I think I've seen this behavior too. AFAIC this is a bug. 
Do you happen to have a scenario where it's really reproducible?
Could you open a issue for it?

Thanks, Achim 

2015-03-10 14:23 GMT+01:00 Martin Lichtin <lichtin@yahoo.com>:
I understand that access to MBeans is protected via RBAC mechanism:


However, is this also the case for code running inside Karaf?
E.g. when doing

   MBeanServer mbs = ManagementFactory.getPlatformMBeanServer();

it seems I can access all MBeans without requiring a username/password.

However, this is not reliable.
Depending on startup timing (or something else), _sometimes_
I receive "Insufficient roles/credentials for operation" for a query,
indicating that KarafMBeanServerGuard is intervening.


Apache Member
Apache Karaf <http://karaf.apache.org/> Committer & PMC
OPS4J Pax Web <http://wiki.ops4j.org/display/paxweb/Pax+Web/> Committer & Project Lead
blog <http://notizblog.nierbeck.de/>
Co-Author of Apache Karaf Cookbook <http://bit.ly/1ps9rkS>

Software Architect / Project Manager / Scrum Master