paulk-asert opened a new pull request, #2807: URL: https://github.com/apache/groovy/pull/2807
… connector consumes JmxBuilder's connectorServer documents properties:[authenticate:true, passwordFile:..., accessFile:...], and wrote them into the connector environment under com.sun.management.jmxremote.* names. Those names belong to the JDK's out-of-the-box management agent, not to a connector server. The agent reads them and translates them into the jmx.remote.x.* names the connector actually consumes, then installs the authenticator itself; see sun.management.jmxremote.ConnectorBootstrap. Nothing performed that translation here, so an operator following the documented syntax started a connector with no authenticator at all. Verified rather than reasoned: with the environment this class built, the connector reported no authenticator and a credential-less client connected and read the MBean count; with jmx.remote.x.password.file the same client is rejected with "Authentication failed! Credentials required". Translate the aliases, and only when authentication was requested. Add loginConfig for JAAS, mapping to jmx.remote.x.login.config. Reject authenticate:true with no source of credentials at all, since that asks for authentication and would otherwise start open, which is the failure being fixed; a caller-supplied jmx.remote.authenticator counts as such a source, since passing a JMXAuthenticator through is the standard JSR-160 route for custom authentication. The com.sun.management.jmxremote.* names remain accepted as input spellings but are no longer copied into the environment, where they mean nothing; the ssl alias is likewise consumed to select the socket factories rather than passed through. Three GROOVY-12119 tests asserted the presence of those inert keys as a witness that the environment map was not discarded; they now assert the effective configuration instead, which is what their comments describe. Note on urgency rather than severity: no released version has ever passed the property map to the connector, because the building method returned null until GROOVY-12119, which is in no GA release. There is therefore no installed base of connectors that believe they are authenticated. What makes this worth fixing before GA is that GROOVY-12119 leaves SSL working while authentication silently does not, which is a quieter failure than the wholly broken configuration it replaced. The default remains an unauthenticated connector when no authentication is requested. Warning on that is a separate question from this one. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
