Password echo of appclient in GlassFish?

Wednesday Mar 14, 2007

In SJSAS 8.x, 9.0 and GlassFish v1, when one tries to access a password protected EJB or Web Service through appclient, it will prompt user name and password if this is not specified in command line or programmatically. By default the prompt will be a GUI dialog box. In remote environment, it may be desirable to have the prompt in text mode. One can achieve this through appclient as follows:

  appclient -client <location of the client jar> -textauth

And username and password will be prompted and user's response will be as follows:

  Enter Username:javaee
  Enter Password:javaee

Note that the password is echoed in the console. This is highly undesirable from security point of view.

In GlassFish v2 with JDK 6 environment, the password is no longer echoed in text password prompt. One can switch the JDK of GlassFish server by editing the AS_JAVA in config/asenv.conf for non-Windows systems and config/asenv.bat for Windows systems. If one reruns the above appclient command, then one will have

  Enter Username:javaee
  Enter Password:

Note that the password is no longer echoed in the console.

One may ask whether one can achieve this without modifying the JDK in whole installation. In GlassFish, one can package the appclient and install it in somewhere else. The command is as follows:

  $GLASSFISH_HOME/bin/package-appclient

This will generate a appclient.jar . Then one can copy this to the desired location and unjar the content. After that, one may need to update the following inside the unjar directories:

• change appclient script to execution mode if necessary. The command in unix is: chmod u+x appclient.
• update the content of asenv.conf or asenv.bat, sun-acc.xml, appclient as described in SJSAS package-appclient doc. For instance, if one want to use webservice in client, then one need to update AS_WEBSERVICE_LIB. In our case, one need to update AS_JAVA to point to a JDK 6 installation.

In this case, the GlassFish installation will still use the same JDK as before. Only the JDK of the new appclient has been updated.