21.7.3. JMX Invoker

To disable authentication for the JMX Invoker, comment out the JNDIFactory, EJBInvokerServlet, and JMXInvokerServlet from the security realm in the $JBOSS_HOME/server/PROFILE/deploy/httpha-invoker.sar/invoker.war/WEB-INF/web.xml file as shown in Example 21.10, “JMX Invoker Authentication Disabled”.

Example 21.10. JMX Invoker Authentication Disabled

<security-constraint>
<web-resource-collection>
<web-resource-name>HttpInvokers</web-resource-name>
<description>
An example security config that only allows users with the role HttpInvoker to access the HTTP invoker servlets
</description>
<!--
<url-pattern>/restricted/*</url-pattern>
<url-pattern>/JNDIFactory/*</url-pattern>
<url-pattern>/EJBInvokerServlet/*</url-pattern>
<url-pattern>/JMXInvokerServlet/*</url-pattern>
-->
  </web-resource-collection>
<auth-constraint>
<role-name>HttpInvoker</role-name>
</auth-constraint>
</security-constraint>