[
https://issues.apache.org/activemq/browse/SM-1915?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=55431#action_55431
]
Gert Vanthienen commented on SM-1915:
-------------------------------------
Claus,
With ServiceMix' support for JAAS authentication on the JMX connector, you can
also write a java policy file and use that when starting ServiceMix and the the
MBeanServer will use that policy to control access. I first tried this but it
became very troublesome to maintain the policy file because you can only grant
privileges and not revoke them, so you have to write a full list of all
permissions like this:
{code}
grant {
permission java.io.FilePermission "-", "read,write,execute,delete";
permission java.lang.RuntimePermission "*";
// a few dozen other standard java permissions here
permission javax.management.MBeanPermission "getAttribute", "*", "*", "*";
//all the other read-only access permission here
}
// all the above just so we can do...
grant principal "admin" {
permission java.security.AllPermission;
};
{code}
In the end, the proxy-based approach just seemed a lot easier to implement. I
do agree there should be an easier to specify a policy like this in the policy
files, perhaps it can be done by writing your own permission that implies the
necessary MBean permissions but I'm afraid that's a bit beyond my current
knowledge of Java security.
> Support more fine-grained authorization on JMX access
> -----------------------------------------------------
>
> Key: SM-1915
> URL: https://issues.apache.org/activemq/browse/SM-1915
> Project: ServiceMix
> Issue Type: Bug
> Components: servicemix-core
> Affects Versions: 3.2.3, 3.3.1
> Reporter: Gert Vanthienen
> Assignee: Gert Vanthienen
> Fix For: 3.2.4, 3.3.2
>
> Attachments: SM-1915.diff
>
>
> Currently, access to the JMX console access is being controlled by a JAAS
> login module. Once logged in to the JMX console, every user is allowed to do
> anything with the provided MBeans.
> This issue aims to add support for basic authorization control as well as
> provide a hook for implementing more fine-grained authorization schemes. The
> basic scheme should allow 'admin' users to do anything and limit the normal
> users to read-only operations.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
