JNDI Security?

[kaloisi]

Is there a way to force authentication for all JNDI access? I'm having trouble finding documentation on this subject.

It looks like the LoginInitialContextFactory accepts a user/password but NamingContextFactory doesn't.

So is there a way to disable NamingContextFactory?

[peterj]

If you run JNDI over HTTP you can secure access. Maybe that will work for you. See http://docs.jboss.com/jbossas/guides/j2eeguide/r2/en/html_single/#d0e6617

[kaloisi]

Is that the only way? Or the Easiest Way?

Do you know how to disable the RMI / jnp protocals?

[peterj]

"kaloisi" wrote:
Is that the only way? Or the Easiest Way?

Neither. It is The Only Way I Know How. Others who are smarter than I am might have other, betters ways of doing it.

As far as disabling jnp, I saw this comment in server/default/conf/jboss-service.xml:

<!-- The listening port for the bootstrap JNP service. Set this to -1
 to run the NamingService without the JNP invoker listening port.
 -->
 <attribute name="Port">1099</attribute>

[vonarxma]

Hi,

There is no example how to access the http invoker when authentication is required. With the following jndi.properties

java.naming.factory.initial=org.jboss.naming.HttpNamingContextFactory
java.naming.factory.url.pkgs=org.jboss.naming
java.naming.provider.url=http://localhost:8080/invoker/JNDIFactory

an exception was thrown instead of the requested naming context. Have you found a solution?

Regards, Matthias