保护JBoss上远程客户端的JNDI

Question

Does anybody know how to secure the JNDI access for remote clients on JBoss? I know how to secure remote JMX invokers but even with that in effect it is still possile to lookup, bind and unbind things in JNDI even if the client is not authenticated.

I would like that that the server refuses to give you access to the InitialContext if you are not authenticated and to make it read only for some clients. Is this possible?

I am using JBoss 5.1.0 GA with jdk6

Answer 1

The instructions on how to do this are in the JBoss Wiki . It is not perfect, but it works. Even if the article only mentions versions 3 and 4 of JBoss it still works with 5.1.0 GA.