Hi, Amy.
On May 26, 2011, at 4:02 PM, Amy Roh wrote:
> I sometimes see this message "User [] from host localhost does not
> have administration access" in users' server.log. I'm trying to
> better understand the users' configuration and debug the issues they
> are facing. When do these get logged and what does this actually
> mean?
There are several ways to submit admin commands of one type or another
- asadmin, admin console, REST, JMX, etc. Eventually all of them
share the same authentication logic in common/container-common
GenericAdminAuthenticator. This code decides whether the submitter
of the admin request should be granted access.
The message you quoted comes from this code. It means that the user
"empty string" with whatever password came with the request is not a
valid administrator username and password.
The default admin user/password is "admin"/(empty string)...that is,
username is "admin" and the password is the empty string. If there is
exactly one admin user set up, then if (for example) an asadmin user
omits the username then GlassFish automatically acts as if the user
specified the one admin username that is set up. The password still
has to match, but again in the default case the empty password will
match. This is what allows users to run asadmin commands from the
same host as the DAS without providing the username and password
explicitly.
One reason users see this message is if they have added another admin
user but still try to submit asadmin commands without specifying the
username. The asadmin program will prompt them but they can just
press enter which sends the empty username to the server. But now
there is no default admin account because there are two accounts, and
GlassFish will insist that the user specify which account he or she
wants to log in with.
The server.log will contain exactly the message you reported.
- Tim