RE: mx4j-Bugs-969175: Security and delegation

Hi, 

> Thanks for the help and comments.
> I will have to run some test again to verify that indeed the subject
> which is established at connect time (on the server) does not 
> limit the
> set of permissions a later delegate can have in practice when invoking
> some method. I can't do it right away though.

Okay. As soon as you can, please let me know.

> I do ask for the following addition (I know this may be spec related,
> but see what you can do):
> PLEASE add a way for delegate to specify credentials, instead 
> of passing
> Subject: JMXConnector.getMBeanServerConnection(Subject
> delegationSubject)  // <== what exists today
> JMXConnector.getMBeanServerConnection(credentials)            
>     // <==
> what we request

This is impossible, right now.
JSR 160 has been included in Tiger, and it's now part of the standard JDK 5.0.
This means that for any API change you must wait JDK 6.0.
Eamonn is starting the effort for JMX 2.0 (included in JDK 6.0), so you can participate via email at the expert group discussion, and support this change.

I'm not keen to add this API to MX4J classes, since it would promote a non standard usage of JSR 160.
Furthermore, any decent mechanism of remote invocation should scale good enough to allow you to create, instead of a single JMXConnector and multiple MBeanServerConnections, multiple JMXConnectors and a single (or multiple) MBeanServerConnections per JMXConnector without incurring in scaling problem.

Regards,

Simon


-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_idP47&alloc_id808&op=click