JDK-8333344 : JMX attaching of Subject does not work when security manager not allowed
  • Type: Bug
  • Component: core-svc
  • Sub-Component: javax.management
  • Priority: P2
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2024-05-31
  • Updated: 2024-06-21
  • Resolved: 2024-06-19
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 23 JDK 24
23Fixed 24 b03Fixed
Related Reports
Relates :  
JDK-8296244 - Alternate implementation of user-based authorization Subject APIs that doesn’t depend on Security Manager APIs
Description
An app server testing with JDK 23 builds is failing since JDK-8296244.

<May 30, 2024, 10:07:33,634 AM Coordinated Universal Time> <Notice> <JMX> <BEA-149535> <JMX Resiliency Activity Server=AdminServer : Connection already exists for the server. Did not attempt to connect to the server>

<May 30, 2024, 10:07:34,356 AM Coordinated Universal Time> <Warning> <RMI> <BEA-080003> <A RuntimeException was generated by the RMI server: javax.management.remote.rmi.RMIConnectionImpl.invoke(Ljavax.management.ObjectName;Ljava.lang.String;Ljava.rmi.MarshalledObject;[Ljava.lang.String;Ljavax.security.auth.Subject;)

weblogic.management.NoAccessRuntimeException: [Management:141302]Access not allowed for Subject: principals=[], on resource Domain, action: execute, target lookupTarget..

weblogic.management.NoAccessRuntimeException: [Management:141302]Access not allowed for Subject: principals=[], on resource Domain, action: execute, target lookupTarget.

                at weblogic.management.internal.SecurityHelper$IsAccessAllowedPrivilegeAction.run(SecurityHelper.java:868)

                at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:344)
Comments
A pull request was submitted for review. URL: https://git.openjdk.org/jdk/pull/19810 Date: 2024-06-20 15:24:35 +0000
20-06-2024
Changeset: bcf4bb48 Author: Kevin Walls <kevinw@openjdk.org> Date: 2024-06-19 16:35:20 +0000 URL: https://git.openjdk.org/jdk/commit/bcf4bb4882e06d8c52f6eb4e9c4e027ba0622c5f
19-06-2024
In problematic builds of jdk 23, after JDK-8296244, attaching with JMX using authentication results in: "getSubject is supported only if a security manager is allowed" The Security Manager being allowed means that -Djava.security.manager=allow to be set, which is not what we document for JMX connections. That setting can be a workaround, but with the current proposed change here in the linked PR, JMX attaches using authentication work without that setting (and with or without a Security Manager).
19-06-2024
A pull request was submitted for review. URL: https://git.openjdk.org/jdk/pull/19624 Date: 2024-06-10 11:28:28 +0000
10-06-2024