JDK17下JBoss EAP 7.4 JMX连接LDAPS认证失败求助

环境信息 #

• 服务器：Linux系统，JBoss EAP 7.4.10.GA，基于OpenJDK 11.0.19（OpenLogic），启用SSL，管理控制台通过LDAPS服务器做安全验证
• 客户端：同机OpenJDK 12连接JMX正常，升级至OpenJDK Runtime Environment Temurin-17.0.8+70后连接失败

异常日志 #

Oct 27, 2023 10:01:31 AM org.xnio.Xnio <clinit>
INFO: XNIO version 3.3.1.Final
Oct 27, 2023 10:01:31 AM org.xnio.nio.NioXnio <clinit>
INFO: XNIO NIO Implementation Version 3.3.1.Final
Oct 27, 2023 10:01:31 AM org.jboss.remoting3.EndpointImpl <clinit>
INFO: JBoss Remoting version 5.0.20.Final
Oct 27, 2023 10:01:31 AM org.jboss.remotingjmx.Util warnDeprecated
WARN: The protocol 'https-remoting-jmx' is deprecated, instead you should use 'remote+https'.
Oct 27, 2023 10:01:31 AM org.jboss.remoting3.remote.RemoteConnection handleException
ERROR: JBREM000200: Remote connection failed: javax.security.sasl.SaslException: Authentication failed: all available authentication mechanisms failed:
javax.security.sasl.SaslException: Authentication failed: all available authentication mechanisms failed:
    at org.jboss.remoting3.remote.ClientConnectionOpenListener.allMechanismsFailed(ClientConnectionOpenListener.java:114)
    at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.handleEvent(ClientConnectionOpenListener.java:453)
    at org.jboss.remoting3.remote.ClientConnectionOpenListener$Capabilities.handleEvent(ClientConnectionOpenListener.java:243)
    at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
    at org.xnio.channels.TranslatingSuspendableChannel.handleReadable(TranslatingSuspendableChannel.java:199)
    at org.xnio.channels.TranslatingSuspendableChannel$1.handleEvent(TranslatingSuspendableChannel.java:113)
    at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
    at org.xnio.ChannelListeners$DelegatingChannelListener.handleEvent(ChannelListeners.java:1092)
    at org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
    at org.xnio.conduits.ReadReadyHandler$ChannelListenerHandler.readReady(ReadReadyHandler.java:66)
    at org.xnio.nio.NioSocketConduit.handleReady(NioSocketConduit.java:88)
    at org.xnio.nio.WorkerThread.run(WorkerThread.java:539)
    at ...asynchronous invocation...(Unknown Source)
    at org.jboss.remoting3.EndpointImpl.doConnect(EndpointImpl.java:272)
    at org.jboss.remoting3.EndpointImpl.doConnect(EndpointImpl.java:253)
    at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:351)
    at org.jboss.remoting3.EndpointImpl.connect(EndpointImpl.java:335)
    at org.jboss.remotingjmx.RemotingConnector.internalRemotingConnect(RemotingConnector.java:239)
    at org.jboss.remotingjmx.RemotingConnector.internalConnect(RemotingConnector.java:158)
    at org.jboss.remotingjmx.RemotingConnector.connect(RemotingConnector.java:105)
    at java.management/javax.management.remote.JMXConnectorFactory.connect(Unknown Source)
    at JavaInstrumentation$1.run(JavaInstrumentation.java:845)
    at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
    at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
    at java.base/java.lang.Thread.run(Unknown Source)

更新信息 #

1. 管理控制台在JDK12和JDK17下均可正常登录，仅JMX客户端在JDK17环境下出现连接失败问题
2. 服务器端JVM参数：

JAVA_OPTS:  -server
-Xlog:gc*:file="/opt/app/logs/eap/gc.log":time,uptimemillis:filecount=5,filesize=3M
-Xms4096m -Xmx4096m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=2048m -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/opt/app/jboss/Dumps/HeapDumps/  --add-exports=java.base/sun.nio.ch=ALL-UNNAMED --add-exports=jdk.unsupported/sun.misc=ALL-UNNAMED --add-exports=jdk.unsupported/sun.reflect=ALL-UNNAMED --add-exports=java.desktop/sun.awt=ALL-UNNAMED --add-exports=java.naming/com.sun.jndi.ldap=ALL-UNNAMED --add-exports=java.naming/com.sun.jndi.url.ldap=ALL-UNNAMED --add-exports=java.naming/com.sun.jndi.url.ldaps=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.lang.reflect=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.security=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.management/javax.management=ALL-UNNAMED --add-opens=java.naming/javax.naming=ALL-UNNAMED

3. 客户端JVM参数：

-Xrs -XX:+SuppressFatalErrorMessage -Xss2m \
-Djavax.xml.soap.SAAJMetaFactory=com.sun.xml.messaging.saaj.soap.SAAJMetaFactoryImpl \
-XX:ErrorFile=/dev/null -XX:HeapDumpPath=/dev/null -XX:-CreateCoredumpOnCrash \
--add-opens=java.management/sun.management=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED \
-Xmx512m -Dsun.net.inetaddr.ttl=900 -Dhttp.keepAlive=false \
-Djdk.http.auth.tunneling.disabledSchemes= -Doracle.jdbc.timezoneAsRegion=false

客户端需添加的配置项 #

1. 开放SASL相关内部API访问权限 #

JDK17模块封装更严格，JBoss Remoting的SASL认证需要访问以下内部API，添加到客户端JVM参数：

--add-exports=java.security.jgss/sun.security.krb5=ALL-UNNAMED \
--add-exports=java.security.sasl/com.sun.security.sasl=ALL-UNNAMED \
--add-opens=java.security.jgss/sun.security.krb5=ALL-UNNAMED \
--add-opens=java.security.sasl/com.sun.security.sasl=ALL-UNNAMED

2. 明确指定SASL认证机制 #

添加JVM参数强制使用兼容的SASL机制：

-Djboss.sasl.mechanism=PLAIN

（注：服务器已启用SSL，PLAIN机制的传输内容会被加密，无需担心明文泄露）

3. 更新JMX连接协议 #

根据日志警告，将旧的https-remoting-jmx协议替换为remote+https，例如连接URL从：

service:jmx:https-remoting-jmx://your-host:your-port

修改为：

service:jmx:remote+https://your-host:your-port

4. 配置SSL信任库（若需要） #

确保客户端信任JBoss EAP的SSL证书以及LDAPS服务器的证书，添加以下参数（替换为实际路径和密码）：

-Djavax.net.ssl.trustStore=/path/to/your/truststore.jks \
-Djavax.net.ssl.trustStorePassword=your-truststore-password

若使用系统默认信任库，需确保相关证书已导入其中。

内容的提问来源于stack exchange，提问作者Ramesh Subramanian