/*
 * $Id: ConnectorServerAgent.java,v 1.2 2007/07/22 21:19:06 blaine Exp $
 *
 * JMX Accelerated Howto and its sample code are copyrighted with the
 * BSD license available in the Howto document.
 * Copyright (c) 2004-2007, Axis Data Management Corp
 */


import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import javax.management.MBeanServerFactory;
import javax.management.MBeanServer;
import javax.management.ObjectName;
import javax.management.remote.JMXConnectorServerFactory;
import javax.management.remote.JMXServiceURL;
import javax.management.JMException;
import java.util.HashMap;
import java.util.Map;
import javax.management.ReflectionException;
import java.io.File;

/**
 * Sample Agent that runs a JMXConnectorServer using the specified URL.
 *
 * Subclass and override method loadBeans() to intialize with your own
 * MBeans (or none); and override isRequireClientAuth() if you want to
 * run with TLS but without Client certs.
 *
 * It's useful for debugging (and learning) to be able to run this program
 * in the foreground.  If you don't ever want it to run in the foreground,
 * then override serve() to run this.serve() in a Thread (or similar).
 */
public class ConnectorServerAgent {
    private boolean tlsMode = false;
    private String urlString = null;
    private Map env = new HashMap();

    static public void main(String[] sa)
            throws IOException, JMException {
        boolean tlsMode = false;
        String urlString = null;

        /* Command-line argument parsing */
        if (sa.length == 2 && sa[0].equals("--tls")) {
            tlsMode = true;
            urlString = sa[1];
        } else if (sa.length == 1) {
            urlString = sa[0];
        }
        if (urlString == null) {
            System.err.println(
                "SYNTAX:  java [--tls] ConnectorServerAgent JMXServiceURL\n"
                + "JMXServiceURL examples:\n    "
                + "service:jmx:rmi:///jndi/rmi://localhost:9999/jndi_id\n"
                + "    service:jmx:jmxmp://0.0.0.0:9999\n"
                + "(A JMXMP impl. required in classpath for jmxmp service.\n"
                + "Try Sun's free jmxremote_optional.jar).\n"
                + "(RMI URLs require an RMI registry to be running at the "
                + "specified address/port).");
            System.exit(2);
        }
        new ConnectorServerAgent(urlString, tlsMode).serve();
    }

    protected ConnectorServerAgent(String urlString, boolean tlsMode) {
        this.urlString = urlString;
        this.tlsMode = tlsMode;
    }

    /**
     * Override this class to load your own Beans upon startup, or override
     * with a no-op method to load no beans upon startup (in which case
     * clients will need to add Beans).
     */
    protected void loadBeans(MBeanServer beanServer) throws JMException {
        try {
            beanServer.createMBean("tst.SampleStd", new ObjectName("a:b=c"));
        } catch (ReflectionException re) {
            throw new JMException(
            "The sample MBean class 'tst.SampleStd' is not in your classpath.\n"
                + "Either fix your classpath, or subclass "
                + getClass().getName() + '.');
        }
    }

    /**
     * Initializes the Agent and runs the JMXServerConnector.
     */
    protected void serve() throws JMException, IOException {
        if (tlsMode) setupTls();
        
        MBeanServer mBeanServer = MBeanServerFactory.createMBeanServer();
        loadBeans(mBeanServer);

        (JMXConnectorServerFactory.newJMXConnectorServer(
            new JMXServiceURL(urlString), env, mBeanServer)).start();

        System.out.println(
                "If you're running this server in the foreground, you "
                + "can stop it with Ctrl-C.");
    }

    /**
     * TLS Mode setup.
     */
    protected void setupTls() {
        // Note that the settings below are conditional, so you can
        // override then with "java -Djavax...=Y... ConnectorServerAgent..."
        // It's definitely not safe to use -D to set passwords, though,
        // but it's useful for prototyping.
        if (System.getProperty("javax.net.ssl.trustStore") == null)
            System.setProperty("javax.net.ssl.trustStore",
                    "client1-cert.store");
        if (System.getProperty("javax.net.ssl.keyStorePassword") == null)
            System.setProperty("javax.net.ssl.keyStorePassword",
                    "pwdSstore");
        if (System.getProperty("javax.net.ssl.keyStore") == null)
            System.setProperty("javax.net.ssl.keyStore", "server.store");

        /* The method above is the simplest (IMO therefore the best)
         * method if your application doesn't use certs for any other
         * purpose.  You should use the instance-based TLS configuration
         * method if your app uses certs for any other purpose
         * (i.e., it could fetch web pages over https, or be a TLS
         * Soap client, etc., or it could run multiple TLS
         * JMXConnectorServers).
         *
         * The instance-based method allocates a SSLSocketFactory
         * based on the SSLContext instance which you instantiate and
         * configure, so you can configure multiple SSLSocketFactories
         * with different SSLContext instances.  This all applies to
         * any standard JSSE TLS application, but for JMX, you 
         * associate the allocated SSLSocketFactory to the Connector
         * with:
         * 
         *  env.put("jmx.remote.tls.socket.factory", yourFactory);
         */

        env.put("jmx.remote.profiles", "TLS");
        //env.put("jmx.remote.tls.enabled.protocols", "TLSv1");
        //env.put("jmx.remote.tls.enabled.cipher.suites",
            //"SSL_RSA_WITH_NULL_MD5");
        // Most users will probably want to use the default TLS 
        // protocols and suites.
        env.put("jmx.remote.tls.need.client.authentication",
                Boolean.toString(isRequireClientAuth()));
        // Comment out the line above if you don't want to require
        // clients to have their own certs.

        if ((new File("access.properties")).isFile())
            env.put("jmx.remote.x.access.file", "access.properties");
        // IF file "access.properties" is present in $PWD (from where server
        // is started), it must have keys of permitted client cert subjects,
        // and values of "readwrite" or "readonly".
        // N.b. You MUST ESCAPE all spaces, colons, and equal signes in the
        // subject with backslashes!
        // Example record:
        // CN\=proto\ client\ 1,OU\=RND,O\=Fake\ Corp.,C\=US  readwrite
    }

    /**
     * Only used if running with TLS mode.
     *
     * If you want to run TLS mode without Client certs, just override
     * this class and override this method to return false.
     *
     * @returns true  (unless this method is overridden).
     */
    protected boolean isRequireClientAuth() {
        return true;
    }
}