RE: Enhancing HTTP-based connector to support SSL

Hi, 

> This is also the kind of work i've done.

Great, we're on the same lines.

> I have also a working SSL implementation for the axis soap 
> based adapter.

Same here.

> Basically i had to modify the 
> mx4j.tools.remote.resolver.soap.SOAPResolver class
> to configure the axis client to deploy the wsdd on an ssl based web 
> container (jetty)
> and also remove some hardcoded stuff in the HTTPResolver 
> class to make 
> it work.
> 
> i'm using an env variable MX4JRemoteConstants.ENDPOINT_PROTOCOL to 
> instruct the adapter that it must be running in https
> and i m passing this var to the JMXConnectorServerFactory 

I preferred not to pass this parameter, but to subclass relevant
classes.
Basically I have overridden HTTPResolver.getEndpointProtocol(Map) so
that SSL subclasses return the correct protocol.
This result in more classes (although very simple), but less work for
the user.
That's why I preferred this way.

> The MX4JRemoteConstants.AXIS_JSSE_SOCKET_FACTORY constant is used to 
> configure the axis client ssl socket factory to use a fake 
> trust manager
> so that the axis client does not crash during sslhandshake when 
> deploying the wsdd, maybe that this stuff could be harcoded in the 
> SOAPResolver since we do not need
> to really trust the webcontainer nor much flexibility..

I haven't had any need to introduce this class.
Can you please expand on the problems you had ?

Have you set this system property ?
System.setProperty("javax.net.ssl.trustStore", "<keystore>");

In client.wsdd, did you change the <transport name="http" ...> into
<transport name="https" ...> ? I did not, and it seems to work fine.

> Another remark, maybe that the Connectors protocol name should also 
> include tls support which would give :
> 
> hessian+ssl
> hessian+tls
> burlap+ssl
> burlap+tls
> soap+ssl
> soap+tls

This would be trivial to add, but since there is no difference between
TLS and SSLv3, well...
For example, in Jetty I could not find any way to specify the SSL
algorihtm: what is passed to SSLContext.getInstance(<algorithm>) ?

My implementation result in this code to start a connector over SSL:

System.setProperty("javax.net.ssl.trustStore", "simon.keystore");
Map serverEnv = new HashMap();
serverEnv.put(MX4JRemoteConstants.HTTP_SERVER_CONFIGURATION,
"mx4j.https.xml");
JMXServiceURL url = new JMXServiceURL("hessian+ssl", null, 8443,
"/hessianjmx");
JMXConnectorServer cntorServer =
JMXConnectorServerFactory.newJMXConnectorServer(url, serverEnv,
newMBeanServer());
cntorServer.start();

The external parts are the "mx4j.https.xml" Jetty configuration file,
which contains the listener on port 8443, and the keystore.
The system property is needed to trust the self-signed certificate. If
this is imported into cacerts, or it is signed by a trusted entity, it
is not needed.

As I've told, I prefer to leave the listeners (or <Connector> in Tomcat
lingo) out of MX4J.
Configuring a listener in Jetty has 9 parameters (from the example
configuration), and same for Tomcat.
While there may be the possibility to find sensible defaults, I would
leave that to the next iterations, unless proven extremely simple to
add.

Thanks,

Simon


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_ide95&alloc_id396&op=click