JMXMP w/ TLS

Some years ago, I ran JMXMP with TLS using the jmx remote RI. It was very easy to set up.

Now I want to do the same thing, but want to use J2SE 1.5 as much as possible. According to the latest jmx remote RI docs, I should be able to use JMXMP by just adding the jmxremote_optional.jar to my Java 1.5 classpath.

I just want TLS (eventually with client auth, and I see that there is an env setting for that). The security examples do all sorts of other SASL stuff with password lookups. I thought I just wanted a simplification of that, since there are already classes and profiles clearly labelled as "SSL".

I certainly do not want to have to code callbacks and factories. I'm want to do the sockets to do the same damned thing they do when I use raw SSLSockets. I was able to do this with an older version of the remote RI.

I notice that if I set all of the env values, and all of the necessary JSSE system properties, a SSL socket is still not allocated by com.sun.jmx.remote.opt.security.TLSServerHandler. I am setting the profile to "TLS", but I notice that if I set it to garbage it is silently ignored, so who knows. I've tried setting a few System properties for telling about the provider package containing the Sun TLS profile (why I should have to tell it about Sun's standard TLS profile, I don't know).

I've worked on this for a solid 8 hours now, and from the very few discussions I see about this, I fear that I am expected to code half a dozen custom classes just to use vannilla TLS capability which is already present in the Sun-provided classes. Is this so?

[1616 byte] By [blaine.simpsona] at [2007-11-15]
# 1

I got it working. Not at all straight-forward. It would be nice if the jmxremote RI examples contained examples of simple JMXMP SSL server and client, but I'm all set now.

blaine.simpsona at 2007-7-29 > top of java,Core,Monitoring & Management...
# 2

Hi Blaine,

It's true that in the JMXMP security examples we don't explicitly say how to do client

authentication using SSL because in most of the cases client authentication will be

performed through SASL and this is what the example tried to emphasize.

The idea with this example was to put everything in it so the user could strip it down

in order to customize it to his/her needs.

In fact, I'm afraid in your case the only think you would need to configure SSL in the

environment map is:

HashMap env = new HashMap();

env.put("jmx.remote.profiles", "TLS");

env.put("jmx.remote.tls.need.client.authentication", "true");

and supply the javax.net.ssl.keyStore* and javax.net.ssl.trustStore* system properties

to configure your keystore and truststore.

FYI, Chapter 7 and Appendix B in the JMX Remote API 1.0 specification describe all

the supported properties for the environment map.

You can find it at: http://jcp.org/en/jsr/detail?id=160

Regards,

Luis-Miguel Alventosa

JavaSE JMX/JConsole development team

Sun Microsystems, Inc.

http://blogs.sun.com/lmalventosa/

lmalventa at 2007-7-29 > top of java,Core,Monitoring & Management...