JMXMPConnectorServer stops accepting after AccessControlException

Hi,

I have an application managed by JMX using the JMXMP connector (Java 1.5). I am restricting which hosts are allowed to manage this application by using java.net.SocketPermission entires in a security policy file.

Attempting to connect to the application from a host which does not have the allowed SocketPermission results in an AccessControlException with reason access denied because there is no permission to accept the connection. So far so good.

The problem is the thread that was listening for new JMXMP client connections seems to get terminated by the AccessControlException. If I dump the number of running threads before and after the connection request, I see there is one less thread.

After this I can no longer access the MBeanServer of the application remotely. All connection attempts (from both allowed or disallowed hosts) result in a TCP connection being opened, but nothing on the server end responds to it.

Is the java.net.SocketPermission the correct way to restrict which hosts can access an application?

Here's part of the traceback:

...

com.sun.jmx.remote.socket.SocketConnectionServer.accept(SocketConnectionServer.java:173)

com.sun.jmx.remote.generic.SynchroMessageconnectionserverImipl.accept(SynchroMessageConnectionServerIpml.java:47)

javax.management.remote.generic.GenericConnectorServer$Receiver.run(GenericConnectorServer.java:340)

Any help would be appreciated...

thanks,

John.

[1502 byte] By [j.w.sa] at [2007-11-27 10:42:38]
# 1

Hi John,

This is a bug in the JMXMP connector server implementation.

I've logged a new bug (Bug ID 6580975) to track this issue. It should appear in the bug

database very soon:

http://bugs.sun.com/bugdatabase/search.do?process=1&category=&bugStatus=&subcategory=&type=&keyword=6580975

Unfortunately there's no workaround for it and I don't know when the next patch

for JavaDMK will be published (open an escalation if you have a JavaDMK support

contract). In the meantime, you could retrieve the JMXMP source code from the

OpenDMK project, fix it yourself and build your own version of the "jmxremote_optional.jar".

The fix is trivial - see the bug's suggested fix in the evaluation section.

OpenDMK: http://opendmk.dev.java.net/

Regards,

Luis-Miguel Alventosa

JavaSE JMX/JConsole/JDMK development team

Sun Microsystems, Inc.

http://blogs.sun.com/lmalventosa/

lmalventa at 2007-7-28 19:19:33 > top of Java-index,Core,Monitoring & Management...