Problem in getting MBean attributes from a JMX remote client program with Administrative Security on

reete...@yahoo.co.in

unread,

Feb 21, 2007, 3:12:55 AM2/21/07

to

Hi,
I am new to JMX and WebSphere Application Server 6.1.
I am trying to get 'heapSize' attribute from 'JVM' MBean by using the Sample program given at following link:
http://publib.boulder.ibm.com/infocenter/wasinfo/v6r1/index.jsp?topic=/com.ibm.websphere.nd.doc/info/ae/ae/tjmx_develop_jsr160.html

Following are the jar files in my classpath:
1)com.ibm.ws.admin.client_6.1.0.jar
2)com.ibm.ws.webservices.thinclient_6.1.0.jar
3)ibmorb.jar
4)management.jar
5)pmij2ee.jar

I was able to create a connection with the Application Server and then Query for the JVM MBean as well. But while calling the getAttribute method for the JVM MBean as shown below:
mbsc.getAttribute(mbean,"heapSize");

I received following error on above line:
javax.management.JMRuntimeException:
>> SERVER (id=4773e3aa, host=01hw107573) TRACE START:
>> javax.management.JMRuntimeException: ADMN0022E: Access is denied for the getStats operation on JVM MBean because of insufficient or empty credentials.
>> at com.ibm.ws.management.AdminServiceImpl.preInvoke(AdminServiceImpl.java:2119)
>> at com.ibm.ws.management.AdminServiceImpl.preInvoke(AdminServiceImpl.java:1766)
>> at com.ibm.ws.management.AdminServiceImpl.preInvoke(AdminServiceImpl.java:1694)
>> at com.ibm.ws.management.AdminServiceImpl.preInvoke(AdminServiceImpl.java:1667)
>> at com.ibm.ws.management.AdminServiceImpl.getAttribute(AdminServiceImpl.java:661)
>> at com.ibm.ws.management.remote.AdminServiceForwarder.getAttribute(AdminServiceForwarder.java:135)
>> at javax.management.remote.rmi.RMIConnectionImpl.doOperation(RMIConnectionImpl.java:1400)
>> at javax.management.remote.rmi.RMIConnectionImpl.access$100(RMIConnectionImpl.java:96)
>> at javax.management.remote.rmi.RMIConnectionImpl$PrivilegedOperation.run(RMIConnectionImpl.java:1260)
>> at javax.management.remote.rmi.RMIConnectionImpl.doPrivilegedOperation(RMIConnectionImpl.java:1356)
>> at javax.management.remote.rmi.RMIConnectionImpl.getAttribute(RMIConnectionImpl.java:612)
>> at javax.management.remote.rmi._RMIConnectionImpl_Tie.getAttribute(_RMIConnectionImpl_Tie.java:576)
>> at javax.management.remote.rmi._RMIConnectionImpl_Tie._invoke(_RMIConnectionImpl_Tie.java:97)
>> at com.ibm.CORBA.iiop.ServerDelegate.dispatchInvokeHandler(ServerDelegate.java:613)
>> at com.ibm.CORBA.iiop.ServerDelegate.dispatch(ServerDelegate.java:466)
>> at com.ibm.rmi.iiop.ORB.process(ORB.java:503)
>> at com.ibm.CORBA.iiop.ORB.process(ORB.java:1552)
>> at com.ibm.rmi.iiop.Connection.respondTo(Connection.java:2673)
>> at com.ibm.rmi.iiop.Connection.doWork(Connection.java:2551)
>> at com.ibm.rmi.iiop.WorkUnitImpl.doWork(WorkUnitImpl.java:62)
>> at com.ibm.ejs.oa.pool.PooledThread.run(ThreadPool.java:95)
>> at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1498)
>> SERVER (id=4773e3aa, host=01hw107573) TRACE END.

at com.ibm.ws.management.AdminServiceImpl.preInvoke(AdminServiceImpl.java:2119)
at com.ibm.ws.management.AdminServiceImpl.preInvoke(AdminServiceImpl.java:1766)
at com.ibm.ws.management.AdminServiceImpl.preInvoke(AdminServiceImpl.java:1694)
at com.ibm.ws.management.AdminServiceImpl.preInvoke(AdminServiceImpl.java:1667)
at com.ibm.ws.management.AdminServiceImpl.getAttribute(AdminServiceImpl.java:661)
at com.ibm.ws.management.remote.AdminServiceForwarder.getAttribute(AdminServiceForwarder.java:135)
at javax.management.remote.rmi.RMIConnectionImpl.doOperation(RMIConnectionImpl.java:1400)
at javax.management.remote.rmi.RMIConnectionImpl.access$100(RMIConnectionImpl.java:96)
at javax.management.remote.rmi.RMIConnectionImpl$PrivilegedOperation.run(RMIConnectionImpl.java:1260)
at javax.management.remote.rmi.RMIConnectionImpl.doPrivilegedOperation(RMIConnectionImpl.java:1356)
at javax.management.remote.rmi.RMIConnectionImpl.getAttribute(RMIConnectionImpl.java:612)
at javax.management.remote.rmi._RMIConnectionImpl_Tie.getAttribute(_RMIConnectionImpl_Tie.java:576)
at javax.management.remote.rmi._RMIConnectionImpl_Tie._invoke(_RMIConnectionImpl_Tie.java:97)
at com.ibm.CORBA.iiop.ServerDelegate.dispatchInvokeHandler(ServerDelegate.java:613)
at com.ibm.CORBA.iiop.ServerDelegate.dispatch(ServerDelegate.java:466)
at com.ibm.rmi.iiop.ORB.process(ORB.java:503)
at com.ibm.CORBA.iiop.ORB.process(ORB.java:1552)
at com.ibm.rmi.iiop.Connection.respondTo(Connection.java:2673)
at com.ibm.rmi.iiop.Connection.doWork(Connection.java:2551)
at com.ibm.rmi.iiop.WorkUnitImpl.doWork(WorkUnitImpl.java:62)
at com.ibm.ejs.oa.pool.PooledThread.run(ThreadPool.java:95)
at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1498)

I have given the proper username and password in the HashTable as mentioned in the sample example.
Can any one please help me with that.

Sven Vermeulen

unread,

Feb 21, 2007, 4:06:31 AM2/21/07

to

On Feb 21, 9:12 am, <reetesh_...@yahoo.co.in> wrote:
> I have given the proper username and password in the HashTable as mentioned in the sample example.
> Can any one please help me with that.

I've always had better luck using SOAP instead of RMI, not only for
the security side but also because I feel that SOAP is more resilient.

Have you searched for the ADMN0022E error? I see quite a few topics by
just running "RMI ADMN0022E" in Google.

Wkr,
Sven Vermeulen

Ken Hygh

unread,

Feb 21, 2007, 5:59:11 AM2/21/07

to

reete...@yahoo.co.in wrote:
> Hi,
> I am new to JMX and WebSphere Application Server 6.1.
> I am trying to get 'heapSize' attribute from 'JVM' MBean by using the Sample program given at following link:
> http://publib.boulder.ibm.com/infocenter/wasinfo/v6r1/index.jsp?topic=/com.ibm.websphere.nd.doc/info/ae/ae/tjmx_develop_jsr160.html
>
> Following are the jar files in my classpath:
> 1)com.ibm.ws.admin.client_6.1.0.jar
> 2)com.ibm.ws.webservices.thinclient_6.1.0.jar
> 3)ibmorb.jar
> 4)management.jar
> 5)pmij2ee.jar
>
> I was able to create a connection with the Application Server and then Query for the JVM MBean as well. But while calling the getAttribute method for the JVM MBean as shown below:
> mbsc.getAttribute(mbean,"heapSize");
>
> I received following error on above line:
> javax.management.JMRuntimeException:
> >> SERVER (id=4773e3aa, host=01hw107573) TRACE START:
> >> javax.management.JMRuntimeException: ADMN0022E: Access is denied for the getStats operation on JVM MBean because of insufficient or empty credentials.

[snip]

>
> I have given the proper username and password in the HashTable as mentioned in the sample example.
> Can any one please help me with that.
>

It doesn't look like you have used the proper username & password, or a
keyfile is incorrect or something. Note that Query will work without
credentials, but using the MBean will fail.

Ken

Reetesh

unread,

Feb 21, 2007, 6:21:33 AM2/21/07

to

Thanks forthe reply ken,
I don't know if i am missing something over here.
I have used following code for getting the MBeanServerConnection:
String jndiPath="/jndi/JMXConnector";
JMXServiceURL url = new JMXServiceURL("service:jmx:iiop://"+"localhost"+":"+"9809"+jndiPath);
Hashtable h = new Hashtable();

//Specify the user ID and password for the server if security is enabled on server.
String[] credentials = new String[] {"reetesh" ,"reetesh"};
h.put("jmx.remote.credentials", credentials);
h.put(JMXConnectorFactory.PROTOCOL_PROVIDER_PACKAGES, "com.ibm.websphere.management.remote");
JMXConnector jmxc = JMXConnectorFactory.connect(url, h);
MBeanServerConnection mbsc = jmxc.getMBeanServerConnection();

The username and password are correct and have Administrator role assigned to it.

Please let me know, in case i have missed out something.
Thanks in advance.

Ken Hygh

unread,

Feb 21, 2007, 8:17:12 AM2/21/07

to

Reetesh,
I've never used this particular API, what I've used is the following,
which uses the com.ibm.websphere.management.AdminClient.
Ken

public AdminClient getSecureAdminClient(String host, String port,
String user, String password) throws ConnectorException {
AdminClient ac = null;
Properties props = System.getProperties();
props.setProperty(AdminClient.CONNECTOR_TYPE,
AdminClient.CONNECTOR_TYPE_SOAP);
props.setProperty(AdminClient.CONNECTOR_HOST, host);
props.setProperty(AdminClient.CONNECTOR_PORT, port);

props.setProperty(AdminClient.PASSWORD, password);
props.setProperty(AdminClient.USERNAME, user);
props.setProperty(AdminClient.CONNECTOR_SECURITY_ENABLED, "true");

props.setProperty("javax.net.ssl.trustStore","/opt/WebSphere/ND6/profiles/default/etc/DummyClientTrustFile.jks");

props.setProperty("javax.net.ssl.keyStore","/opt/WebSphere/ND6/profiles/default/etc/DummyClientKeyFile.jks");
props.setProperty("javax.net.ssl.trustStorePassword","WebAS");
props.setProperty("javax.net.ssl.keyStorePassword","WebAS");
try {
ac = AdminClientFactory.createAdminClient(props);
} catch (ConnectorException e) {
//new AdminException(ex).printStackTrace();
System.err.println(getClass().getName() + ".getAdminClient()
Exception: " + e);
throw e;
}
return ac;

}

Reetesh

unread,

Feb 21, 2007, 8:33:07 AM2/21/07

to

Hi Ken,
U ran this code with Administrative Security enabled?

I have already tried this AdminClient approach as well, but got the same error.
It works well if i disable Admin Security from the Admin Console.

While debugging, i tried getting the properties object for the created Admin Client using adminClient.getConnectorProperties();
Then i tried getting the values for AdminClient.USERNAME and AdminClient.PASSWORD and it returned me null.

So i guess, the username password that i am setting while creating AdminClient object are not set properly. m stuck with it for quiet sometime now.
Any pointers for probable cause?

Ken Hygh

unread,

Feb 21, 2007, 9:20:27 AM2/21/07

to

This code works with security enabled. Really really sounds like you're
using the wrong userid/pw combo.

Ken

Reetesh

unread,

Feb 21, 2007, 9:44:52 AM2/21/07

to

Could you tell me the jars that u were using??

Reetesh

unread,

Feb 21, 2007, 9:43:26 AM2/21/07

to

Well Ken, thnks for the reply.

The User id that i am passing while creating AdminClient is created using Admin console under Users and Groups->Manage Users. I have given this user Administrator Role. And the password that i am providing is also correct.
I am using WAS 6.1.

Paul Ilechko

unread,

Feb 21, 2007, 10:33:19 AM2/21/07

to

This user is in your WAS user registry ?

Ken Hygh

unread,

Feb 21, 2007, 11:14:20 AM2/21/07

to

Reetesh wrote:
> Could you tell me the jars that u were using??

I used the appclient install.
Ken

Reetesh

unread,

Feb 22, 2007, 12:23:25 AM2/22/07

to

Thanks for the reply Paul.
I am using the default Federated Repository in WebSphere Application Server 6.1 for security configuration and this User is created in that.

If i have missed out could you please tell me where can i recheck the user being added in the repository?

nihil

unread,

Apr 19, 2007, 12:13:16 AM4/19/07

to

On Feb 21, 1:12 pm, <reetesh_...@yahoo.co.in> wrote:
> Hi,

> I am new toJMXandWebSphereApplication Server 6.1.
> I am trying to get 'heapSize' attribute from 'JVM' MBean by using the Sample program given at following link:http://publib.boulder.ibm.com/infocenter/wasinfo/v6r1/index.jsp?topic...

Hi reetesh.....,

Hi....

I also want to use the standard JMX Remoting API (Jsr 160) to connect
to the jmx server.
I m running sample code which u r running from below IBM link..
http://publib.boulder.ibm.com/infocenter/wasinfo/v6r1/index.jsp?topic=/com.ibm.websphere.express.doc/info/exp/ae/tjmx_customjava_jsr160.html

But when I m trying to connect it throws following exceptions...:(
java.io.IOException: Failed to retrieve RMIServer stub:
javax.naming.NameNotFoun
dException: Context: manoriDCNode01Cell/nodes/manoriDCNode01/servers/
server1, na
me: JMXConnector: First component in name JMXConnector not found.
[Root exceptio
n is org.omg.CosNaming.NamingContextPackage.NotFound: IDL:omg.org/
CosNaming/Nami
ngContext/NotFound:1.0]

Then I copied adminclient.jar and ibmorb.jar and orb.properties file
to classpath from websphere installtion and it worked well for me..:)

but thats not standard way bcoz...i guess its using websphere classes
and interfaces.......

Can u tell me wat it means by standard way of connecting to jmx
server....?

Any help greatly appreciated..

Thanks,
Nihil

sm...@ensof.co.kr

unread,

Mar 27, 2008, 9:04:51 AM3/27/08

to

Hello, 
 
I've got the exactly same problem. 
 
Did you solve this problem? 
 
Would be glad if you could give a reply here. 
 
Thanks.

Sangmok Lee

unread,

Mar 27, 2008, 9:43:26 AM3/27/08

to

<ol>
<li>Source</li>
</ol>
import java.util.Hashtable; 
import java.util.Set; 
 
import javax.management.MBeanServerConnection; 
import javax.management.ObjectName; 
import javax.management.remote.JMXConnector; 
import javax.management.remote.JMXConnectorFactory; 
import javax.management.remote.JMXServiceURL; 
 
public class WebSphereMBeanTest1 { 
 
private MBeanServerConnection mbs = null; 
 
public static void main(String[] args) { 
try { 
System.out.println("Start."); 
 
WebSphereMBeanTest1 client = new WebSphereMBeanTest1(); 
client.connect("localhost", "9100"); 
client.getHeapSize(); 
 
} catch (Exception e) { 
e.printStackTrace(); 
} 
} 
 
public void connect(String hostname, String port) throws Exception { 
String jndiPath = "/jndi/JMXConnector"; 
 
JMXServiceURL url = new JMXServiceURL("service:jmx:iiop://" + hostname + ":" + port + jndiPath); 
 
Hashtable h = new Hashtable(); 
 
String<a href="http://www-128.ibm.com/developerworks/forums/">] credentials = new String[</a> { "admin", "admin" }; 
h.put("jmx.remote.credentials", credentials); 
 
JMXConnector jmxc = JMXConnectorFactory.connect(url, h); 
 
mbs = jmxc.getMBeanServerConnection(); 
 
System.out.println("Connected."); 
} 
 
public Set getHeapSize() { 
try { 
String query = "WebSphere:*,type=JVM,j2eeType=JVM"; 
ObjectName queryName = new ObjectName(query); 
Set nameSet = mbs.queryNames(queryName, null); 
if (nameSet != null && !nameSet.isEmpty()) { 
System.out.println("#### OK. Query."); 
 
ObjectName objName = (ObjectName) nameSet.iterator().next(); 
System.out.println("#### objName : " + mbs.getMBeanInfo(objName).toString()); 
 
String heapSize = (String) mbs.getAttribute(objName, "heapSize"); 
System.out.println(heapSize); 
 
return nameSet; 
} else { 
System.out.println("#### NK. (" + query + ")"); 
return null; 
} 
} catch (Exception e) { 
System.out.println("#### Exception : " + e); 
e.printStackTrace(); 
return null; 
} 
} 
} 

<ol>
<li>StdOut</li>
</ol>
smlee@linux-smlee:~/test/mbean> run.sh 
Start. 
Connected. 
#### OK. Query. 
#### objName : javax.management.modelmbean.ModelMBeanInfoSupport@8fb850ba 
#### Exception : javax.management.JMRuntimeException: 
<div class="jive-quote"><div class="jive-quote">SERVER (id=4773e3aa, host=linux-smlee.site) TRACE START: 
javax.management.JMRuntimeException: ADMN0022E: Access is denied for the getStats operation on JVM MBean because of insufficient or empty credentials. 
at com.ibm.ws.management.AdminServiceImpl.preInvoke(AdminServiceImpl.java:1918) 
at com.ibm.ws.management.AdminServiceImpl.preInvoke(AdminServiceImpl.java:1766) 
at com.ibm.ws.management.AdminServiceImpl.preInvoke(AdminServiceImpl.java:1694) 
at com.ibm.ws.management.AdminServiceImpl.preInvoke(AdminServiceImpl.java:1667) 
at com.ibm.ws.management.AdminServiceImpl.getAttribute(AdminServiceImpl.java:661) 
at com.ibm.ws.management.remote.AdminServiceForwarder.getAttribute(AdminServiceForwarder.java:135) 
at javax.management.remote.rmi.RMIConnectionImpl.doOperation(RMIConnectionImpl.java:1400) 
at javax.management.remote.rmi.RMIConnectionImpl.access$100(RMIConnectionImpl.java:96)</div></div>
. 
. 
. 
. 

<ol>
<li>JARs</li>
</ol>
bootstrap.jar 
com.ibm.ws.emf_2.1.0.jar 
com.ibm.ws.runtime_6.1.0.jar 
com.ibm.ws.webcontainer_2.0.0.jar 
com.ibm.ws.webservices.thinclient_6.1.0.jar 
ibmorb.jar 
ibmorbapi.jar 
j2ee.jar 
jmxremote.jar 
jmxri.jar 
jmxtools.jar 
management.jar 
mx4j-jmx.jar 
ws_runtime.jar 

Thanks.

Sangmok Lee

unread,

Mar 27, 2008, 9:37:41 PM3/27/08

to

Hi, everyone~ 
 
I just found way out how to make it works well. 
 
I misunderstood the auth. system. 
 
If you have same problem, check and make it like below. 
 
Using Admin console under Users and Groups->Manage Users. 
#Admin User Role : add websphere (with 'administrator' role) 
#Admin Group Role : add my_grp (with 'administrator' roles) 
#Manage Users : websphere (with 'admin_grp' Group) 
#Manage Groups : my_grp 
 
It works <img src="!" alt="" /> (If not, you can send me a mail) 
 
Thanks.

sachg...@gmail.com

unread,

Apr 12, 2008, 3:35:14 AM4/12/08

to

Hi !! 
 
Can you help me I am getting same problem and not able to fix 
it though I have done what you have described. 

 
Thanks, 
Sachinlnctmca2004

lc...@constantcontact.com

unread,

Jul 21, 2008, 5:24:44 PM7/21/08

to

I'm trying to configure the security settings as described, but I see only the following message on the "Manage Users" and "Manage Groups" screens:

To manage users and groups, either federated repositories must be the current realm definition or the current realm definition configuration must match the federated repositories configuration. If you use Lightweight Directory Access Protocol (LDAP), configure both the federated repositories and standalone LDAP registry configurations to use the same LDAP server.