[GERONIMO-3467] Confusing security exception thrown while authenticating using JMX with a just starting server

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 2.0.1, 2.0.2, 2.1
• Fix Version/s: 2.0.2, 2.1
• Component/s: security
• Security Level: public (Regular issues)
• Assignee: Unassigned
• Reporter: Shiva Kumar
• Created: 12/Sep/07 13:07
• Updated: 23/Jul/08 21:00
• Resolved: 02/Feb/08 01:23

Description

Scenario is as below:
Let's say server is starting and org.apache.geronimo.configs/rmi-naming/2.0.1/car has started, but org.apache.geronimo.configs/j2ee-security/2.0.1/car hasn't yet started. If an external entity (like Geronimo Eclipse Plug-in) now tries to connect to the kernel remotely through JMX, although rmi connection succeeds, authenticate will fail (because security realm has not yet been started).

In this case, org.apache.geronimo.jmxremoting.Authenticator.authenticate() is getting a LoginException with error
"javax.security.auth.login.LoginException: No LoginModules configured for geronimo-admin". However this exception is not propogated, but rather is thrown back as a 'SecurityException("Invalid login")'.

Issue Links

• is depended upon by: GERONIMODEVTOOLS-193 Runs ping and throws java.lang.SecurityException during Geronimo server startup.