JMX 客户端会话
我研究 JMX 一段时间了，但我陷入困境。
我有一个通过 JMX 向远程客户端公开某些功能的应用程序，尽管现有的安全功能可能足以满足大多数情况，我的应用程序使用 Apache Shiro 框架作为安全后端。
我的问题是我不知道如何在服务器端收集客户端数据。 Shiro 需要一种方法来识别客户端（主题），通常执行线程与主题相关联，但在线 JMX 文档没有提供有关远程 JMX 线程模型的太多线索。
我如何将客户端与线程关联起来，或者有没有办法在交互的 MBean 内检索客户端数据？
I've bean studying JMX for a while, but I'm stuck.
I have an application that exposes some functionality to remote clients via JMX, although existing security features may be sufficiant for most cases my application uses Apache Shiro framework as the security backend.
My problem is that i don't how to gather client data serverside. Shiro needs a way to identify a client (subject), normally executing thread is associated with a subject but online JMX documentation does not give much clue about thread model of remote JMX.
How can i associate a client with a thread or is there a way to retrieve client data inside the interacted MBeans?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
在研究和尝试不同的技术之后；有两个赢家：
1- 名为 ClientContext 的新功能将成为 Java 7 的一部分：Java 7 尚未完成，ClientContext 将破坏向后兼容性。
2-将Shiro主题附加到AccessControlContext：这是我选择的解决方案，Shiro的默认主题检索机制不考虑Java的访问控制上下文。我很久以前就进行了测试来测试这一点，但它不起作用。现在我知道为什么了：默认情况下，SecurityUtils.getSubject() 调用将检索到的主题附加到当前调用的线程，但这种方法是无用的，因为线程可以在客户端之间共享。但 AccessControlContext 功能更强大，并且看起来 JMX 与它配合得很好；您的访问控制上下文（在 JMXAuthenticator 登录期间进行身份验证）可以从 MBeanServerForwarder 甚至您的 MBean 内部进行访问。我用多个客户端检索他们的本金对此进行了测试，它很有效。
编辑：我如何将 Shiro 主题附加到当前 AccessControlContext？
1- 使用构建器类Subject.Builder 创建一个独立的Shiro 主题。
2- 验证用户身份（使用 Shiro 主题的登录方法等）
3- 使用包含 Shiro 主题作为私有凭证的单例集创建可变 JAAS 主题。
4- 向底层 Java 安全系统提供 JAAS 主题（例如，在 JMXAuthenticator 的身份验证方法中返回主题）
可以创建一个帮助程序类来简化此方法。当您需要代表 Shiro 主题执行操作（用于授权等）时，请从 AccessControlContext 获取它并使用 Subject.execute... 方法之一。这可以在代理或转发器（如 MBeanServerForwarder）内执行。
After researching and trying different techniques; there are two winners:
1- New feature called ClientContext that will be a part of Java 7: Java 7 is not yet complete, and ClientContext will break backwards compatibility.
2- Attaching Shiro subject to AccessControlContext: This is the solution I choose, Shiro's default subject retrieval mechanism does not consider Java's access control context. I ran a test a long ago to test this but it didn't work. Now I know why: by default SecurityUtils.getSubject() call attaches the retrieved Subject to the currently calling thread, but this approach is useless since threads can be shared between clients. But AccessControlContext is much more powerful, and it looks like JMX plays nicely with it; your access control context (which is authenticated during login at JMXAuthenticator) can be accessed from a MBeanServerForwarder or even inside your MBean. I tested this with a multiple clients retrieving their principal, it simply works.
Edit: How i attach Shiro subject to the current AccessControlContext?
1- Create an unattached Shiro subject using the builder class Subject.Builder.
2- Authenticate the user (using Shiro subject's login method, etc.)
3- Create a mutable JAAS subject with a singleton set containing the Shiro subject as the private credentials.
4- Provide the JAAS subject to the underlying Java security System (for example, Return the subject inside a JMXAuthenticator's authentication method)
A helper class can be created to simplify this approach. When you need an action to be performed on behalf of the Shiro subject (for authorization, etc.), get it from AccessControlContext and use one of the Subject.execute... methods. This can be performed inside a proxy or a forwarder (like MBeanServerForwarder).