[ https://jira.jboss.org/browse/JBAS-8159?page=com.atlassian.jira.plugin.sy... ] Dimitris Andreadis reassigned JBAS-8159: ---------------------------------------- Assignee: Scott Marlow (was: Dimitris Andreadis) The jsr160 service is just a wrapper over the jdk adapter. Assign to Scott to look at. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/browse/JBAS-8159?page=com.atlassian.jira.plugin.sy... ] Scott Marlow commented on JBAS-8159: ------------------------------------ Thanks for the 5.x patch, that will be useful to others also using 5.x. The JSR-160 connector can be secured already in 6.x (see umbrella jira JBAS-7818), but if you have improvements (for AS 6) to what we did, that is always welcome. What do think? -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/browse/JBAS-8159?page=com.atlassian.jira.plugin.sy... ] Xavier MOGHRABI commented on JBAS-8159: --------------------------------------- The patch is complete for securing the JMX JSR160 connector for JBoss 5.x as the provided version is not secured. In fact, the security relies on JRE , see : http://blogs.sun.com/lmalventosa/entry/jmx_authentication_authorization To secure the connector, I've added those properties : <attribute name="AuthNMethod">jmx.remote.x.login.config</attribute> <attribute name="AuthNParameter">jmx-console</attribute> <attribute name="AuthZMethod">jmx.remote.x.access.rolebased</attribute> <attribute name="AuthZParameter">JBossAdmin</attribute> AuthNMethod represents one of the authentication method available in the JRE : jmx.remote.x.login.config (JAAS), jmx.remote.x.password.file (File base) AuthNParameter represents the JAAS domain or the file containing the password. AuthZMethod represents one of the authorization method available in the JRE : jmx.remote.x.access.file (File base) or custom one based one role : jmx.remote.x.access.rolebased AuthZParameter represents the file containing the access rights or the role that grants the access. The only thing I really wrote is the role based authz. It can be approve since I didn't do a distinction between readonly and readwrite. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/browse/JBAS-8159?page=com.atlassian.jira.plugin.sy... ] Xavier MOGHRABI updated JBAS-8159: ---------------------------------- Attachment: jmx-remoting-src.zip The new version of jmx-remoting.sar including security and Serialization handler. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/browse/JBAS-8159?page=com.atlassian.jira.plugin.sy... ] Xavier MOGHRABI updated JBAS-8159: ---------------------------------- Attachment: jmx-remoting-src.zip -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/browse/JBAS-8159?page=com.atlassian.jira.plugin.sy... ] Shelly McGowan updated JBAS-8159: --------------------------------- Fix Version/s: TBD-6.x (was: 6.0.0.Final) -- This message is automatically generated by JIRA. - For more information on JIRA, see: http://www.atlassian.com/software/jira