Mailing-List: contact user-help@karaf.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@karaf.apache.org
Received-SPF: pass (nike.apache.org: local policy)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=s1024; d=yahoo.com;
  h=DKIM-Signature:Received:X-Yahoo-SMTP:X-YMail-OSG:X-Yahoo-Newman-Property:Content-Type:Mime-Version:Subject:From:In-Reply-To:Date:Content-Transfer-Encoding:Message-Id:References:To:X-Mailer;
  b=yn/Ru8RYuQNQBsiC3qr84yJ+5T4Y3/ENTgorw8uLTYyvs9AebNEj47EhmTi99IKIRbomBfE/D5/M8hXdjNVIH0BE+8hATFWd16j51xTey5SsKO50qt2ETvhFcRhLqqRhx5o2L/Cc5G6BBGOsHEn+eG5dS2JRn1JPeCyw/LJLzZQ=
  ;
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Apple Message framework v1084)
Subject: Re: Turn off karaf jmx authentication
From: David Jencks <david_jencks@yahoo.com>
In-Reply-To: 
 <CAPCjjnF_5Cm33XESc8o7en+g=HPV-7V9Ru-qGhkdMi7G49f1Ow@mail.gmail.com>
Date: Wed, 6 Jul 2011 17:49:56 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <4F6517A9-68A1-452B-8AC7-7BE8144E4555@yahoo.com>
References: 
 <CAPCjjnHHAFMZmn9FqaBa4zBJScbPssk7Tr915nvO-YAL5MGA5g@mail.gmail.com>
 <8AAB5393-650D-4A15-BAD8-26DC10026ECE@yahoo.com>
 <CAPCjjnG04+0zzDNP12PaLv1q3k26FDWoXtJ0O76v1-fD1cMmoQ@mail.gmail.com>
 <CAPCjjnF_5Cm33XESc8o7en+g=HPV-7V9Ru-qGhkdMi7G49f1Ow@mail.gmail.com>
To: user@karaf.apache.org

I think it might be a good idea to have a flag whose name clearly =
identifies what kind of auth will be used, e.g.

jmxAuthentication=3D<UserPassword|ClientCert>

I'd expect to be confused otherwise.

thanks
david jencks

On Jul 6, 2011, at 4:01 PM, Dan Tran wrote:

> I meant o.a.k.management.cfg's jmxRealm field
>=20
> -D
>=20
> On Wed, Jul 6, 2011 at 4:00 PM, Dan Tran <dantran@gmail.com> wrote:
>> My be I can enhance o.a.k.management to disable user/pass
>> authentication if the 'realm' field is empty?
>>=20
>> -D
>>=20
>> On Wed, Jul 6, 2011 at 2:53 PM, David Jencks <david_jencks@yahoo.com> =
wrote:
>>> Hi Dan,
>>>=20
>>> I was thinking about this too recently.... geronimo has pretty much =
the same code for user/pw jmx auth and also client cert auth.  =
Geronimo's user/pw code is slightly more functional than karaf's in that =
it provides logout functionality.  At the moment it is not controlled by =
config admin.
>>>=20
>>> If you'd like to take a look and repurpose the geronimo code its at
>>>=20
>>> =
https://svn.apache.org/repos/asf/geronimo/server/trunk/framework/modules/g=
eronimo-jmx-remoting
>>>=20
>>> There's a bunch of GBeanInfoBuilder goo in there that is geronimo =
specific.  Basically you should take it out after using it as a guide =
for what to expose via config admin.
>>>=20
>>> If I had time and were working on this :-) I would use Declarative =
Services and write a component that depending on a flag in config admin =
would set up either the user/pw jmx connector/authenticator or the =
client cert one, looking for different properties in config admin for =
each.  It's presumably possible to do this with blueprint as well.
>>>=20
>>> hope this helps
>>> david jencks
>>>=20
>>> On Jul 6, 2011, at 1:39 PM, Dan Tran wrote:
>>>=20
>>>> Hi I am in the process of getting my Karaf's JMX to accept only SSL
>>>> with client certificate.  But first, how do I turn off the normal
>>>> user/password ( karaf/karaf ) authentication?
>>>>=20
>>>> the etc/o.a.k.management.cfg does not seem to provide a way to do =
just that.
>>>>=20
>>>> Thanks
>>>>=20
>>>>=20
>>>> -Dan
>>>=20
>>>=20
>>=20