atom feed162 messages in org.apache.db.derby-devJMX meeting system authorization (DER...
FromSent OnAttachments
89 earlier messages
Daniel John Debrunner (JIRA)Feb 5, 2008 9:23 am 
Rick Hillegas (JIRA)Feb 5, 2008 9:45 am 
Rick Hillegas (JIRA)Feb 5, 2008 9:53 am 
Daniel John DebrunnerFeb 5, 2008 11:32 am 
Daniel John Debrunner (JIRA)Feb 5, 2008 11:58 am 
Rick HillegasFeb 5, 2008 12:51 pm 
Daniel John DebrunnerFeb 5, 2008 1:01 pm 
Rick HillegasFeb 5, 2008 1:44 pm 
Daniel John DebrunnerFeb 5, 2008 3:05 pm 
John EmbretsenFeb 6, 2008 6:14 am 
John H. Embretsen (JIRA)Feb 6, 2008 6:48 am 
Daniel John DebrunnerFeb 6, 2008 8:00 am 
Rick HillegasFeb 6, 2008 10:08 am 
John H. EmbretsenFeb 6, 2008 11:43 am 
Rick HillegasFeb 6, 2008 12:06 pm 
Daniel John DebrunnerFeb 6, 2008 12:10 pm 
Daniel John DebrunnerFeb 6, 2008 12:21 pm 
John H. EmbretsenFeb 6, 2008 12:29 pm 
Daniel John Debrunner (JIRA)Feb 6, 2008 12:38 pm 
John EmbretsenFeb 7, 2008 9:03 am 
Daniel John DebrunnerFeb 7, 2008 9:17 am 
Rick HillegasFeb 7, 2008 9:42 am 
Daniel John DebrunnerFeb 7, 2008 9:46 am 
Rick HillegasFeb 7, 2008 9:58 am 
Daniel John DebrunnerFeb 7, 2008 10:25 am 
John H. EmbretsenFeb 7, 2008 11:17 am 
Rick HillegasFeb 8, 2008 8:43 am 
Daniel John DebrunnerFeb 8, 2008 9:14 am 
John H. Embretsen (JIRA)Feb 8, 2008 9:21 am 
Martin ZaunFeb 8, 2008 10:05 pm 
Daniel John DebrunnerFeb 9, 2008 10:38 am 
Daniel John Debrunner (JIRA)Feb 9, 2008 9:37 pm 
John H. Embretsen (JIRA)Feb 10, 2008 8:48 am 
Daniel John Debrunner (JIRA)Feb 11, 2008 10:13 am 
Thomas Nielsen (JIRA)Feb 11, 2008 11:39 am 
Daniel John Debrunner (JIRA)Feb 11, 2008 12:00 pm 
Thomas Nielsen (JIRA)Feb 11, 2008 12:13 pm 
Daniel John Debrunner (JIRA)Feb 11, 2008 12:29 pm 
Daniel John Debrunner (JIRA)Feb 12, 2008 1:48 pm 
Daniel John Debrunner (JIRA)Feb 12, 2008 1:58 pm 
John H. Embretsen (JIRA)Feb 14, 2008 5:50 am 
Daniel John Debrunner (JIRA)Feb 14, 2008 9:14 am 
Daniel John Debrunner (JIRA)Feb 14, 2008 11:42 am 
Daniel John Debrunner (JIRA)Feb 14, 2008 1:38 pm 
John H. Embretsen (JIRA)Feb 15, 2008 7:57 am 
Daniel John DebrunnerFeb 15, 2008 8:35 am 
John H. Embretsen (JIRA)Feb 18, 2008 7:10 am 
Daniel John Debrunner (JIRA)Feb 18, 2008 9:14 am 
John H. Embretsen (JIRA)Feb 18, 2008 9:22 am 
Daniel John Debrunner (JIRA)Feb 18, 2008 10:06 am 
23 later messages
Subject:JMX meeting system authorization (DERBY-2109 & 1387) WAS Re: [jira] Commented: (DERBY-1387) Add JMX extensions to Derby
From:Daniel John Debrunner (dj@apache.org)
Date:Feb 7, 2008 10:25:57 am
List:org.apache.db.derby-dev

Rick Hillegas wrote:

Daniel John Debrunner wrote:

In order to use JMX to monitor/configure Derby (and other applications), I think that the following is true:

DerbyNet-Admin => JMX-Admin Engine-Admin => JMX-Admin DB-Admin => JMX-Admin OtherApp-Admin => JMX-Admin

Right. "VM-Admin => JMX-Admin" is my shorthand for "If you are a VM-Admin, then you are a JMX-Admin".

It's also key to note that JMX-Admins can have different identities, so while OtherApp-Admin and DerbyNet-Admin may both be JMX-Admins, they may not be able to perform the same operations.

Derby's JMX and DERBY-2109 should be coming together so that the policy file can grant shutdown permission to JMXPrincipal('dan') and if I connect via jmx then I can shutdown the server without having to provide additional authentication. I think Rick pointed out that it was strange to have to authenticate twice to shutdown the server.

If the JMXPrincipal is not authorized to shutdown then an additional authentication step would be required to a become a valid (Derby) SystemPrincipal.

For this mode to be enabled some changes are needed to DERBY-2109:

- Enforce Derby's security permissions if there is a security manager (regardless of Derby's authentication state)

- Continue to support shutting the network server & engine down without authentication credentials but only from within the same virtual machine. This shutdown would require the Derby shutdown permission if a security manager was installed.

- Ensure that the implementation follows the spec when it says that Derby's permissions can be granted to code or other non-Derby Principals.

With those changes to DERBY-2109 then the jmx beans could be expanded to support valid jmx users as system administrators.

Dan.