JMX: How can I support both secure and insecure access at the same time (different URLs)

Question

I've been asked to support 2 URLs for JMX access to our server:

A secure one (service:jmx:rmi://localhost/jndi/rmi://localhost:2020/jmxrmi) An insecure one: (service:jmx:rmi://localhost/jndi/rmi://localhost:2020/insecure-jmxrmi)

The insecure one is primarily for demo purposes - no it won't be used during production.

I can create a custom ConnectorServer for /jmxrmi and provide an interceptor to use our security mechanism to verify credentials. If I just create a vanilla second ConnectorServer (no 'env' properties), however, using jconsole -debug to access it initially tries secure access, and puts up the dialog about that failing, then asking if I want to try it insecurely.

The docs I've read from Oracle/Sun indicate that I can disable password auth and SSL using a couple of command-line -D switches. But then does that not mess with the /jmxrmi secure access?

How do I support both secure and non-secure connections at the same time? Note that I don't need them using the same URL, of course.

Thanks!

Answer 1

This is a tough one. When you disable auth and SSL you do it per JVM.

The JMXRMP protocol can not distinguish between secured and non-secured connection. You either set up the security and it will be used or not. I think the best shot would be using a custom ConnectorServer and put up with the messages JConsole produces.