jmx_exporter icon indicating copy to clipboard operation
jmx_exporter copied to clipboard

[Feature] allow javaAgent to load a custom Authenticator

Open gtully opened this issue 4 months ago • 0 comments

The context is apache activemq artemis, where the mbean server can be locked down to authenticated users. The RBAC, requires ArtemisPrincipals, and typically artemis generates these through JAAS logins. An example authenticator that we would like to plug in is at https://github.com/apache/activemq-artemis/blob/main/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/jaas/HttpServerAuthenticator.java

see some documentation at: https://activemq.apache.org/components/artemis/documentation/latest/management.html#artemis_rbac_mbean_server_guard With this feature, the agent can directly authenticate with Artemis. With out some solution, the agent won't be able to scrape any mbeans!

There is another piece of the puzzle covered by https://github.com/prometheus/client_java/issues/1088 To propagate an authenticated jaas subject to the application or MBean calls we need an attribute and a doAs handler.

gtully avatar Oct 03 '24 12:10 gtully