Re: Re: JMX and SSL

Hi Ron,

Forget everything I said before! I was completely wrong! Oooops!

The Sun's JNDI/RMI Registry Service Provider does not allow to supply an SSL RMI Client
Socket Factory that would be later used when calling bind/lookup. This prevents the
RMIConnector (client-side) and the RMIConnectorServer (server-side) to talk to an SSL
protected RMI Registry when going through the JMXConnector[Client|Server]Factory.

There's a possible workaround although a bit more complicated than calling the factories:

1) Start an SSL-protected RMI Registry (use LocateRegistry.createRegistry with SSL RMI
    Client and Server Socket Factory)

2) On the server side, instantiate the RMIJRMPServerImpl explicitly and pass it in to
    the RMIConnectorServer's constructor which takes an RMIServerImpl as argument, then
    bind the RMIJRMPServerImpl explicitly to your SSL-protected RMI Registry
    (use LocateRegistry.getRegistry with SSL RMI Client Socket Factory).

3) On the client side, retrieve the RMIServer stub from the SSL-protected RMI Registry
    (use LocateRegistry.getRegistry with SSL RMI Client Socket Factory) and then pass it
    in to the RMIConnector constructor.

Regards,
Luis

 > Luis-Miguel Alventosa wrote:
 >
 > Hi Ron,
 >
 > When you specify the SSL RMI Socket Factories in the RMIConnectorServer
 > map,
 > SSL is only used for the RMI invocations on the RMIServer and RMIConnection
 > remote objects.
 >
 > In order to perform SSL on the JNDI lookup you have to create your RMI
 > registry
 > by supplying the SSL RMI Socket Factories too. The client application will
 > then use SSL to carry out the JNDI lookup.
 >
 > See java.rmi.registry.LocateRegistry.createRegistry(int port,
 > RMIClientSocketFactory csf,
 > RMIServerSocketFactory ssf)
 >
 > Regards,
 > Luis
 >
 >  > Ron Vered wrote:
 >  >
 >  > Eamonn,
 >  >
 >  > This is with regard to RMI transport, specifically RMI JNDI.
 >  >
 >  > When a JMX client connects to JMX server (in above scenario), there are
 >  > actually 2 connections made, 1 to the RMI naming service and the other
 >  > to the exported RMI object.
 >  > While there is a way to provide socket factories for RMI transport for
 >  > the exported RMI object, I am not aware of a way to specify socket
 >  > factories for the JNDI lookup.
 >  >
 >  > If I am not mistaken, you need to specify socket factory on the client
 >  > before you do the lookup since it's a boot-strap issue.
 >  >
 >  > If SSL is required for both the JNDI lookup and for the RMI invocation
 >  > (and not only for the latter connection), how can this be done?
 >  >
 >  > Regards,
 >  > Ron.


-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php