Password echo of appclient in GlassFish?
By Shing Wai Chan on Mar 14, 2007
In SJSAS 8.x, 9.0 and GlassFish v1, when one tries to access a password protected EJB or Web Service through appclient, it will prompt user name and password if this is not specified in command line or programmatically. By default the prompt will be a GUI dialog box. In remote environment, it may be desirable to have the prompt in text mode. One can achieve this through appclient as follows:
appclient -client <location of the client jar> -textauth
And username and password will be prompted and user's response will be as follows:
Note that the password is echoed in the console. This is highly undesirable from security point of view.
In GlassFish v2 with JDK 6 environment, the password is
no longer echoed in text password prompt. One can switch the
JDK of GlassFish server by editing the
config/asenv.conf for non-Windows systems and
config/asenv.bat for Windows systems. If one
reruns the above
appclient command, then one will have
Note that the password is no longer echoed in the console.
One may ask whether one can achieve this without modifying the JDK in whole installation. In GlassFish, one can package the appclient and install it in somewhere else. The command is as follows:
This will generate a
appclient.jar . Then one
can copy this to the desired location and unjar the content.
After that, one may need to update the following inside the unjar
appclientscript to execution mode if necessary. The command in unix is:
chmod u+x appclient.
- update the content of
asenv.bat, sun-acc.xml, appclient as described in SJSAS package-appclient doc. For instance, if one want to use webservice in client, then one need to update
AS_WEBSERVICE_LIB. In our case, one need to update
AS_JAVAto point to a JDK 6 installation.
appclienthas been updated.