[
https://issues.apache.org/jira/browse/DERBY-3429?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12570998#action_12570998
]
John H. Embretsen commented on DERBY-3429:
------------------------------------------
If we remove this system property and enable Derby JMX management by default,
then the only recommended way for a user (admin) to allow JMX management of his
application embedding Derby, but not Derby itself, is to use a security
manager, correct?
This means that if the user (admin) is not willing to use a security manager to
limit JMX exposure, he must accept that valid JMX users may see and access
Derby's MBeans. I don't see how this is much different from today, when a valid
JMX user (client) may enable Derby's ManagementMBean programmatically even if
the system property has not been set. This will in turn enable all relevant
Derby MBeans.
So, I think this is an acceptable approach.
An alternative approach is to reverse the default value of the property, so
that a user has to set it (to false) if he does not want to enable Derby's
MBeans by default.
Then, for example, JConsole users won't see MBeans related to Derby by default.
It would still be possible to enable Derby's MBeans at runtime, using the
ManagementMBean, so the usefulness of such a knob may be limited (it won't stop
dedicated (and valid) JMX users from enabling the MBeans).
At the moment I don't know of any other use cases supporting the need to enable
Derby-JMX with a static knob.
> Remove system property derby.system.jmx
> ---------------------------------------
>
> Key: DERBY-3429
> URL: https://issues.apache.org/jira/browse/DERBY-3429
> Project: Derby
> Issue Type: Sub-task
> Reporter: Daniel John Debrunner
> Priority: Minor
>
> I don't believe that derby.system.jmx provides any benefit and is counter to
> the concept of using JMX for management.
> The one use case for it from DERBY-1387 is:
> Making the Derby JMX automatically available in the MBean server will make it
> impossible for the user to make some application with an embedded Derby db
> manageable thorugh JMX without also making Derby manageable thorugh JMX. I
> would think that this "all or nothing" granularity could be a problem for
> some applications. So we would need an explicit derby.system.jmx property for
> enabling the management service anyway.
> The functional spec contains no information as to why this is a useful
> feature.
> I wanted to separate out the discussion from the wider issues in DERBY-1387
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
