One password to rule them all!

A few weeks ago I talked about how easy it is to get started with jconsole. The focus of that discussion was local monitoring and management where jconsole connects to applications running as the same user on the same machine. It is a simple scenario with simple configuration and jconsole doesn't need to prompt for username and password.

Now let us move onto the more complicated (and arguably more realistic) scenario where an application is deployed over a number of machines. In these cases the configuration of the JMX agent gets more complicated as it involves setting up SSL, a password file, and choosing a port number for the agent. This is all described on the Monitoring and Management with JMX page. One bugaboo with all this is that the password and access files create yet another place for user administration and yet another password to remember. If the application environment is distributed across the globe then it means sharing files in a secure manner or maybe a password file per machine. SSL client certificates provide a better alternative but in many environments they are a missing piece in the overall security infrastructure. Assuming you aren't using SSL client certs then another alternative to password authentication is LDAP. In many companies there is already directory server infrastructure and many of your applications may be using LDAP already. So today I want to talk about configuring the JMX agent to use LDAP instead of the file-based authentication.

Let's start by talking about the JMXAuthenticator implementation in the JMX agent. It is based on Java Authentication and Authorization Service (JAAS). Authentication is performed by passing the user credentials to a JAAS LoginModule. By default it uses a LoginModule that authenticates using the password and access files. An alternative LoginModule (and hence an alternative authentication mechanism), is specified using the com.sun.management.jmxremote.login.config property. The property is set to the name of a JAAS login configuration entry. For LDAP that means we need to set it to the entry name for an LDAP-based LoginModule.

J2SETM 5.0 didn't ship with an LDAP based LoginModule but there is one in a Mustang (Java SE 6.0) thanks to Vincent Ryan. The LoginModule is com.sun.security.auth.module.LdapLoginModule. To use it we need to create a JAAS configuration entry. I've created the configuration file ldap.config and configured the entry to work within Sun. Here's how it looks:

SunConfig {
    com.sun.security.auth.module.LdapLoginModule REQUIRED
        userProvider="ldap://sun-ds/ou=people,dc=sun,dc=com"
        userFilter="(&(uid={USERNAME})(objectClass=inetOrgPerson))"
        authzIdentity=monitorRole
        useSSL=false;
    };

If you aren't familar with the syntax of the configuration file then the Configuration class details the information needed for configuration, and there are examples available.

The specification for the LoginModule details all the options. In this example I've named the entry "SunConfig". The flag "REQUIRED" means that authentication is required to succeed. The other items are module options. The userProvider option identifies the LDAP directory. It's a LDAP URL (or a list of URLs). The URL identifies the LDAP server to use and the position in the directory tree where user entries are located. The userFilter module option is another piece of LDAP configuration. It specifies the search filter to use to locate a user entry in the LDAP directory. The token "{USERNAME}" is replaced with the username before the filter is used to search the directory. If all this looks like gobbledegook then have a chat with your LDAP administrator to get the magic settings for your environment.

The authzIdentity takes a bit of explaining and we'll come back to it shortly. The final module option in this confguration is useSSL which indictaes if the connection to the LDAP server uses SSL or not. The default is true but I've tried to keep this example simple and so it is disabled.

So now we have a JAAS configuration entry for the LDAP LoginModule. The next piece is to configure two system properties:

  • com.sun.management.jmxremote.login.config configures the JMX agent to use our JAAS configuration entry
  • java.security.auth.login.config specifies the JAAS configuration file to load

Here's a sample command line with all the properties set:

java -Dcom.sun.management.jmxremote.port=5000
     -Dcom.sun.management.jmxremote.ssl=false
     -Dcom.sun.management.jmxremote.login.config=SunConfig
     -Djava.security.auth.login.config=ldap.config
     -jar MyApplication.jar

I've snuck in two other properties here. The com.sun.management.jmxremote.port property configures the TCP port number, and com.sun.management.jmxremote.ssl specifies if SSL is enabled or disabled (I've chosen to disable it to keep the configuration simple but you'll want to enable it in production environments).

At this point we have our configuration so we start the application. The JMX agent starts with the application so we now try to connect using jconsole. For example I'll assume the application is on "myserver" and we're "John Doe" (username "jdoe"). To connect we start jconsole, switch to the Remote tab of the Connection Dialog, and enter the connection details:

When we press the Connect button then jconsole will connect to the JMX agent, and the JMX agent will attempt to authenticate "jdoe".

When you initially setup your configuration it can be useful to add the debug opton to the JAAS configuration entry. If you add debug=true then the LdapLoginModule will print trace information to standard output. Here's an example for when jdoe does a successful login:

[LdapLoginModule] search-first mode; SSL disabled
[LdapLoginModule] user provider: ldap://sun-ds/ou=people,dc=sun,dc=com
[LdapLoginModule] searching for entry belonging to user: jdoe
[LdapLoginModule] found entry: cn=John Doe,ou=people,dc=sun,dc=com
[LdapLoginModule] attempting to authenticate user: jdoe
[LdapLoginModule] authentication succeeded
[LdapLoginModule] added X500Principal "CN=John Doe,OU=people, DC=sun, DC=com" to Subject
[LdapLoginModule] added UserPrincipal "jdoe" to Subject
[LdapLoginModule] added UserPrincipal "monitorRole" to Subject

This log is saying that the LoginModule searched for the user entry "jdoe". It was found and then the password was authenticated.

If the password was entered incorrectly then you'll see something like this:

[LdapLoginModule] search-first mode; SSL disabled
[LdapLoginModule] user provider: ldap://sun-ds/ou=people,dc=sun,dc=com
[LdapLoginModule] searching for entry belonging to user: jdoe
[LdapLoginModule] found entry: cn=John Doe,ou=people,dc=sun,dc=com
[LdapLoginModule] attempting to authenticate user: jdoe
[LdapLoginModule] authentication failed
[LdapLoginModule] aborted authentication

Now let's get back to the authzIdentity module option that I skipped over earilier. In the example I used authzIdentity=monitorRole which means that all authenticated users get read-only access to the managed VM. In technical terms the Principle named monitorRole is added to each authenticated user (or Subject). The name monitorRole corresponds to an entry in the JMX access file. The JMX access file is usually ${JRE_HOME}/lib/management/jmxremote.access but you can use the com.sun.management.jmxremote.access.file property to specify an alternative file if you wish. By default the file contains two roles, namely monitorRole with readonly access, and controlRole with readwrite access. In some environments it might make sense to allow all users access to the managed VM but more realistically there will only be a small number of technical staff that will be monitoring and managing the applications. In that case we need to update the configuration as follows:

So, assuming we want our "John Doe" to have read-write access then we create an entry in the JMX access file as follows:

jdoe    readwrite

So what does this mean? When John Doe connects he will be authenticated using his normal LDAP password. Once authenticated he has readwrite access to the managed application (by virtue of the entry in the access file).

In summary, I think you will agree that the ability for the JMX agent to authenticate users using LDAP is very nice. It eliminates the need to manage additional password files and for those managing applications it means there is only one password to remember. There is some configuration required and specific users still need to be setup in the access file but overall it is a whole lot better than having to mantain password files.

Comments:

Hi, what a great blog! you're right to higlight the feature to connect to jmx apps and authenticate with jaas through JMXAuthenticator. about authenticating against an LDAP directory: you've said: "J2SETM 5.0 didn't ship with an LDAP based LoginModule" since java 1.4, you can connect with the JNDILoginModule to an LDAP directory. jGuard(http://www.jguard.net) provides also a LGPL net.sf.jguard.loginmodules.loginModule to do that: JNDILoginModule(yes, the same name). note that with jGuard, you can modify on the fly authentication and authorization system to have a flexible security management system. it provides a powerful COnfiguration and Policy implementation. cheers, Charles(jGuard team).

Posted by Charles GAY on January 17, 2006 at 06:39 AM PST #

slm arkadaslar ben caner fazla lafa gerek yok okadar

Posted by canerrasit on July 20, 2006 at 03:41 AM PDT #

nil

Posted by Ramzy on July 23, 2006 at 03:22 PM PDT #

Posted by guest on July 26, 2006 at 05:59 PM PDT #

yyy

Posted by guest on August 01, 2006 at 04:01 PM PDT #

i want internet trading

Posted by Niraj Singh on August 02, 2006 at 10:04 PM PDT #

Java Is VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY VERY Great Language

Posted by Gaurav on August 06, 2006 at 05:53 PM PDT #

good

Posted by guest on August 09, 2006 at 06:40 PM PDT #

I like The java programming language.

Posted by xbooms on August 29, 2006 at 07:46 PM PDT #

Post a Comment:
Comments are closed for this entry.
About

user12820862

Search

Top Tags
Categories
Archives
« April 2014
SunMonTueWedThuFriSat
  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
   
       
Today
News
Blogroll

No bookmarks in folder