Considerations When Running GlassFish Server With Default Security

In GlassFish Server, the default admin account is username "admin" with an empty password. Admin clients provide empty credentials or none at all, and all are authenticated and authorized as that default admin user. None of the participants (clients, DAS, or instances) encrypts network messages.

If this level of security is acceptable in your environment, no changes are needed and you do not need to enable secure administration. Imposing a heightened level of security is optional.

However, consider Table 5-2, which shows which operations are accepted and rejected when secure admin is disabled.

Note - When secure admin is disabled, GlassFish Server does allow remote monitoring (read-only) access via the REST interface.

Table 5-2 Accepted and Rejected Operations if Secure Admin is Disabled

Operation	Run From Same System as DAS	Run From Remote System
`start-local-instance`	Functions as expected	Cannot sync with DAS. The instance starts but cannot communicate with the DAS. DAS will not see the instance.
Any other `asadmin` subcommand	Functions as expected	Rejected. A user sees the username/password prompt, but even correct entries are rejected.
Commands that use SSH. For example, create-instance.	Functions as expected; requires prior SSH configuration.	Functions as expected; requires prior SSH configuration.

Skip Navigation Links
Exit Print View
	Oracle GlassFish Server 3.1 Security Guide