Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature] allow javaAgent to load a custom Authenticator #1001

Closed
gtully opened this issue Oct 3, 2024 · 2 comments
Closed

[Feature] allow javaAgent to load a custom Authenticator #1001

gtully opened this issue Oct 3, 2024 · 2 comments

Comments

@gtully
Copy link
Contributor

gtully commented Oct 3, 2024

The context is apache activemq artemis, where the mbean server can be locked down to authenticated users.
The RBAC, requires ArtemisPrincipals, and typically artemis generates these through JAAS logins. An example authenticator that we would like to plug in is at https://github.com/apache/activemq-artemis/blob/main/artemis-server/src/main/java/org/apache/activemq/artemis/spi/core/security/jaas/HttpServerAuthenticator.java

see some documentation at: https://activemq.apache.org/components/artemis/documentation/latest/management.html#artemis_rbac_mbean_server_guard
With this feature, the agent can directly authenticate with Artemis. With out some solution, the agent won't be able to scrape any mbeans!

There is another piece of the puzzle covered by prometheus/client_java#1088
To propagate an authenticated jaas subject to the application or MBean calls we need an attribute and a doAs handler.

gtully added a commit to gtully/jmx_exporter that referenced this issue Oct 3, 2024
gtully added a commit to gtully/jmx_exporter that referenced this issue Oct 3, 2024
dhoard pushed a commit that referenced this issue Oct 20, 2024
@dhoard dhoard self-assigned this Oct 21, 2024
@dhoard
Copy link
Collaborator

dhoard commented Oct 31, 2024

@gtully I have integrated the code. I made some changes around class names/configuration.

httpServer:
  authentication:
    plugin:
      class: io.prometheus.jmx.AuthenticatorPlugin
      subjectAttributeName: io.prometheus.jmx.CustomAuthenticatorSubjectAttribute

@gtully
Copy link
Contributor Author

gtully commented Oct 31, 2024

@dhoard thanks for your help on this, and for the ibm java fix. much appreciated.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants