Uploaded image for project: 'ActiveMQ Artemis'
  1. ActiveMQ Artemis
  2. ARTEMIS-3325

JMX guard blocks local access to Artemis MBeans

    XMLWordPrintableJSON

Details

    • Bug
    • Status: In Progress
    • Minor
    • Resolution: Unresolved
    • 2.17.0
    • None
    • JMX

    Description

      In 2.17.0, there were some changes to JMX RBAC which enforces guarded JMX access.

      While this is fine for remote access to JMX, or the HTTP access to JMX via Hawtio/Jolokia, it does seem that local connections are blocked from reading the Mbeans for:

       org.apache.activemq.artemis.*

      This wasn't the case for 2.16.0 and earlier.

      Since there doesn't seem to be a way to pass authentication on the JMX Attach API with something like Jconsole, therefore we need a bypass for the guarded access to enable read-only access to the Artemis Mbeans for monitoring purposes. As you can see, they are in 'unavailable' state for Jconsole.

      The Artemis documentation on security states that Jconsole will use BasicSecurityManager, not JAAS, but it's not made clear that this means only remote access: https://activemq.apache.org/components/artemis/documentation/latest/security.html#basic-security-manager

       

       

      Attachments

        Activity

          People

            brusdev Domenico Francesco Bruscino
            The_AM Andrew
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated: