Security - JDK 5 Documentation v6.0, Java 2 SDK 英文文档

1. Open the work_dir/jmx_examples/Security/simple directory.

Inside this directory you will find the following directories:

/server, containing the fileServer.java
/config, containing the security configuration files:
access.properties
keystore
password.properties
truststore
/mbeans, containing the following files:
SimpleStandardMBean.java
SimpleStandard.java
/client, containing the following files:
Client.java
ClientListener.java
2. Open all the *.java and *.properties files in a text editor

These files will be analyzed in the following sections.

5.1.1.1 Server.java

The Server.java class is shown in CODE EXAMPLE 5-1.

 
public class Server { 
 
  public static void main(String[] args) { 
  try { 
       MBeanServer mbs = MBeanServerFactory.createMBeanServer(); 
 
       HashMap env = new HashMap(); 
 
       SslRMIClientSocketFactory csf =  
                  new SslRMIClientSocketFactory(); 
       SslRMIServerSocketFactory ssf =  
                  new SslRMIServerSocketFactory(); 
       env.put(RMIConnectorServer. 
                  RMI_CLIENT_SOCKET_FACTORY_ATTRIBUTE,csf); 
       env.put(RMIConnectorServer. 
                  RMI_SERVER_SOCKET_FACTORY_ATTRIBUTE,ssf); 
 
       env.put("jmx.remote.x.password.file", 
                 "config" + File.separator + "password.properties"); 
       env.put("jmx.remote.x.access.file", 
                 "config" + File.separator + "access.properties"); 
 
       JMXServiceURL url = new JMXServiceURL( 
        "service:jmx:rmi:///jndi/rmi://localhost:9999/server"); 
         JMXConnectorServer cs = 
            JMXConnectorServerFactory.newJMXConnectorServer(url,  
                                                            env,  
                                                            mbs); 
       cs.start(); 
     } catch (Exception e) { 
       e.printStackTrace(); 
     } 
  } 
} 
 

The Server class shown in CODE EXAMPLE 5-1 creates an MBean server mbs, and populates an environment map env with a secure RMI client socket factory csf, a secure RMI server socket factory ssf, and the properties files password.properties and access.properties.

The properties file password.properties contains a username and password and is accessed using the JMX Remote API interface JMXAuthenticator. Using the property jmx.remote.x.password.file is the same as creating a password-based JMXAuthenticator and passing it into the environment map through the jmx.remote.authenticator property.

The properties file access.properties contains a username and a level of access permission that can be either readwrite or readonly. This represents the level of access this user can have to MBean server operations. This file-based access control is implemented using the JMX technology interface MBeanServerForwarder, which wraps the real MBean server inside an access controller MBean server. The access controller MBean server only forwards requests to the real MBean server after performing the appropriate checks.

Server creates a JMX service URL, named url, for an RMI connector that will operate over the default JRMP transport, and register an RMI connector stub in an RMI registry on port 9999 of the local host.

The MBean server mbs, the environment map env and the service URL url are all passed to JMXConnectorServer to create a new, secure JMX connector server named cs.

5.1.1.2 SimpleStandardMBean.java

The SimpleStandardMBean class defines the same straightforward MBean interface as was used in Chapter 3, "JMX Connectors".

5.1.1.3 SimpleStandard.java

The SimpleStandard class defines the same straightforward MBean as was used in Chapter 3, "JMX Connectors".

5.1.1.4 ClientListener.java

The ClientListener class defines the same straightforward notification listener as was used in Chapter 3, "JMX Connectors".

5.1.1.5 Client.java

The Client.java class is shown in CODE EXAMPLE 5-2.

 
public class Client { 
 
  public static void main(String[] args) { 
  try { 
      HashMap env = new HashMap(); 
 
      String[] credentials = new String[] { "username" , "password" }; 
      env.put("jmx.remote.credentials", credentials); 
      JMXServiceURL url = new JMXServiceURL( 
         "service:jmx:rmi:///jndi/rmi://localhost:9999/server");       
      JMXConnector jmxc = JMXConnectorFactory.connect(url, env); 
      MBeanServerConnection mbsc = jmxc.getMBeanServerConnection(); 
      String domains[] = mbsc.getDomains(); 
      for (int i = 0; i < domains.length; i++) { 
         System.out.println("Domain[" + i + "] = " + domains[i]); 
      } 
       
      ObjectName mbeanName =  
          new ObjectName("MBeans:type=SimpleStandard"); 
      mbsc.createMBean("SimpleStandard", mbeanName, null, null); 
      // Perform MBean operations 
      [...] 
      
      mbsc.removeNotificationListener(mbeanName, listener); 
      mbsc.unregisterMBean(mbeanName); 
      jmxc.close(); 
    }  catch (Exception e) { 
      e.printStackTrace(); 
    } 
  } 
} 
 

The Client class shown in CODE EXAMPLE 5-2 populates an environment map env with a set of credentials, namely the username and password expected by the Server. These credentials are then given to an instance of JMXConnector named jmxc when the service URL of the connector stub and the environment map are passed to JMXConnectorFactory.connect(). Through jmxc, the Client connects to the MBean server started by Server, and performs MBean operations.

When the connection is established, the credentials supplied in the environment map env are sent to the server. The server then calls the authenticate() method of the JMXAuthenticator interface, passing the client credentials as parameters. The authenticate() method authenticates the client and returns a subject that contains the set of principals upon which the access control checks will be performed.

5.1.2 Running the RMI Connector Example With Simple Security

To run the RMI connector example with simple security, perform the following steps:

$ javac 
      mbeans/SimpleStandard.java \ 
      mbeans/SimpleStandardMBean.java \ 
      server/Server.java \ 
      client/Client.java \ 
      client/ClientListener.java 
 

 
$ export CLASSPATH=server ; rmiregistry 9999 & 
 

 
$ java -classpath server:mbeans \ 
     -Djavax.net.ssl.keyStore=config/keystore \ 
     -Djavax.net.ssl.keyStorePassword=password \ 
     Server & 

You will see confirmation of the creation of the MBean server and of the RMI connector.

 
$java -classpath client:server:mbeans \ 
     -Djavax.net.ssl.trustStore=config/truststore \ 
     -Djavax.net.ssl.trustStorePassword=trustword \ 
     Client 
 

You will see confirmation of the creation of the connector client, the various MBean operations followed by the closure of the connection.

As you can see, all the above appears to proceed in exactly the same manner as the basic RMI connector example shown in Chapter 3, "JMX Connectors". However, if you were to open password.properties and change the password, you would see a java.lang.SecurityException when you launched the Client, and the connection would fail.

5.2 Subject Delegation

If your implementation requires the client end of the connection to perform different operations on behalf of multiple users or applications, using the security mechanisms demonstrated in Section 5.1 "Simple Security", each different user would require one secure connection for every operation it performs. If you expect your connector clients to interact with numerous users, you can reduce the load on your system by implementing subject delegation. Subject delegation establishes a single secure connection for a user, and this connection can be used to perform related operations on behalf of any number of users. The connection itself is made by an authenticated user. If the authenticated user has been granted a SubjectDelegationPermission that allows it to act on behalf of another user, then operations can be performed over the connection on behalf of that user.

5.2.1 Secure RMI Connectors With Subject Delegation

You can find an example of a secure RMI connector that implements subject delegation in the directory work_dir/jmx_examples/Security/subject_delegation.

 
public class Server { 
 
   public static void main(String[] args) { 
     try { 
          MBeanServer mbs = MBeanServerFactory.createMBeanServer(); 
          HashMap env = new HashMap(); 
          env.put("jmx.remote.x.password.file", 
                  "config" + File.separator + "password.properties"); 
          env.put("jmx.remote.x.access.file", 
                  "config" + File.separator + "access.properties"); 
 
          JMXServiceURL url = new JMXServiceURL( 
             "service:jmx:rmi:///jndi/rmi://localhost:9999/server"); 
          JMXConnectorServer cs = 
              JMXConnectorServerFactory.newJMXConnectorServer(url, env, mbs); 
          cs.start(); 
     } catch (Exception e) { 
          e.printStackTrace(); 
     } 
   } 
} 
 

 
public class Client { 
 
  public static void main(String[] args) { 
    try { 
         HashMap env = new HashMap(); 
         String[] credentials = new String[] { "username" , "password" }; 
         env.put("jmx.remote.credentials", credentials); 
         JMXServiceURL url = new JMXServiceURL( 
            "service:jmx:rmi:///jndi/rmi://localhost:9999/server"); 
         JMXConnector jmxc = JMXConnectorFactory.connect(url, env); 
         Subject delegationSubject = 
            new Subject(true, 
                Collections.singleton(new JMXPrincipal("delegate")), 
                Collections.EMPTY_SET, 
                Collections.EMPTY_SET); 
 
         MBeanServerConnection mbsc = 
            jmxc.getMBeanServerConnection(delegationSubject); 
         String domains[] = mbsc.getDomains(); 
         ObjectName mbeanName = 
            new ObjectName("MBeans:type=SimpleStandard"); 
         mbsc.createMBean("SimpleStandard", mbeanName, null, null); 
         // Perform MBean operations 
         // 
 
[...] 
         mbsc.removeNotificationListener(mbeanName, listener); 
         mbsc.unregisterMBean(mbeanName); 
         jmxc.close(); 
     } catch (Exception e) { 
         e.printStackTrace(); 
     } 
  } 
} 
 

$ javac  mbeans/SimpleStandard.java \ 
  mbeans/SimpleStandardMBean.java \ 
  server/Server.java \ 
  client/Client.java \ 
  client/ClientListener.java 
 

$ java -classpath server:mbeans \ 
  -Djava.security.policy=config/java.policy Server &