instance. This constructor makes a copy of the properties instance and it is the copy that is consulted to check the username and access level of an incoming connection. The original properties object can be modified without affecting the copy. If the refresh method is then called, the MBeanServerFileAccessController will make a new copy of the properties object at that time.

Parameters

accessFileProps:Properties: properties list containing the username/access level entries.

Exceptions

IllegalArgumentException:: if accessFileProps is null or if any of the supplied access level values differs from "readonly" or "readwrite".

MBeanServerFileAccessController back to summary

MBeanServerFileAccessController	back to summary
public MBeanServerFileAccessController(Properties accessFileProps, MBeanServer mbs) throws IOException Create a new MBeanServerAccessController that forwards all the MBeanServer requests to the MBeanServer set by invoking the `setMBeanServer` method after doing access checks based on read and write permissions. This instance is initialized from the specified properties instance. This constructor makes a copy of the properties instance and it is the copy that is consulted to check the username and access level of an incoming connection. The original properties object can be modified without affecting the copy. If the `refresh` method is then called, the `MBeanServerFileAccessController` will make a new copy of the properties object at that time. Parameters accessFileProps:Properties properties list containing the username/access level entries. mbs:MBeanServer the MBeanServer object to which requests will be forwarded. Exceptions IllegalArgumentException: if `accessFileProps` is `null` or if any of the supplied access level values differs from "readonly" or "readwrite".

public MBeanServerFileAccessController(Properties accessFileProps, MBeanServer mbs) throws IOException

Parameters

accessFileProps:Properties: properties list containing the username/access level entries.
mbs:MBeanServer: the MBeanServer object to which requests will be forwarded.

Exceptions

IllegalArgumentException:: if accessFileProps is null or if any of the supplied access level values differs from "readonly" or "readwrite".

Method Detail

checkAccess	back to summary
private synchronized void checkAccess(MBeanServerFileAccessController.AccessType requiredAccess, String arg)

checkCreate	back to summary
public void checkCreate(String className) Overrides com.sun.jmx.remote.security.MBeanServerAccessController.checkCreate. Check if the caller can create MBeans or instances of the given class. This method does nothing if so, otherwise throws SecurityException. Annotations @Override

checkCreate

back to summary

public void checkCreate(String className)

Overrides com.sun.jmx.remote.security.MBeanServerAccessController.checkCreate.

Check if the caller can create MBeans or instances of the given class. This method does nothing if so, otherwise throws SecurityException.

Annotations

@Override

checkCreateAccess	back to summary
private static boolean checkCreateAccess(MBeanServerFileAccessController.Access access, String className)

checkRead	back to summary
public void checkRead() Implements abstract com.sun.jmx.remote.security.MBeanServerAccessController.checkRead. Check if the caller can do read operations. This method does nothing if so, otherwise throws SecurityException. Annotations @Override

checkRead

back to summary

public void checkRead()

Implements abstract com.sun.jmx.remote.security.MBeanServerAccessController.checkRead.

Check if the caller can do read operations. This method does nothing if so, otherwise throws SecurityException.

Annotations

@Override

checkUnregister	back to summary
public void checkUnregister(ObjectName name) Overrides com.sun.jmx.remote.security.MBeanServerAccessController.checkUnregister. Check if the caller can do unregister operations. This method does nothing if so, otherwise throws SecurityException. Annotations @Override

checkUnregister

back to summary

public void checkUnregister(ObjectName name)

Overrides com.sun.jmx.remote.security.MBeanServerAccessController.checkUnregister.

Check if the caller can do unregister operations. This method does nothing if so, otherwise throws SecurityException.

Annotations

@Override

checkWrite	back to summary
public void checkWrite() Implements abstract com.sun.jmx.remote.security.MBeanServerAccessController.checkWrite. Check if the caller can do write operations. This method does nothing if so, otherwise throws SecurityException. Annotations @Override

checkWrite

back to summary

public void checkWrite()

Implements abstract com.sun.jmx.remote.security.MBeanServerAccessController.checkWrite.

Check if the caller can do write operations. This method does nothing if so, otherwise throws SecurityException.

Annotations

@Override

classNameMatch	back to summary
private static boolean classNameMatch(String pattern, String className)

parseProperties	back to summary
private void parseProperties(Properties props)

propertiesFromFile	back to summary
private static Properties propertiesFromFile(String fname) throws IOException

refresh back to summary

refresh	back to summary
public synchronized void refresh() throws IOException Refresh the set of username/access level entries. If this instance was created using the `MBeanServerFileAccessController(String)` or `MBeanServerFileAccessController(String, MBeanServer)` constructors to specify a file from which the entries are read, the file is re-read. If this instance was created using the `MBeanServerFileAccessController(Properties)` or `MBeanServerFileAccessController(Properties, MBeanServer)` constructors then a new copy of the `Properties` object is made. Exceptions IOException: if the file does not exist, is a directory rather than a regular file, or for some other reason cannot be opened for reading. IllegalArgumentException: if any of the supplied access level values differs from "readonly" or "readwrite".

public synchronized void refresh() throws IOException

Refresh the set of username/access level entries.

If this instance was created using the MBeanServerFileAccessController(String) or MBeanServerFileAccessController(String, MBeanServer) constructors to specify a file from which the entries are read, the file is re-read.

If this instance was created using the MBeanServerFileAccessController(Properties) or MBeanServerFileAccessController(Properties, MBeanServer) constructors then a new copy of the Properties object is made.

Exceptions

IOException:: if the file does not exist, is a directory rather than a regular file, or for some other reason cannot be opened for reading.
IllegalArgumentException:: if any of the supplied access level values differs from "readonly" or "readwrite".

com.sun.jmx.remote.security back to summary

private Class MBeanServerFileAccessController.Access

Class Inheritance

extends Object

java.lang.Object
com.sun.jmx.remote.security.MBeanServerFileAccessController.Access

Field Summary

Modifier and Type	Field and Description
pack-priv final String[]	createPatterns
private final String[]	NO_STRINGS
private boolean	unregister
pack-priv final boolean	write

Constructor Summary

Access	Constructor and Description
pack-priv	Access(boolean write, boolean unregister, List<String> createPatternList)

Method Summary

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

createPatterns	back to summary
pack-priv final String[] createPatterns

NO_STRINGS	back to summary
private final String[] NO_STRINGS

unregister	back to summary
private boolean unregister

write	back to summary
pack-priv final boolean write

Constructor Detail

Access	back to summary
pack-priv Access(boolean write, boolean unregister, List<String> createPatternList)

com.sun.jmx.remote.security back to summary

private final Enum MBeanServerFileAccessController.AccessType

Class Inheritance

extends Enum<MBeanServerFileAccessController.AccessType>

java.lang.Object
java.lang.Enum
com.sun.jmx.remote.security.MBeanServerFileAccessController.AccessType

Field Summary

Modifier and Type	Field and Description
public static final MBeanServerFileAccessController.AccessType	CREATE
public static final MBeanServerFileAccessController.AccessType	READ
public static final MBeanServerFileAccessController.AccessType	UNREGISTER
public static final MBeanServerFileAccessController.AccessType	WRITE

Constructor Summary

Access	Constructor and Description
private	AccessType()

Method Summary

Modifier and Type	Method and Description
public static MBeanServerFileAccessController.AccessType	valueOf(String name)
public static MBeanServerFileAccessController.AccessType[]	values()

Inherited from java.lang.Enum:: clone compareTo describeConstable equals finalize getDeclaringClass hashCode name ordinal toString valueOf

Field Detail

CREATE	back to summary
public static final MBeanServerFileAccessController.AccessType CREATE

READ	back to summary
public static final MBeanServerFileAccessController.AccessType READ

UNREGISTER	back to summary
public static final MBeanServerFileAccessController.AccessType UNREGISTER

WRITE	back to summary
public static final MBeanServerFileAccessController.AccessType WRITE

Constructor Detail

AccessType	back to summary
private AccessType()

Method Detail

valueOf	back to summary
public static MBeanServerFileAccessController.AccessType valueOf(String name)

values	back to summary
public static MBeanServerFileAccessController.AccessType[] values()

com.sun.jmx.remote.security back to summary

private Class MBeanServerFileAccessController.Parser

Class Inheritance

extends Object

java.lang.Object
com.sun.jmx.remote.security.MBeanServerFileAccessController.Parser

Field Summary

Modifier and Type	Field and Description
private int	c
private static final int	EOS
private int	i
private final String	identity
private final int	len
private final String	s

Constructor Summary

Access	Constructor and Description
private	Parser(String identity, String s)

Method Summary

Modifier and Type	Method and Description
private void	next()
pack-priv static MBeanServerFileAccessController.Access	parseAccess(String identity, String s)
private MBeanServerFileAccessController.Access	parseAccess()
private String	parseClassName()
private void	parseCreate(List<String> createClasses)
private MBeanServerFileAccessController.Access	parseReadWrite()
private String	parseWord()
private void	skipSpace()
private IllegalArgumentException	syntax(String msg)

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

c	back to summary
private int c

EOS	back to summary
private static final int EOS

i	back to summary
private int i

identity	back to summary
private final String identity

len	back to summary
private final int len

s	back to summary
private final String s

Constructor Detail

Parser	back to summary
private Parser(String identity, String s)

Method Detail

next	back to summary
private void next()

parseAccess	back to summary
pack-priv static MBeanServerFileAccessController.Access parseAccess(String identity, String s)

parseAccess	back to summary
private MBeanServerFileAccessController.Access parseAccess()

parseClassName	back to summary
private String parseClassName()

parseCreate	back to summary
private void parseCreate(List<String> createClasses)

parseReadWrite	back to summary
private MBeanServerFileAccessController.Access parseReadWrite()

parseWord	back to summary
private String parseWord()

skipSpace	back to summary
private void skipSpace()

syntax	back to summary
private IllegalArgumentException syntax(String msg)

public Class MBeanServerFileAccessController

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

private Class MBeanServerFileAccessController.Access

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

private final Enum MBeanServerFileAccessController.AccessType

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

private Class MBeanServerFileAccessController.Parser

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail