RMI Access Exceptions

[Al Johnston]

Hi,

I've spent the last two days trying to make this work but am not getting anywhere. I am trying to deploy some RMI objects for testing so that we can move forward with other tasks we want to use RMI for. The problem is that I keep getting java.security.AccessControlException: access denied (java.net.SocketPermission [external_ip:1099] connect,resolve) exceptions. Here is what I've done:

Server Object:

   
public class RemoteServerImpl implements RemoteServer{

    public static void main(String[] args) {
        System.setProperty("java.security.policy", "c:\\Program Files\\Java\\" +
                    "jre6\\lib\\ext\\server.policy");
        System.setSecurityManager(new RMISecurityManager());
        
        try {
            RemoteServer server = new RemoteServerImpl();
            Remote stub = (Remote) UnicastRemoteObject.exportObject(server, 0);
            Registry registry = LocateRegistry.getRegistry();
            registry.rebind(name, stub);
            System.out.println("Remote server started and waiting for calls");
        }
        catch(Exception e) {
            e.printStackTrace();
        }
    }
 

We put a policy file on the server to allow all access. The server starts fine but nothing can get through to it.

Here is the client object which is running on another machine. Incidentally, the server is a test server with nothing more than an IP address for addressing:

   
System.setProperty("java.security.policy", "c:\\Program Files\\Java\\jre6\\lib\\ext\\offerplatform.remote.client.policy");
        System.setSecurityManager(new RMISecurityManager());
        
        String[][] offerData = null;
        if(subID == null) {
            subID = "0";
        }
        try {
64            Registry registery = LocateRegistry.getRegistry(hostName);
65           RemoteServer remote = (RemoteServer) Naming.lookup("//" + hostName + "/" +
66                    name);
67            this.ic = remote.getIFrameOffersObject(sessionID, userID, iframeID,
68                    ipAddress, subID);
69            offerData = ic.loadIFrame(sessionID, iframeID, userID,
70                    ipAddress, subID);
        }
 

RemoteServer and RemoteClient are on two different machines. When I run RemoteClient, I get

   
java.security.AccessControlException: access denied (java.net.SocketPermission [external_ip]:1099 connect,resolve)
        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:323)
        at java.security.AccessController.checkPermission(AccessController.java:546)
        at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
        at java.lang.SecurityManager.checkConnect(SecurityManager.java:1034)
        at java.net.Socket.connect(Socket.java:513)
        at java.net.Socket.connect(Socket.java:469)
        at java.net.Socket.<init>(Socket.java:366)
        at java.net.Socket.<init>(Socket.java:179)
        at sun.rmi.transport.proxy.RMIDirectSocketFactory.createSocket(RMIDirectSocketFactory.java:22)
        at sun.rmi.transport.proxy.RMIMasterSocketFactory.createSocket(RMIMasterSocketFactory.java:128)
        at sun.rmi.transport.tcp.TCPEndpoint.newSocket(TCPEndpoint.java:595)
        at sun.rmi.transport.tcp.TCPChannel.createConnection(TCPChannel.java:198)
        at sun.rmi.transport.tcp.TCPChannel.newConnection(TCPChannel.java:184)
        at sun.rmi.server.UnicastRef.newCall(UnicastRef.java:322)
        at sun.rmi.registry.RegistryImpl_Stub.lookup(Unknown Source)
        at java.rmi.Naming.lookup(Naming.java:84)
        at com.cpawins.offerplatform.RemoteClient.getIFrameOffers(RemoteClient.java:65)
        at com.cpawins.offerplatform.RemoteClient.main(RemoteClient.java:37)
Exception in thread "main" java.lang.NullPointerException
        at com.cpawins.offerplatform.RemoteClient.main(RemoteClient.java:38)
Java Result: 1

 

My client policy file looks like this:

   
grant {
  permission java.net.SocketPermission 
  "[external_ip]", "connect,resolve";
};

 

Can someone please help me figure this out? Thanks so much!

Best,
Al

[Edward Harned]

If your client is getting exceptions, then focus on the client.

You should always start with a policy.all file for both the server and client, such as:

  
grant {
    permission java.security.AllPermission "", "";
};
  

Once you get past the security problem, then you can narrow the policy permissions down a bit.

[Al Johnston]

Thanks so much for the help. I tried to set a policy file for my client as policy.all. I have now tested on two different servers. The test server is new so I tried it on the production server hoping that maybe something would go right there that is not happening for me on the test server. On the test server, I was able to get timeout errors. On the production server, I no longer get a connect access error, but I get a resolve access error.

Here are my latest files:

Server Policy File

    
grant codeBase "file:/C:/Progra~1/Java/jre6/lib/ext/myJarFile.jar" {
    permission java.security.AllPermission;   
};

Server Code:

   
public class RemoteServerImpl implements RemoteServer{

private static final String name = "RemoteServer";

        System.setProperty("java.security.policy", "c:\\Program Files\\Java\\" +
                    "jre6\\lib\\ext\\server.policy");
        System.setSecurityManager(new RMISecurityManager());
        
        try {
            RemoteServer server = new RemoteServerImpl();
            RemoteServer stub = (RemoteServer) UnicastRemoteObject.exportObject(server, 8100);
            Registry registry = LocateRegistry.getRegistry();
            registry.rebind(name, stub);
            System.out.println("Remote server started and waiting for calls");
        }

 

I start the server with the following:

  
c:\
cd\
cd C:\Progra~1\Java\jre6\lib\ext
java ... -Djava.rmi.server.codebase=file:/C:/Progra~1/Java/jre6/lib/ext/myJarFile.jar -Djava.rmi.server.hostname=[server_url.com] -Djava.security.policy=server.policy my_qualified_name.RemoteServerImpl
  

That all starts up fine.

Then I go to the client:

Client Policy File:

  
grant codeBase "file:/...myJarFile.jar{
  permission java.security.AllPermission "", "";
};
  

Client Code:

  
public class RemoteClient {

    private String hostName = "server_url.com";
    private String name = "RemoteServer";
     
    public Object getRemoteObject() {
        System.setProperty("java.security.policy", "C:\\...\\offerplatform.remote.client.policy");
        System.setSecurityManager(new RMISecurityManager());
        

        try {
            Registry registery = LocateRegistry.getRegistry(hostName);            
            RemoteServer remote = (RemoteServer) registery.lookup(name);

  

When I run the client, I get:

   
ava.security.AccessControlException: access denied (java.net.SocketPermission server_url.com resolve)
        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:323)
        at java.security.AccessController.checkPermission(AccessController.java:546)
        at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
        at java.lang.SecurityManager.checkConnect(SecurityManager.java:1031)
        at java.net.InetAddress.getAllByName0(InetAddress.java:1128)
        at java.net.InetAddress.getAllByName0(InetAddress.java:1109)
        at java.net.InetAddress.getAllByName(InetAddress.java:1072)
        at java.net.InetAddress.getByName(InetAddress.java:969)
        at java.net.InetSocketAddress.<init>(InetSocketAddress.java:124)
        at java.net.Socket.<init>(Socket.java:179)
        at sun.rmi.transport.proxy.RMIDirectSocketFactory.createSocket(RMIDirectSocketFactory.java:22)
        at sun.rmi.transport.proxy.RMIMasterSocketFactory.createSocket(RMIMasterSocketFactory.java:128)
        at sun.rmi.transport.tcp.TCPEndpoint.newSocket(TCPEndpoint.java:595)
        at sun.rmi.transport.tcp.TCPChannel.createConnection(TCPChannel.java:198)
        at sun.rmi.transport.tcp.TCPChannel.newConnection(TCPChannel.java:184)
        at sun.rmi.server.UnicastRef.newCall(UnicastRef.java:322)
        at sun.rmi.registry.RegistryImpl_Stub.lookup(Unknown Source)

 

The difference being that now instead of a "connect, resolve", I'm just getting a resolve error. Either way, setting my policy to all permissions has not solved my problem. Incidentally, I've tried changing the name of the server from the URL to the actual IP and still have the same problem (although sometimes that gives me a "connect, resolve" error). I also get back the internal address of the server in my error list depending on which server I'm calling. For instance, on the test server, I asked for the resource at 64.68.... and got back a could not connect to 192.168... (the internal address of the server I was calling).

Thanks,
Al

[Al Johnston]

I still have the same problem. I have verified that all ports are open. When I set the server name value with the -Djava flag to our web domain address and set the name of my client as the same and run the client, I am getting a resolve error. When I change both to the IP address of the server, I get a connect resolve error. Has anyone else ever had this issue? Thanks for any help you can give.

Best,
Al

[Al Johnston]

I'm not going to mark this as resolved because it's not. But, I think I've figured out the problem if I can get my network guys to do what they need to do. I changed the client to name = "localHost" and ran it on the same server as the RMI server. I got some errors, but confirmed that it's working. I'll start a new thread for the errors as I think that's a problem with my design that will probably be easier to answer. Thanks to any who read this and pondered it and for the responses I got.

Best,
Al