Technical White Paper - JBoss Security

Locate the jmx-console.war directory in the deploy directory of your server configuration. If you are just using the default configuration, then it will be under JBOSS_DIR/server/default/deploy directory and you are using the clustered configuration, then it will be under JBOSS_DIR/server/all/deploy directory.

Now edit the web.xml file under jmx-console.war/WEB-INF directory and uncomment the security constraint block as shown below:

   <!-- A security constraint that restricts access to the HTML JMX console
   to users with the role JBossAdmin. Edit the roles to what you want and
   uncomment the WEB-INF/jboss-web.xml/security-domain element to enable
   secured access to the HTML JMX console. -->
   <security-constraint>
     <web-resource-collection>
       <web-resource-name>HtmlAdaptor</web-resource-name>
       <description>An example security config that only allows users with the
         role JBossAdmin to access the HTML JMX console web application
       </description>
       <url-pattern>/*</url-pattern>
       <http-method>GET</http-method>
       <http-method>POST</http-method>
     </web-resource-collection>
     <auth-constraint>
       <role-name>JBossAdmin</role-name>
     </auth-constraint>
   </security-constraint> 

Edit the jboss-web.xml file also and uncomment the security-domain element as shown below:

<jboss-web>
   <!-- Uncomment the security-domain to enable security. You will
      need to edit the htmladaptor login configuration to setup the
      login modules used to authentication users.  -->
      <security-domain>java:/jaas/jmx-console</security-domain> 
</jboss-web>

Now locate the two properties files called as jmx-console-users.properties and jmx-console-roles.properties that will be in the conf directory of your server configuration under the props sub-directory('default', 'all' or 'custom'). An example of the location will be /server/default/conf/props.

In the jmx-console-users.properties, you can add/change the user/password combination.

In the jmx-console-roles.properties, you will need to assign roles to the users you added or changed in step.4. Just remember to add JBossAdmin role to the users who will be using the jmx-console.

Now when you start JBoss and try to access the jmx-console, you should see a pop up appear that will ask you to enter the username and password. You can use one of the users/password combination that you configured in steps 4 and 5.

Perform all the steps outlined in the earlier chapter to secure the jmx-console.

Edit the web.xml file of deploy/jmx-console.war/WEB-INF in the server configuration you are using (default, all, custom etc). You will need to uncomment the filter settings as shown here:

<!-- -->
       <filter>
         <filter-name>JmxOpsAccessControlFilter</filter-name>
         <filter-class>org.jboss.jmx.adaptor.html.JMXOpsAccessControlFilter</filter-class>
         <init-param>
           <param-name>updateAttributes</param-name>
           <param-value>UpdateAttributeRole</param-value>
           <description>Comma-delimited Roles that define the JMX Operation denoting updation of Attributes</description>
         </init-param>
         <init-param>
           <param-name>invokeOp</param-name>
           <param-value>InvokeOpRole</param-value>
           <description>Comma-delimited Roles that define the JMX Operation denoting Invocation of Operations</description>
         </init-param>
      </filter>
      <filter-mapping>
         <filter-name>JmxOpsAccessControlFilter</filter-name>
         <servlet-name>HtmlAdaptor</servlet-name>
      </filter-mapping> 

Now if an user is allowed to click the 'invoke' buttons on the various MBean services in the jmx console (action will invoke operations), then the user needs to have 'InvokeOpRole'. If the user is allowed to click the 'Apply Changes' button(action will update the jmx attributes of the service), then the user needs to have 'updateAttributeRole'.

For this to apply, you will need to update the jmx-console-roles.properties file. An example is shown below:

# A sample roles.properties file for use with the UsersRolesLoginModule
 admin=JBossAdmin,HttpInvoker,UpdateAttributeRole
 admin2=JBossAdmin,HttpInvoker,InvokeOpRole