Access to Resources via Non-admin accounts

Question

Is there any way to provide access to resources so that they are accessible via
non-admin accounts. For e.g. to Retrieve my JMSConnectionfactory i do a
Environment env = new Environment();
env.setProviderUrl(url);
env.setSecurityPrincipal(username);
env.setSecurityCredentials(password);
Context ctx = env.getInitialContext();
The username and password here is the admin account. This works fine but if i
use a non-admin account(member of Operators group), i get exceptions on Domainloghandler
runtime
Problem: I need to register a mbean that needs to access JMS Resources. Since
our deployment team doesnt want to provide us access to admin accounts, we use
a "operators" group account to register our mbeans. if i do this, i get a
Access not Allowed for subject:principals=[operator, Operators], on ResourceType:
DomainLogHandlerRuntime Action: execute Target: registerToMe.
This happens when my managed resource tries to access a JMS ConnectionFactory.
Instead if i register my mbeans using the admin account, everything is fine and
my managed resource works nice.
This is on weblogic 81 SP1 on Solaris. Please let me know if you need more details.
Any clues/hints/solutions greatly appreciated. There is not a lot of documentation
on how to access/register mbeans using non-admin accounts.
TIA
Raj

Answer 1

I have done some more debugging on this and have narrowed down the issue to the
location where my initialcontext is being obtained.
so if i register my mbean as a non-admin account and do an operation on the managed
resource which fetches initial context, i get the below exception. This is how
i get my initialcontext
weblogic.jndi.Environment env = new weblogic.jndi.Environment();
env.setProviderURL("t3://machine:8102,machine:8103");
env.setSecurityPrincipal("operator");
env.setSecurityCredentials("operator");
Context ctx = env.getInitialContext();
I am doing this from a mbean thats registered on a different managed server(t3://machine:8101)...
Whats wrong with this?
TIA
Raj
"Raj" <[email protected]> wrote:
>
Is there any way to provide access to resources so that they are accessible
via
non-admin accounts. For e.g. to Retrieve my JMSConnectionfactory i do
a
Environment env = new Environment();
env.setProviderUrl(url);
env.setSecurityPrincipal(username);
env.setSecurityCredentials(password);
Context ctx = env.getInitialContext();
The username and password here is the admin account. This works fine
but if i
use a non-admin account(member of Operators group), i get exceptions
on Domainloghandler
runtime
Problem: I need to register a mbean that needs to access JMS Resources.
Since
our deployment team doesnt want to provide us access to admin accounts,
we use
a "operators" group account to register our mbeans. if i do this, i get
a
Access not Allowed for subject:principals=[operator, Operators], on ResourceType:
DomainLogHandlerRuntime Action: execute Target: registerToMe.
This happens when my managed resource tries to access a JMS ConnectionFactory.
Instead if i register my mbeans using the admin account, everything is
fine and
my managed resource works nice.
This is on weblogic 81 SP1 on Solaris. Please let me know if you need
more details.
Any clues/hints/solutions greatly appreciated. There is not a lot of
documentation
on how to access/register mbeans using non-admin accounts.
TIA
Raj