jdk 8332303: Better JMX interoperability with older JDKs, after removing Subject Delegation

Running JConsole from a previous JDK, and attaching to jdk-23 (after JDK-8326666: Remove the Java Management Extension (JMX) Subject Delegation feature), the MBean tab is blank.

In javax/management/remote/rmi/RMIConnectionImpl.java: addNotificationListener rejects a non-null delegationSubjects array, but older JDKs will send such an array. It could accept the array, and only reject/throw if it contains a non-null Subject (i.e. if an attempt to use subject delegation is really happening).

Manually testing JConsole, the MBean tab is fully populated and usable.

Progress

[x] Change must be properly reviewed (1 review required, with at least 1 Reviewer)
[x] Change must not contain extraneous whitespace
[x] Commit message must refer to an issue
[ ] Change requires CSR request JDK-8332371 to be approved

Issues

JDK-8332303: Better JMX interoperability with older JDKs, after removing Subject Delegation (Bug - P3)
JDK-8332371: Better JMX interoperability with older JDKs, after removing Subject Delegation (CSR)

Reviewers

Daniel Fuchs (@dfuch - Reviewer) ⚠️ Review applies to 68c791e7

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/19253/head:pull/19253
$ git checkout pull/19253

Update a local copy of the PR:
$ git checkout pull/19253
$ git pull https://git.openjdk.org/jdk.git pull/19253/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 19253

View PR using the GUI difftool:
$ git pr show -t 19253

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/19253.diff

Webrev

Link to Webrev Comment

May 15 '24 16:05 kevinjwalls

:wave: Welcome back kevinw! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

May 15 '24 17:05 bridgekeeper[bot]

@kevinjwalls This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8332303: Better JMX interoperability with older JDKs, after removing Subject Delegation

Reviewed-by: dfuchs, cjplummer

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 125 new commits pushed to the master branch:

ebc520e83f503eeb4e5af6d5aef62df9227af4f7: 8332841: GenShen: Pull shared members from control thread into common base class
236432dbdb9bab4aece54c2fea08f055e5dbf97e: 8332084: Ensure JdkConsoleImpl.restoreEcho visibility in a shutdown hook
b3b33667ad3bdb7be868fb165a1ea53054947cd0: 8332631: Update nsk.share.jpda.BindServer to don't use finalization
f66a58661459bf64212ec332540c12d5d691270f: 8332641: Update nsk.share.jpda.Jdb to don't use finalization
cd3e4c03661f770ebeefcd3637d56589243ac0a9: 8326734: text-decoration applied to lost when mixed with or
c2cca2ab443ff87f689810b747985adfdbfbe54a: 8330647: Two CDS tests fail with -UseCompressedOops and UseSerialGC/UseParallelGC
6d2aeb82bc6f8b6894bf3777162be0efb2826397: 8332745: Method::is_vanilla_constructor is never used
cfdc64fcb43e3b261dddc6cc6947235a9e76154e: 8331291: java.lang.classfile.Attributes class performs a lot of static initializations
0c934ff4e2fb53a72ad25a080d956745a5649f9b: 8325520: Vector loads and stores with indices and masks incorrectly compiled
c099f14f07260713229cffbe7d23aa8305415a67: 8305457: Implement java.io.IO
... and 115 more: https://git.openjdk.org/jdk/compare/c4867c62c44b48e48845608fe4b29b58749767ad...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

May 15 '24 17:05 openjdk[bot]

@kevinjwalls The following labels will be automatically applied to this pull request:

jmx
serviceability

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing lists. If you would like to change these labels, use the /label pull request command.

May 15 '24 17:05 openjdk[bot]

Webrevs

May 15 '24 17:05 mlbridge[bot]

/csr needed

May 15 '24 17:05 dfuch

@dfuch has indicated that a compatibility and specification (CSR) request is needed for this pull request.

@kevinjwalls please create a CSR request for issue JDK-8332303 with the correct fix version. This pull request cannot be integrated until the CSR request is approved.

May 15 '24 17:05 openjdk[bot]

I'm just trying to understand current and previous behavior of jconsole a bit better. It sounds like jconsole always passes a non-null delegationSubjects, which results in an UOE, and you've changed to code to accept it as long as the entries are all null, resulting in no UOE and jconsole properly displaying the mbean tab. But what I don't understand is why we are seeing this issue with jconsole when it appears it is already passes null for the delegationSubjects argument, even back as far as JDK 8u.

May 15 '24 19:05 plummercj

I'm just trying to understand current and previous behavior of jconsole a bit better.....

Right, to be clear it's not JConsole's fault. The early part of JConsole's stack is:

...connection....
	at java.management.rmi/javax.management.remote.rmi.RMIConnectionImpl_Stub.addNotificationListeners(RMIConnectionImpl_Stub.java:136)
	at java.management.rmi/javax.management.remote.rmi.RMIConnector.addListenersWithSubjects(RMIConnector.java:595)
	at java.management.rmi/javax.management.remote.rmi.RMIConnector.addListenerWithSubject(RMIConnector.java:571)
	at java.management.rmi/javax.management.remote.rmi.RMIConnector$RemoteMBeanServerConnection.addNotificationListener(RMIConnector.java:1238)
	at jdk.jconsole/sun.tools.jconsole.MBeansTab$1.doInBackground(MBeansTab.java:93)
...older frames...

...and when it is running with an older JDK, RMIConnector.addListenerWithSubject() would create a new array of Subjects, containing what it was given (which is null). It passes on the array, and then is going to get the UnsupportedOperationException. i.e. Older client code passing a null Subject, actually "promotes" it to an array and hits the Exception, although it really is not trying to use the removed feature.

This problem is specifically with addListenerWithSubject.

May 15 '24 20:05 kevinjwalls

Ok. So the older version of jconsole does pass the empty delegationSubjects, not null. Is there any way to run jconsole in a way that would result in it passing a non-empty delegationSubjects, resulting in this issue still reproducing?

May 15 '24 21:05 plummercj

...Is there any way to run jconsole in a way that would result in it passing a non-empty delegationSubjects, resulting in this issue still reproducing?

I don't think there is, JConsole has a hard null in this call. Also I don't see in JConsole any calls of getMBeanServerConnection with a Subject being passed, that's the main gateway method to use the removed feature.

If there was a way to use Subject Delegation with JConsole (or with anything else), and you try to attach to a jdk-23, then that will fail with the UnsupportedOperationException and that's what we want as the feature is gone. Realistically it's a feature with no known usage as discussed in the deprecation and removal changes.

May 15 '24 21:05 kevinjwalls

...Is there any way to run jconsole in a way that would result in it passing a non-empty delegationSubjects, resulting in this issue still reproducing?

I don't think there is, JConsole has a hard null in this call. Also I don't see in JConsole any calls of getMBeanServerConnection with a Subject being passed, that's the main gateway method to use the removed feature.

If there was a way to use Subject Delegation with JConsole (or with anything else), and you try to attach to a jdk-23, then that will fail with the UnsupportedOperationException and that's what we want as the feature is gone. Realistically it's a feature with no known usage as discussed in the deprecation and removal changes.

If jconsole is passing null, why is it triggering this exception?

May 15 '24 23:05 plummercj

If jconsole is passing null, why is it triggering this exception?

JConsole passes null, but when running on an older jdk, the older RMIConnector actually "promotes" it to an array before making the remote call. If you connect to a jdk-23 with the removal, the exception is thrown.

(JConsole running on jdk-23 can connect to jdk-23 fine.) (Also just to note, a jdk-23 JConsole can connect to an older JDK and show the MBean tab OK.)

May 16 '24 08:05 kevinjwalls

@kevinjwalls I assume the RN for the removal of the subject delegation feature will need to be adjusted once this current PR is integrated.

May 20 '24 08:05 AlanBateman

@kevinjwalls I assume the RN for the removal of the subject delegation feature will need to be adjusted once this current PR is integrated.

When this fix goes in, there will be a window of builds between jdk 23+18 to jdk-23+build_with_this_fix, where older JMX clients using addNotificationListener() will see an exception. I wasn't going to highlight this in the RN, I thought JDK-8332303 looks quite discoverable already. If the RN is the place to discuss temporary and now-fixed issues with selection of earlier builds before release, I could add something there.

May 20 '24 14:05 kevinjwalls

Thanks Chris, and Daniel, for the reviews!

May 24 '24 19:05 kevinjwalls

/integrate

May 24 '24 19:05 kevinjwalls

Going to push as commit 253508b03a3de4dab00ed7fb57e9f345d8aed1a4. Since your change was applied there have been 125 commits pushed to the master branch:

ebc520e83f503eeb4e5af6d5aef62df9227af4f7: 8332841: GenShen: Pull shared members from control thread into common base class
236432dbdb9bab4aece54c2fea08f055e5dbf97e: 8332084: Ensure JdkConsoleImpl.restoreEcho visibility in a shutdown hook
b3b33667ad3bdb7be868fb165a1ea53054947cd0: 8332631: Update nsk.share.jpda.BindServer to don't use finalization
f66a58661459bf64212ec332540c12d5d691270f: 8332641: Update nsk.share.jpda.Jdb to don't use finalization
cd3e4c03661f770ebeefcd3637d56589243ac0a9: 8326734: text-decoration applied to lost when mixed with or
c2cca2ab443ff87f689810b747985adfdbfbe54a: 8330647: Two CDS tests fail with -UseCompressedOops and UseSerialGC/UseParallelGC
6d2aeb82bc6f8b6894bf3777162be0efb2826397: 8332745: Method::is_vanilla_constructor is never used
cfdc64fcb43e3b261dddc6cc6947235a9e76154e: 8331291: java.lang.classfile.Attributes class performs a lot of static initializations
0c934ff4e2fb53a72ad25a080d956745a5649f9b: 8325520: Vector loads and stores with indices and masks incorrectly compiled
c099f14f07260713229cffbe7d23aa8305415a67: 8305457: Implement java.io.IO
... and 115 more: https://git.openjdk.org/jdk/compare/c4867c62c44b48e48845608fe4b29b58749767ad...master

Your commit was automatically rebased without conflicts.

May 24 '24 19:05 openjdk[bot]

@kevinjwalls Pushed as commit 253508b03a3de4dab00ed7fb57e9f345d8aed1a4.

:bulb: You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

May 24 '24 19:05 openjdk[bot]