Want to shutdown solaris 10 using java application

Question

Greetings all!
I have been unsuccessful at creating my application to shut down a Solaris 10 server with a java application. I am hoping someone might be able to point me in a good direction here.
I want to log on as a regular user and run a java application that monitors remote information (UPS battery voltage) and will gracefully shutdown the server if there is a problem. If I run my application as root all is well, except that I am running as root :)
I can write code to access the shell:
Process proc = Runtime.getRuntime().exec("ls");
BufferedReader Input = new BufferedReader(new InputStreamReader(proc.getInputStream()));
while ((s = Input.readLine()) != null) {out.println(s);}
But I can't do a "su"?
I've tried multiple examples out there of code that allows shell communication, and good examples of using Runtime.getRuntime()
I think the conclusion is that you can't issue a su command via java application.
I've also tried to telnet from a console to localhost and log in as root - no joy there either.
Would someone have information that might point me in the right direction to solve this problem? Even better, if there is a sample snippet to go along with any help.
Thank You very much!
Ray

Answer 1

Wow,
Thank you for the very detailed response! I read the referenced web page last night, I'll read it again today too. RBAC sounds like a pretty complicated administrative tool. Coming from the Win32 domain, most of this security stuff is sadly uncharted territory for me (except for my mac).
Let me see if I understand your method:
Create a role, javarole, this role needs Primary Administrator priviliges (in order to invoke "shutdown -y -i5 -g0") only available to root
Create a powerdown profile, essentially a script:
this line creates the file:
# echo "powerdown:::profile to powerdown server:help=powerdown.html" >> /etc/security/prof_attr
I think this is the actual added script: (instead of the shutdown command just use init 5)
# chmod 755 /usr/sbin/powerdown
# cat > /usr/sbin/powerdown <<EOF
#!/bin/sh
/usr/sbin/init 5
EOF
This line is a bit confusing to me, is it also part of the script?
# echo "powerdown:suser:cmd:::/usr/sbin/powerdown:uid=0" >> /etc/security/exec_attr
I see the uid=0 (root)
It seems obvious to me that I log in a root to create this script, which is the reason it has permission to shutdown...right?
Also, I tried the su command using runTime.exec("su poweroff"); // a user I created to try poweroff scripts
It seems that su is generally not available, I will create the role and try to telnet to it.
What about creating a generic user script that includes the javarole name and password, and then run the script "/usr/sbin/powerdown"
Yes, it leaves a role password exposed, however it is a very limited role, that is not accessible by a user login, but the turn off script is available to every user?
Regards,
Ray