diff --git a/config/alfresco/alfresco-jmxrmi.access b/config/alfresco/alfresco-jmxrmi.access new file mode 100644 index 0000000000..765f118a36 --- /dev/null +++ b/config/alfresco/alfresco-jmxrmi.access @@ -0,0 +1,48 @@ +###################################################################### +# Default Access Control File for Remote JMX(TM) Monitoring +###################################################################### +# +# Access control file for Remote JMX API access to monitoring. +# This file defines the allowed access for different roles. The +# password file (jmxremote.password by default) defines the roles and their +# passwords. To be functional, a role must have an entry in +# both the password and the access files. +# +# Default location of this file is $JRE/lib/management/jmxremote.access +# You can specify an alternate location by specifying a property in +# the management config file $JRE/lib/management/management.properties +# (See that file for details) +# +# The file format for password and access files is syntactically the same +# as the Properties file format. The syntax is described in the Javadoc +# for java.util.Properties.load. +# Typical access file has multiple lines, where each line is blank, +# a comment (like this one), or an access control entry. +# +# An access control entry consists of a role name, and an +# associated access level. The role name is any string that does not +# itself contain spaces or tabs. It corresponds to an entry in the +# password file (jmxremote.password). The access level is one of the +# following: +# "readonly" grants access to read attributes of MBeans. +# For monitoring, this means that a remote client in this +# role can read measurements but cannot perform any action +# that changes the environment of the running program. +# "readwrite" grants access to read and write attributes of MBeans, +# to invoke operations on them, and to create or remove them. +# This access should be granted to only trusted clients, +# since they can potentially interfere with the smooth +# operation of a running program +# +# A given role should have at most one entry in this file. If a role +# has no entry, it has no access. +# If multiple entries are found for the same role name, then the last +# access entry is used. +# +# +# Default access control entries: +# o The "monitorRole" role has readonly access. +# o The "controlRole" role has readwrite access. + +monitorRole readonly +controlRole readwrite diff --git a/config/alfresco/alfresco-jmxrmi.password b/config/alfresco/alfresco-jmxrmi.password new file mode 100644 index 0000000000..6adad9adbd --- /dev/null +++ b/config/alfresco/alfresco-jmxrmi.password @@ -0,0 +1,63 @@ +# ---------------------------------------------------------------------- +# Template for jmxremote.password +# +# o Copy this template to jmxremote.password +# o Set the user/password entries in jmxremote.password +# o Change the permission of jmxremote.password to read-only +# by the owner. +# +# See below for the location of jmxremote.password file. +# ---------------------------------------------------------------------- + +############################################################## +# Password File for Remote JMX Monitoring +############################################################## +# +# Password file for Remote JMX API access to monitoring. This +# file defines the different roles and their passwords. The access +# control file (jmxremote.access by default) defines the allowed +# access for each role. To be functional, a role must have an entry +# in both the password and the access files. +# +# Default location of this file is $JRE/lib/management/jmxremote.password +# You can specify an alternate location by specifying a property in +# the management config file $JRE/lib/management/management.properties +# or by specifying a system property (See that file for details). + + +############################################################## +# File permissions of the jmxremote.password file +############################################################## +# Since there are cleartext passwords stored in this file, +# this file must be readable by ONLY the owner, +# otherwise the program will exit with an error. +# +# The file format for password and access files is syntactically the same +# as the Properties file format. The syntax is described in the Javadoc +# for java.util.Properties.load. +# Typical password file has multiple lines, where each line is blank, +# a comment (like this one), or a password entry. +# +# +# A password entry consists of a role name and an associated +# password. The role name is any string that does not itself contain +# spaces or tabs. The password is again any string that does not +# contain spaces or tabs. Note that passwords appear in the clear in +# this file, so it is a good idea not to use valuable passwords. +# +# A given role should have at most one entry in this file. If a role +# has no entry, it has no access. +# If multiple entries are found for the same role name, then the last one +# is used. +# +# In a typical installation, this file can be read by anybody on the +# local machine, and possibly by people on other machines. +# For # security, you should either restrict the access to this file, +# or specify another, less accessible file in the management config file +# as described above. +# +# Following are two commented-out entries. The "measureRole" role has +# password "QED". The "controlRole" role has password "R&D". +# +monitorRole change_asap +controlRole change_asap diff --git a/config/alfresco/alfresco-shared.properties b/config/alfresco/alfresco-shared.properties new file mode 100644 index 0000000000..1fb1a0f69b --- /dev/null +++ b/config/alfresco/alfresco-shared.properties @@ -0,0 +1,14 @@ +# +# Properties shared between the Alfresco server +# and its remote clients (e.g.: the virtualization server). +# +# Ports used by Alfresco AVM +# +# Note: These ports are also used by the virtualization server +# (hence, they're in a seperate file that's can be copied easily). + +# MBeanServer registry (protocol: RMI) +avm.jmxrmi.port=50500 + +# AVMRemote API (protocol: RMI) +avm.remote.port=1313 diff --git a/config/alfresco/core-services-context.xml b/config/alfresco/core-services-context.xml index 47e209f688..7eea2f249d 100644 --- a/config/alfresco/core-services-context.xml +++ b/config/alfresco/core-services-context.xml @@ -8,6 +8,11 @@ + + + + + @@ -15,6 +20,7 @@ + classpath:alfresco/alfresco-shared.properties classpath:alfresco/repository.properties classpath:alfresco/version.properties classpath:alfresco/domain/transaction.properties @@ -22,6 +28,52 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/config/alfresco/extension/custom-db-and-data-context.xml.sample b/config/alfresco/extension/custom-db-and-data-context.xml.sample index 3f44bb33a4..b88e5838a7 100644 --- a/config/alfresco/extension/custom-db-and-data-context.xml.sample +++ b/config/alfresco/extension/custom-db-and-data-context.xml.sample @@ -15,6 +15,7 @@ + classpath:alfresco/alfresco-shared.properties classpath:alfresco/repository.properties classpath:alfresco/version.properties classpath:alfresco/domain/transaction.properties @@ -38,4 +39,4 @@ - \ No newline at end of file + diff --git a/config/alfresco/repository.properties b/config/alfresco/repository.properties index af47e22408..a09be156f6 100644 --- a/config/alfresco/repository.properties +++ b/config/alfresco/repository.properties @@ -133,5 +133,3 @@ user.name.caseSensitive=false # AVM Specific properties. avm.remote.idlestream.timeout=30000 -avm.remote.port=1313 - diff --git a/source/java/org/alfresco/util/RuntimeSystemPropertiesSetter.java b/source/java/org/alfresco/util/RuntimeSystemPropertiesSetter.java new file mode 100644 index 0000000000..007936c3c3 --- /dev/null +++ b/source/java/org/alfresco/util/RuntimeSystemPropertiesSetter.java @@ -0,0 +1,67 @@ +/*----------------------------------------------------------------------------- +* Copyright 2006 Alfresco Inc. +* +* Licensed under the Mozilla Public License version 1.1 +* with a permitted attribution clause. You may obtain a +* copy of the License at: +* +* http://www.alfresco.org/legal/license.txt +* +* Unless required by applicable law or agreed to in writing, +* software distributed under the License is distributed on an +* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, +* either express or implied. See the License for the specific +* language governing permissions and limitations under the +* License. +* +* +* Author Jon Cox +* File RuntimeSystemPropertiesSetter.java +*----------------------------------------------------------------------------*/ + +package org.alfresco.util; + +import org.springframework.beans.BeansException; +import org.springframework.beans.factory.config.BeanFactoryPostProcessor; +import org.springframework.beans.factory.config.ConfigurableListableBeanFactory; +import org.springframework.core.Ordered; + + + +/** +* Sets runtime JVM system properties for Spring Framework. +* +* This class is used by the Spring framework to inject system properties into +* the runtime environment (e.g.: alfresco.jmx.dir). The motivation for this +* is that certain values must be set within spring must be computed in advance +* for org.springframework.beans.factory.config.PropertyPlaceholderConfigurer +* to work properly. +* +*/ +public class RuntimeSystemPropertiesSetter + implements BeanFactoryPostProcessor, Ordered +{ + // default: just before PropertyPlaceholderConfigurer + private int order = Integer.MAX_VALUE - 1; + + public void RuntimeSystemPropertiesSetter() { } + + public void postProcessBeanFactory(ConfigurableListableBeanFactory beanFactory) + throws BeansException + { + ClassLoader loader = Thread.currentThread().getContextClassLoader(); + String path=null; + try + { + path = loader.getResource("alfresco/alfresco-jmxrmi.password").toURI().getPath(); + } + catch (java.net.URISyntaxException e ) { e.printStackTrace(); } + + String alfresco_jmx_dir = + path.substring(0,path.lastIndexOf("/alfresco-jmxrmi.password")); + + System.setProperty("alfresco.jmx.dir", alfresco_jmx_dir); + } + public void setOrder(int order) { this.order = order; } + public int getOrder() { return order; } +}