Mailing-List: contact derby-dev-help@db.apache.org; run by ezmlm
Precedence: bulk
Reply-To: <derby-dev@db.apache.org>
Received-SPF: neutral (nike.apache.org: local policy)
Message-ID: <47A8CEDA.90400@apache.org>
Date: Tue, 05 Feb 2008 13:02:18 -0800
From: Daniel John Debrunner <djd@apache.org>
User-Agent: Thunderbird 2.0.0.9 (Windows/20071031)
MIME-Version: 1.0
To: derby-dev@db.apache.org
Subject: Re: [jira] Commented: (DERBY-1387) Add JMX extensions to Derby
References: <29598799.1202234048566.JavaMail.jira@brutus>
 <47A8B9D5.3090505@apache.org> <47A8CC7F.7080504@sun.com>
In-Reply-To: <47A8CC7F.7080504@sun.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Rick Hillegas wrote:
> Daniel John Debrunner wrote:
>> Rick Hillegas (JIRA) wrote:
>>>     [ 
>>> https://issues.apache.org/jira/browse/DERBY-1387?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12565836#action_12565836 
>>> ]
>>> Rick Hillegas commented on DERBY-1387:
>>> --------------------------------------
>>>
>>> I believe the reason that I was not able to connect at the end of my 
>>> experiment was this: the server was actually brought down. Again, 
>>> without presenting credentials, this seems like the wrong behavior to 
>>> me.
>>
>> Isn't that Derby's behaviour at the moment, shutting the network 
>> server down does not enforce authentication? Security enforcement 
>> should not be the role of the JMX mbeans.
>>
>> Dan.
> Right. I think there are at least two authentication issues here. One is 
> the current behavior of the network server (the bug which will be 
> addressed by Martin's work on DERBY-2109). The other issue is the fact 
> that the current DERBY-1387 patch lets you get your hands on the server 
> and system MBeans without presenting credentials. It's that latter issue 
> which I'm talking about here.

What would be the issue with getting access to those mbeans without 
authentication? Just trying to understand the concern.

Dan.