Re: fine grained security with SubjectTrackingMBeanServer example

Hi Alper,

When the JMX client calls mbsc.addNotificationListener() for the first time
the connector server needs to register a listener on the MBeanServerDelegate
MBean to listen for register/unregister MBean notifications. This call is made
on behalf of the connector server (and not on behalf of the authenticated user)
and thus no Subject will be available in the thread's context but the call will
still go through the MBeanServerForwarder (i.e. your SubjectTrackingMBeanServer)
and that's where your code throws a NullPointerException.

A solution to this problem might be having a special case for adding listeners
to the MBeanServerDelegate MBean in your MBeanServerForwarder where a null
Subject might be accepted.

I hope this helps.

Regards,
Luis-Miguel Alventosa
JMX - Java SE development team
Sun Microsystems, Inc.

 > Alper Akture wrote:
 >
 > I'm trying to do fine grained security using a JMXAuthenticator, and an
 > MBeanServerForwarder as in the mx4j SubjectTrackingMBeanServer example. It
 > seems to work fine when I do an mBeanServerConnection.createMBean() call,
 > but not when I do a mBeanServerConnection.addNotificationListener() call. I
 > do both calls in one method of a unit test. I can see in
 > SubjectTrackingMBeanServer that the Subject is set properly for the
 > createMBean() call, but Subject is null for the addNotificationListener call
 > (causing the trace below).
 >
 > Here's how I start the server:
 >
 >         JMXServiceURL url = new
 > JMXServiceURL("service:jmx:rmi:///jndi/rmi://localhost:9999/server");
 >
 >         Map<String, JMXAuthenticator> environment = new HashMap<String,
 > JMXAuthenticator>();
 >         JMXAuthenticator authenticator = new MyAuthenticator();
 >         environment.put(JMXConnectorServer.AUTHENTICATOR, authenticator);
 >         MBeanServer server =
 > MBeanServerFactory.createMBeanServer("remote.security");
 >         cntorServer = JMXConnectorServerFactory.newJMXConnectorServer(url,
 > environment, server);
 >         ObjectName cntorServerName = ObjectName.getInstance(":service=" +
 > JMXConnectorServer.class.getName() + ",protocol=" + url.getProtocol());
 >
 >         server.registerMBean(cntorServer, cntorServerName);
 >         NamingService naming = new NamingService();
 >         ObjectName namingName = ObjectName.getInstance(":service=" +
 > NamingService.class.getName());
 >         server.registerMBean(naming, namingName);
 >         naming.start();
 >
 >         SubjectTrackingMBeanServer interceptor = new
 > SubjectTrackingMBeanServer();
 >         cntorServer.setMBeanServerForwarder(interceptor);
 >         cntorServer.start();
 >
 > Here's starting the client:
 >
 > 	JMXServiceURL url = new
 > JMXServiceURL("service:jmx:rmi:///jndi/rmi://localhost:9999/server");
 >
 > 	Map<String, String[]> environment = new HashMap<String, String[]>();
 > 	String[] credentials = new String[]{"user", "password"};
 > 	environment.put(JMXConnector.CREDENTIALS, credentials);		
 > 	JMXConnector connector = JMXConnectorFactory.newJMXConnector(url,
 > null);
 > 	connector.connect(environment);
 > 	MBeanServerConnection connection =
 > connector.getMBeanServerConnection();				
 > 	Object[] params = new Object[1];
 > 	params[0] = object3;
 > 	String[] sig = new String[1];
 > 	sig[0] = "com.intersperse.objectmodel.ManagedObject";
 > 	connection.createMBean(ManagedObjectMBean.class.getName(),
 > ObjectName.getInstance(obj3Name), params, sig);
 > 	.
 > 	.
 > 	.
 > 	connection.addNotificationListener(ObjectName.getInstance(obj3Name),
 > new NotificationListener() {
 > 				public void
 > handleNotification(javax.management.Notification notification, Object
 > handback) {
 > 					// TODO Auto-generated method stub
 >
 > 				}
 > 			}, null, null);
 >
 >
 > The stack trace:
 >
 > java.lang.IllegalArgumentException: Can't add listener to MBean server
 > delegate: java.lang.NullPointerException
 > 	at
 > com.sun.jmx.remote.internal.ArrayNotificationBuffer.createListeners(ArrayNot
 > ificationBuffer.java:531)
 > 	at
 > com.sun.jmx.remote.internal.ArrayNotificationBuffer.<init>(ArrayNotification
 > Buffer.java:153)
 > 	at
 > com.sun.jmx.remote.internal.ArrayNotificationBuffer.getNotificationBuffer(Ar
 > rayNotificationBuffer.java:64)
 > 	at
 > javax.management.remote.rmi.RMIServerImpl.getNotifBuffer(RMIServerImpl.java:
 > 495)
 > 	at
 > javax.management.remote.rmi.RMIConnectionImpl.getServerNotifFwd(RMIConnectio
 > nImpl.java:148)
 > 	at
 > javax.management.remote.rmi.RMIConnectionImpl.doOperation(RMIConnectionImpl.
 > java:1444)
 > 	at
 > javax.management.remote.rmi.RMIConnectionImpl.access$100(RMIConnectionImpl.j
 > ava:81)
 > 	at
 > javax.management.remote.rmi.RMIConnectionImpl$PrivilegedOperation.run(RMICon
 > nectionImpl.java:1245)
 > 	at java.security.AccessController.doPrivileged(Native Method)
 > 	at
 > javax.management.remote.rmi.RMIConnectionImpl.doPrivilegedOperation(RMIConne
 > ctionImpl.java:1348)
 > 	at
 > javax.management.remote.rmi.RMIConnectionImpl.addNotificationListeners(RMICo
 > nnectionImpl.java:956)
 > 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 > 	at
 > sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39
 > )
 > 	at
 > sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl
 > .java:25)
 > 	at java.lang.reflect.Method.invoke(Method.java:585)
 > 	at
 > sun.rmi.server.UnicastServerRef.dispatch(UnicastServerRef.java:294)
 > 	at sun.rmi.transport.Transport$1.run(Transport.java:153)
 > 	at java.security.AccessController.doPrivileged(Native Method)
 > 	at sun.rmi.transport.Transport.serviceCall(Transport.java:149)
 > 	at
 > sun.rmi.transport.tcp.TCPTransport.handleMessages(TCPTransport.java:460)
 > 	at
 > sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(TCPTransport.java:7
 > 01)
 > 	at java.lang.Thread.run(Thread.java:595)
 > 	at
 > sun.rmi.transport.StreamRemoteCall.exceptionReceivedFromServer(StreamRemoteC
 > all.java:247)
 > 	at
 > sun.rmi.transport.StreamRemoteCall.executeCall(StreamRemoteCall.java:223)
 > 	at sun.rmi.server.UnicastRef.invoke(UnicastRef.java:126)
 > 	at com.sun.jmx.remote.internal.PRef.invoke(Unknown Source)
 > 	at
 > javax.management.remote.rmi.RMIConnectionImpl_Stub.addNotificationListeners(
 > Unknown Source)
 > 	at
 > javax.management.remote.rmi.RMIConnector.addListenersWithSubjects(RMIConnect
 > or.java:546)
 > 	at
 > javax.management.remote.rmi.RMIConnector.addListenerWithSubject(RMIConnector
 > .java:521)
 > 	at
 > javax.management.remote.rmi.RMIConnector.access$700(RMIConnector.java:119)
 > 	at
 > javax.management.remote.rmi.RMIConnector$RemoteMBeanServerConnection.addNoti
 > ficationListener(RMIConnector.java:1181)
 > 	at
 > com.intersperse.clientjmx.mbeanserver.SubjectTrackingMBeanServerIntegrationT
 > est.testAddNotificationListener1(SubjectTrackingMBeanServerIntegrationTest.j
 > ava:217)
 > 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 > 	at
 > sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39
 > )
 > 	at
 > sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl
 > .java:25)
 > 	at java.lang.reflect.Method.invoke(Method.java:585)
 > 	at junit.framework.TestCase.runTest(TestCase.java:154)
 > 	at junit.framework.TestCase.runBare(TestCase.java:127)
 > 	at junit.framework.TestResult$1.protect(TestResult.java:106)
 > 	at junit.framework.TestResult.runProtected(TestResult.java:124)
 > 	at junit.framework.TestResult.run(TestResult.java:109)
 > 	at junit.framework.TestCase.run(TestCase.java:118)
 > 	at
 > org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRu
 > nner.java:478)
 > 	at
 > org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.run(RemoteTestRunner.
 > java:344)
 > 	at
 > org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.main(RemoteTestRunner
 > .java:196)
 > Caused by: java.lang.NullPointerException
 > 	at
 > com.intersperse.clientjmx.mbeanserver.SubjectTrackingMBeanServer.getUserID(S
 > ubjectTrackingMBeanServer.java:73)
 > 	at
 > com.intersperse.clientjmx.mbeanserver.SubjectTrackingMBeanServer.canAccess(S
 > ubjectTrackingMBeanServer.java:82)
 > 	at
 > com.intersperse.clientjmx.mbeanserver.SubjectTrackingMBeanServer.addNotifica
 > tionListener(SubjectTrackingMBeanServer.java:92)
 > 	at
 > com.sun.jmx.remote.internal.ArrayNotificationBuffer$1.run(ArrayNotificationB
 > uffer.java:584)
 > 	at java.security.AccessController.doPrivileged(Native Method)
 > 	at
 > com.sun.jmx.remote.internal.ArrayNotificationBuffer.addNotificationListener(
 > ArrayNotificationBuffer.java:582)
 > 	at
 > com.sun.jmx.remote.internal.ArrayNotificationBuffer.createListeners(ArrayNot
 > ificationBuffer.java:526)
 > 	at
 > com.sun.jmx.remote.internal.ArrayNotificationBuffer.<init>(ArrayNotification
 > Buffer.java:153)
 > 	at
 > com.sun.jmx.remote.internal.ArrayNotificationBuffer.getNotificationBuffer(Ar
 > rayNotificationBuffer.java:64)
 > 	at
 > javax.management.remote.rmi.RMIServerImpl.getNotifBuffer(RMIServerImpl.java:
 > 495)
 > 	at
 > javax.management.remote.rmi.RMIConnectionImpl.getServerNotifFwd(RMIConnectio
 > nImpl.java:148)
 > 	at
 > javax.management.remote.rmi.RMIConnectionImpl.doOperation(RMIConnectionImpl.
 > java:1444)
 > 	at
 > javax.management.remote.rmi.RMIConnectionImpl.access$100(RMIConnectionImpl.j
 > ava:81)
 > 	at
 > javax.management.remote.rmi.RMIConnectionImpl$PrivilegedOperation.run(RMICon
 > nectionImpl.java:1245)
 > 	at java.security.AccessController.doPrivileged(Native Method)
 > 	at
 > javax.management.remote.rmi.RMIConnectionImpl.doPrivilegedOperation(RMIConne
 > ctionImpl.java:1348)
 > 	at
 > javax.management.remote.rmi.RMIConnectionImpl.addNotificationListeners(RMICo
 > nnectionImpl.java:956)
 > 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 > 	at
 > sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39
 > )
 > 	at
 > sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl
 > .java:25)
 > 	at java.lang.reflect.Method.invoke(Method.java:585)
 > 	at
 > sun.rmi.server.UnicastServerRef.dispatch(UnicastServerRef.java:294)
 > 	at sun.rmi.transport.Transport$1.run(Transport.java:153)
 > 	at java.security.AccessController.doPrivileged(Native Method)
 > 	at sun.rmi.transport.Transport.serviceCall(Transport.java:149)
 > 	at
 > sun.rmi.transport.tcp.TCPTransport.handleMessages(TCPTransport.java:460)
 > 	at
 > sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(TCPTransport.java:7
 > 01)
 > 	at java.lang.Thread.run(Thread.java:595)
 >
 >
 >
 > Using Tomcat but need to do more? Need to support web services, security?
 > Get stuff done quickly with pre-integrated technology to make your job easier
 > Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
 > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
 > _______________________________________________
 > Mx4j-user mailing list
 > [email protected]
 > https://lists.sourceforge.net/lists/listinfo/mx4j-user

Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642