Remote Deployment permissions

Question

Hi all,
I want to do a remote deployment from my pc to a cluster on different machines using the admin_client.jar file.
The example in the OC4J Deployment Guide is this :
java -jar admin_client.jar
deployer:oc4j:opmn://test-cycle.oracle.com/testunit
oc4jadmin_ welcome1+
-deploy
-file d:\temp\rupg\testru.ear
-deploymentName testru –bindAllWebApps
As you can see the example uses the oc4jadmin account to do a remote deployment.
That also works for me. However, when I use another test account that is not a member of the oc4j-administrators+ role (see system-jazn-data.xml) I get the following error:
+FINER: RMIConnection.writeDisconnectMessage Preparing to send disconnect message: Login failed Not authorized*+
FINE: RMIClient.lookup Failed during lookupjavax.naming.AuthenticationException: Not authorized
at oracle.oc4j.rmi.ClientRmiTransport.connectToServer(ClientRmiTransport.java:100)
+...+
I already tried making the test account a member of the oc4j-app-administrators+ role. This gives the test account only com.evermind.server.rmi.RMIPermission Login.
However, a -validateURI or -deploy using the admin_client.jar still failes.
So my question is : Is there a list available somewhere of all the (jazn) permissions needed to do a remote deployment ? I couldn't find such a list in the deployment guide (10.1.3.4.0) ...
Regards,
Ronald Wouters

Answer 1

I found a solution to this problem.
The problem was that I was trying to do a remote deploy NOT to the default "home" oc4j instance but to another oc4j instance that I created in the same application server instance. I had given my test user only "RMIPermission login". However, this test user was defined only in the system-jazn-data.xml of the "home" oc4j instance.
I simply copied this xml over to the other oc4j instance, thereby setting up the same users, roles and permissions in the new oc4j instance as in the home instance.
After restarting the appserver, remote deployment using my test account worked just fine.
I'm pretty sure this is not the "official" way to do this because in a production environment you would probably not even have write permissions to the directory containing these xml files.
Can anyone tell me if the javasso stuff that I read about in the config and admin manual could be the "official" way to solve this kind of problem ? Or am I way off base here ?
Any insight would be much appreciated.
Regards.