JMX process, is it possible to call an external application to handle access rights when client attempts access

Question

I have an application that is running on localhost:1234, I am using jconsole to connect to this. The application has a password file to handle login.

I need to allow logging in based on different AD groups of the windows user. So for example, if they are in Group1 they will be given readwrite access, if they are Group2 they are given readonly access, and group3 is not given and access.

I have created an AD group handling application that can query a list of AD groups and return the required user access level and login details.

My problem: I want to connect to the application using jconsole via the command line using something like:

jconsole localhost:1234

Obviously this will fail to connect, because it's expecting a username and password.

Is there a way in which I can have my JMX application that's running on localhost:1234 wait for an incoming connection request and run my AD group handling application to determine their access level?

My application on localhost:1234 is very basic and looks like this:

import java.lang.management.ManagementFactory;

import javax.management.InstanceAlreadyExistsException;
import javax.management.MBeanRegistrationException;
import javax.management.MBeanServer;
import javax.management.MalformedObjectNameException;
import javax.management.NotCompliantMBeanException;
import javax.management.ObjectName;

    public class SystemConfigManagement {

        private static final int DEFAULT_NO_THREADS = 10;
        private static final String DEFAULT_SCHEMA = "default";

        public static void main(String[] args) 
                throws MalformedObjectNameException, InterruptedException, 
                InstanceAlreadyExistsException, MBeanRegistrationException, 
                NotCompliantMBeanException{
            //Get the MBean server
            MBeanServer mbs = ManagementFactory.getPlatformMBeanServer();
            //register the mBean
            SystemConfig mBean = new SystemConfig(DEFAULT_NO_THREADS, DEFAULT_SCHEMA);
            ObjectName name = new ObjectName("com.barc.jmx:type=SystemConfig");
            mbs.registerMBean(mBean,  name);
            do{
                Thread.sleep(2000);
                System.out.println(
                        "Thread Count = " + mBean.getThreadCount() 
                        + ":::Schema Name = " + mBean.getSchemaName()
                        );
            }while(mBean.getThreadCount() != 0);
        }
    }

and

package com.test.jmx;

public class SystemConfig implements SystemConfigMBean {

    private int threadCount;
    private String schemaName;

    public SystemConfig(int numThreads, String schema){
        this.threadCount = numThreads;
        this.schemaName = schema;
    }

    @Override
    public void setThreadCount(int noOfThreads) {
        this.threadCount = noOfThreads;
    }

    @Override
    public int getThreadCount() {
        return this.threadCount;
    }

    @Override
    public void setSchemaName(String schemaName) {
        this.schemaName = schemaName;
    }

    @Override
    public String getSchemaName() {
        return this.schemaName;
    }

    @Override
    public String doConfig() {
        return "No of Threads=" + this.threadCount + " and DB Schema Name = " + this.schemaName;
    }

}

[source : http://www.journaldev.com/1352/what-is-jmx-mbean-jconsole-tutorial]

Is there somewhere in main() where I can create this query to validate the user details using the AD group handling application?

eckes eckes · Accepted Answer · 2015-04-22T10:47:49

The default RMI connector server cannot do that very well (you can provide your own JAAS module (UC3) or Authenticator (UC4)).

You might be better off using another protocol/implementation which does already delegate authentication. There are some webservice, REST- and even jboss remoting connectors and most of them can be authenticated via a container mechanism. However I think most of them are not easy to integrate.

If you use for example Jolokia (servlet), you could also use hawt.io as a very nice "AJAX" console. (I am not sure if jolokia actually ships a JMX client connector which you can use in JConsole but there are many alternative clients which are most of the time better for integration/automation).

JMX process, is it possible to call an external application to handle access rights when client attempts access

1 Answers