Camel + JMX + LDAP authentication with org.apache.camel.jmx.createRmiConnector - apache-camel

Question

all.
Have been trying to get remoted JMX with JAAS authentication to work usin Camel version 2.10.3 + Java 6.
The app uses Java DSL and is "hand wired", and runs with system properties:
-Dcom.sun.management.jmxremote.authenticate=true
-Djmx.remote.x.login.config=StagingJmxAuthConfig
-Dorg.apache.camel.jmx.usePlatformMBeanServer=true
-Djava.security.auth.login.config=./src/main/resources/conf/ldap-auth.config
-Dcom.sun.management.jmxremote.ssl=false
-Dorg.apache.camel.jmx.createRmiConnector=true
-Dorg.apache.camel.jmx.rmiConnector.registryPort=9140
However, for all intents and purposes it seems that I might as well be running with authentication/authorization switched off.
Debugging into the JRE's JMX and JAAS classes (and Camel as well), note the following:
In the class org.apache.camel.management.DefaultManagementAgent:
cs = JMXConnectorServerFactory.newJMXConnectorServer(url, null, server);
This in turn later creates an instance of javax.management.remote.rmi.RMIJRMPServerImpl with an empty Map for the env constructor argument.
Now, I wonder if there's something that's just escaping me -- when a request later comes to the the connector, and the javax.management.remote.rmi.RMIServerImpl does a doNewClient(), it can't possibly trigger any JAAS activity?
Line 197-208 of RMIServerImpl - remember Camel sets "env" to null, which is translated to empty map:
JMXAuthenticator authenticator =
(JMXAuthenticator) env.get(JMXConnectorServer.AUTHENTICATOR);
if (authenticator == null) {
/*
* Create the JAAS-based authenticator only if authentication
* has been enabled
*/
if (env.get("jmx.remote.x.password.file") != null ||
env.get("jmx.remote.x.login.config") != null) {
authenticator = new JMXPluggableAuthenticator(env);
}
}
Am I correct in assuming that to get remoted, JAAS authenticated JMX to work one must hand code the JMX RMI connector setup?
Shouldn't Camel have provided an environment to get JAAS to work? Doesn't even seem to touch the JAAS config file...
UPDATE: SOLVED
Setting the following system properties on the VM did the trick:
-Dcom.sun.management.jmxremote=true
-Dcom.sun.management.jmxremote.port=9410
-Dcom.sun.management.jmxremote.authenticate=true
-Djmx.remote.x.login.config=StagingJmxAuthConfig
-Dorg.apache.camel.jmx.usePlatformMBeanServer=true
-Djava.security.auth.login.config=./src/main/resources/conf/ldap-auth.config
-Dcom.sun.management.jmxremote.ssl=false
-Dorg.apache.camel.jmx.createRmiConnector=false
-Dcom.sun.management.jmxremote.login.config=StagingJmxAuthConfig
For us, using a secured LDAP, the following is the login config:
StagingJmxAuthConfig {
com.sun.security.auth.module.LdapLoginModule REQUIRED
java.naming.security.authentication="simple"
java.naming.security.principal="cn=Directory Manager"
java.naming.security.credentials="PASSWORD"
userProvider="ldap://LDAPHOST:389/BASEDN"
userFilter="(&(uid={USERNAME})(appRole=SOME_VALUE))"
authzIdentity=monitorRole
debug=true
useSSL=false;
};
Now I'm able to connect using jmxterm:
java -jar jmxterm-1.0-alpha-4-uber.jar -l service:jmx:rmi:///jndi/rmi://THEHOST:9410/jmxrmi -u LDAPUSER -p LDAPPASS
Note that the JNDI RMI name is missing the "/camel" postfix -- this is the only difference, it seems.
HOORAY!

Answer 1

In essence:
Use Java6 authenticated JMX remoting
Set org.apache.camel.jmx.createRmiConnector=false
Set org.apache.camel.jmx.usePlatformMBeanServer=true
The example above also shows how to connect to a search protected LDAP, which is actually isolated as the application in question uses a different LDAP for JNDI lookup for JMS.