title: Camel + JMX + LDAP authentication with org.apache.camel.jmx.createRmiConnector
body: <p>all.</p>
  
  <p>Have been trying to get remoted JMX with JAAS authentication to work usin Camel version 2.10.3 + Java 6.</p>
  
  <p>The app uses Java DSL and is "hand wired", and runs with system properties:</p>
  
  <pre><code>-Dcom.sun.management.jmxremote.authenticate=true 
  -Djmx.remote.x.login.config=StagingJmxAuthConfig 
  -Dorg.apache.camel.jmx.usePlatformMBeanServer=true 
  -Djava.security.auth.login.config=./src/main/resources/conf/ldap-auth.config 
  -Dcom.sun.management.jmxremote.ssl=false
  -Dorg.apache.camel.jmx.createRmiConnector=true
  -Dorg.apache.camel.jmx.rmiConnector.registryPort=9140
  </code></pre>
  
  <p>However, for all intents and purposes it seems that I might as well be running with authentication/authorization switched off.</p>
  
  <p>Debugging into the JRE's JMX and JAAS classes (and Camel as well), note the following:</p>
  
  <p>In the class <code>org.apache.camel.management.DefaultManagementAgent</code>:</p>
  
  <pre><code>cs = JMXConnectorServerFactory.newJMXConnectorServer(url, null, server);
  </code></pre>
  
  <p>This in turn later creates an instance of <code>javax.management.remote.rmi.RMIJRMPServerImpl</code> with an empty Map for the <code>env</code> constructor argument.</p>
  
  <p>Now, I wonder if there's something that's just escaping me -- when a request later comes to the the connector, and the <code>javax.management.remote.rmi.RMIServerImpl</code> does a <code>doNewClient()</code>, it can't possibly trigger any JAAS activity? </p>
  
  <p>Line 197-208 of RMIServerImpl - remember Camel sets "env" to <code>null</code>, which is translated to empty map:</p>
  
  <pre><code>JMXAuthenticator authenticator =
      (JMXAuthenticator) env.get(JMXConnectorServer.AUTHENTICATOR);
  if (authenticator == null) {
      /*
       * Create the JAAS-based authenticator only if authentication
       * has been enabled
       */
      if (env.get("jmx.remote.x.password.file") != null ||
      env.get("jmx.remote.x.login.config") != null) {
      authenticator = new JMXPluggableAuthenticator(env);
      }
  }
  </code></pre>
  
  <p>Am I correct in assuming that to get remoted, JAAS authenticated JMX to work one must hand code the JMX RMI connector setup?</p>
  
  <p>Shouldn't Camel have provided an environment to get JAAS to work? Doesn't even seem to touch the JAAS config file...</p>
  
  <p><strong>UPDATE: SOLVED</strong></p>
  
  <p>Setting the following system properties on the VM did the trick:</p>
  
  <pre><code>-Dcom.sun.management.jmxremote=true 
  -Dcom.sun.management.jmxremote.port=9410
  -Dcom.sun.management.jmxremote.authenticate=true
  -Djmx.remote.x.login.config=StagingJmxAuthConfig
  -Dorg.apache.camel.jmx.usePlatformMBeanServer=true
  -Djava.security.auth.login.config=./src/main/resources/conf/ldap-auth.config
  -Dcom.sun.management.jmxremote.ssl=false 
  -Dorg.apache.camel.jmx.createRmiConnector=false 
  -Dcom.sun.management.jmxremote.login.config=StagingJmxAuthConfig
  </code></pre>
  
  <p>For us, using a secured LDAP, the following is the login config:</p>
  
  <pre><code>StagingJmxAuthConfig {
     com.sun.security.auth.module.LdapLoginModule REQUIRED
     java.naming.security.authentication="simple"
     java.naming.security.principal="cn=Directory Manager"
     java.naming.security.credentials="PASSWORD"
     userProvider="ldap://LDAPHOST:389/BASEDN"
     userFilter="(&amp;(uid={USERNAME})(appRole=SOME_VALUE))"
     authzIdentity=monitorRole
     debug=true
     useSSL=false;
     };
  </code></pre>
  
  <p>Now I'm able to connect using jmxterm:</p>
  
  <pre><code>java -jar jmxterm-1.0-alpha-4-uber.jar -l service:jmx:rmi:///jndi/rmi://THEHOST:9410/jmxrmi -u LDAPUSER -p LDAPPASS
  </code></pre>
  
  <p>Note that the JNDI RMI name is missing the "/camel" postfix -- this is the only difference, it seems.</p>
  
  <p>HOORAY!</p>