Uploaded image for project: 'Geode'
  1. Geode
  2. GEODE-6717

NotAuthorizedException during JMX scraping

    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Closed
    • Major
    • Resolution: Fixed
    • None
    • 1.11.0
    • jmx, security
    • None

    Description

      Geode shows the following log and the JMX statistics gathering fails:

      [info 2019/04/29 15:02:39.609 CEST locator <RMI TCP Connection(23)-127.0.0.1> tid=0x80] NotAuthorizedException: null not authorized for CLUSTER:READ
      

      To reproduce this start geode with access control enabled and start JMX scraping (e.g. with jmx-exporter) from 2 processes using the same credentials at the same time. What happens is that the first RMI TCP connection is created, the user is authenticated and an Apache Shiro session is created. If the second process starts collecting JMX info while the first one is still running, his RMI TCP Connection will not create a new session, but attach to the existing one. Once the first connection ends, the session is stopped, the cache emptied and the second connection is left trying to gather info without a valid session and credentials info.

       

      As I saw this is how Apache Shiro works:

      To create a session it use method getSession(boolean create). In case there is already an existing session associated with the same Subject, it is returned and create argument is ignored. If no session exist and create is true, new session will be created, associated with that Subject and then returned.

       

      Workaround for this is checking how many processes are connected to the session, and logout only if this is the latest process connected on it.

       

      Attachments

        Activity

          People

            mkevo Mario Kevo
            mkevo Mario Kevo
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0h
                0h
                Logged:
                Time Spent - 9h
                9h