Java Dynamic Management Kit 5.1 Tutorial

11.2.2 Secure JMXMP Connectors With Subject Delegation

The example of JMXMP connectors with subject delegation is mostly identical to the example of a simple secure JMXMP connector. The only differences are in the client end of the connection, in which the delegation subject is defined, and in the java.policy file used to grant permission to the delegation subjects created.

The Client class defines the same delegation subject as was defined for the RMI connector with subject delegation, in Example 11–6.
The java.policy file in this example is identical to the one used for the RMI connector with subject delegation, except that it points to the jmxremote_optional.jar runtime library that is required by JMXMP connectors.

In this example, the Server class creates an MBean server, and a connector server cs, again protected by an SSL password, as was the case in the simple secure JMXMP connector example.

The Client creates a connector client named jmxc in the same way as in the previous JMXMP connector examples. The Client then creates an instance of Subject, called delegationSubject, with a Principal that is an instance of JMXPrincipal, named delegate.

An MBean server connection, named mbsc, is created by calling the getMBeanServerConnection() method of JMXConnector, with delegationSubject passed in as a parameter. This MBean server connection therefore allows operations to be performed on the remote MBean server on behalf of the principals stored in the delegationSubject, which in this example is the JMXPrincipal named delegate.

To Run the Secure JMXMP Connector Example With Subject Delegation

Run this example from within the examplesDir/current/Security/jmxmp/subject_delegation directory.

Compile the example classes.

$ javac -classpath classpath \
      mbeans/SimpleStandard.java \
      mbeans/SimpleStandardMBean.java \
      server/Server.java \
      server/PropertiesFileCallbackHandler.java \
      client/Client.java \
      client/ClientListener.java \
      client/UserPasswordCallbackHandler.java

Create a java.policy file from the java.policy.template file in the config directory.

You must replace @INSTALL_HOME_FOR_JDMK@ with your installDir.

Start the Server.

The Server requires the SSL keystore file and its password, and a pointer to the java.policy file when you launch it.

$ java -classpath server:mbeans:classpath \
     -Djavax.net.ssl.keyStore=config/keystore \
     -Djavax.net.ssl.keyStorePassword=password \
     -Djava.security.policy=config/java.policy Server &

You will see confirmation of the creation of the MBean server, the initialization of the environment map and the launching of the JMXMP connector.

Start the Client.

Again, the Client requires the SSL truststore and its password when it is launched.
$ java -classpath client:mbeans:classpath \ -Djavax.net.ssl.trustStore=config/truststore \ -Djavax.net.ssl.trustStorePassword=trustword \ Client
You will see confirmation of the creation of the JMXMP connector client, the initialization of the environment map, the creation of the delegation subject, the connection to the MBean server and the performance of the various MBean operations followed by the closure of the connection.