Spring / OC4J / JMX - Unauthorized access from application publishing mbean

Question

I get the following when my Spring app tries to publish mbeans to the OC4J MBeanServer.
My app works fine in JBoss, i.e. JBoss doesn't throw a security exception.
What file do I have to configure in OC4J for this to be allowed?
java.lang.SecurityException: Unauthorized access from application: ice-crem to MBean: bean:name=portalConfig
     at oracle.oc4j.admin.jmx.shared.UserMBeanServer.checkRegisterAccess(UserMBeanServer.java:873)
     at oracle.oc4j.admin.jmx.shared.UserMBeanServer.registerMBean(UserMBeanServer.java:400)
     at oracle.oc4j.admin.jmx.server.state.LocalizationFilterMBeanServer.registerMBean(LocalizationFilterMBeanServer.java:341)

Answer 1

It looks like you are trying to access MBeans in the bean: domain from an application called ice-crem.
OC4J enforces a security proxy for MBeans. By default an application specific MBean
can only access MBeans within the same application -- so the ice-crem application can only see MBeans in the ice-crem domain.
If an application creates its own Custom MBeanServer, then the security proxy intercepto does not come into play since there are no OC4J System MBeans in it. Any application can access an applications Custom MBeanServer.
What I found when using Spring with JMX was to configure it to use a Custom MBeanServer.
<bean id="customMBeanServer"
class="org.springframework.jmx.support.MBeanServerFactoryBean">
<property name="defaultDomain" value="customMBeanServer"/>
<property name="locateExistingServerIfPossible" value="false"/>
<property name="registerWithFactory" value="true"/>
</bean>
and then put all the Spring exported MBeans in that.
<bean id="exporter"
class="org.springframework.jmx.export.MBeanExporter">
<property name="beans">
<map>
<entry key="bean:name=bean1"
value-ref="bean1"/>
<entry key="bean:name=bean2"
value-ref="bean2"/>
</map>
</property>
<property name="server" ref="customMBeanServer"/>
</bean>
If you want to disable the JMX security proxy, so you can do what you are currently trying to do and what works in JBoss, then you nee dto start OC4J with this System property:
java -Doc4j.jmx.security.proxy.off=true -jar oc4j.jarDoing that exposes the OC4J System MBeans to all deployed applications, so its not something you really want to run in production unless you then go and apply a Java2 policy style restriction on the oc4j:* mbeans.
cheers
-steve-