GROOVY-12270: Map connector authentication properties onto the keys a…

[paulk-asert]

… connector consumes

JmxBuilder's connectorServer documents properties:[authenticate:true, passwordFile:..., accessFile:...], and wrote them into the connector environment under com.sun.management.jmxremote.* names. Those names belong to the JDK's out-of-the-box management agent, not to a connector server. The agent reads them and translates them into the jmx.remote.x.* names the connector actually consumes, then installs the authenticator itself; see sun.management.jmxremote.ConnectorBootstrap. Nothing performed that translation here, so an operator following the documented syntax started a connector with no authenticator at all.

Verified rather than reasoned: with the environment this class built, the connector reported no authenticator and a credential-less client connected and read the MBean count; with jmx.remote.x.password.file the same client is rejected with "Authentication failed! Credentials required".

Translate the aliases, and only when authentication was requested. Add loginConfig for JAAS, mapping to jmx.remote.x.login.config. Reject authenticate:true with no source of credentials at all, since that asks for authentication and would otherwise start open, which is the failure being fixed; a caller-supplied jmx.remote.authenticator counts as such a source, since passing a JMXAuthenticator through is the standard JSR-160 route for custom authentication.

The com.sun.management.jmxremote.* names remain accepted as input spellings but are no longer copied into the environment, where they mean nothing; the ssl alias is likewise consumed to select the socket factories rather than passed through. Three GROOVY-12119 tests asserted the presence of those inert keys as a witness that the environment map was not discarded; they now assert the effective configuration instead, which is what their comments describe.

Note on urgency rather than severity: no released version has ever passed the property map to the connector, because the building method returned null until GROOVY-12119, which is in no GA release. There is therefore no installed base of connectors that believe they are authenticated. What makes this worth fixing before GA is that GROOVY-12119 leaves SSL working while authentication silently does not, which is a quieter failure than the wholly broken configuration it replaced.

The default remains an unauthenticated connector when no authentication is requested. Warning on that is a separate question from this one.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 87.50000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 70.1623%. Comparing base (5f56279) to head (e4a71b1).
⚠️ Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
...roovy/jmx/builder/JmxServerConnectorFactory.groovy	87.5000%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@                Coverage Diff                 @@
##               master      #2807        +/-   ##
==================================================
+ Coverage     70.1516%   70.1623%   +0.0107%     
- Complexity      35828      35841        +13     
==================================================
  Files            1562       1562                
  Lines          132523     132527         +4     
  Branches        24379      24385         +6     
==================================================
+ Hits            92967      92984        +17     
+ Misses          31140      31133         -7     
+ Partials         8416       8410         -6     

Files with missing lines	Coverage Δ
...roovy/jmx/builder/JmxServerConnectorFactory.groovy	59.2593% <87.5000%> (+3.2593%)	⬆️

... and 7 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[testlens-app]

✅ All tests passed ✅

🏷️ Commit: e4a71b1
▶️ Tests: 109823 executed
⚪️ Checks: 31/31 completed

---

Learn more about TestLens at testlens.app.

[Copilot]

Pull request overview

This PR fixes groovy-jmx’s JmxServerConnectorFactory so that authentication-related properties provided via JmxBuilder.connectorServer(properties: ...) are translated onto the JMX connector server keys that are actually consumed (jmx.remote.x.*), rather than being copied into the environment under the JDK management agent’s unrelated com.sun.management.jmxremote.* names (which a connector server ignores). It also tightens behavior to avoid silently starting an open connector when authentication was explicitly requested.

Changes:

• Translate authenticate/passwordFile/accessFile/loginConfig aliases into jmx.remote.x.* keys only when authentication is requested, and stop copying inert com.sun.management.jmxremote.* keys into the connector environment.
• Reject authenticate:true when no credential source is provided (password file, login config, or authenticator).
• Update/add tests to assert the effective connector configuration (including an end-to-end authentication check).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
subprojects/groovy-jmx/src/main/groovy/groovy/jmx/builder/JmxServerConnectorFactory.groovy	Translates authentication property aliases to jmx.remote.x.*, enforces presence of a credential source when authenticate:true, and stops copying management-agent-only keys into the connector environment.
subprojects/groovy-jmx/src/test/groovy/groovy/jmx/builder/JmxServerConnectorFactoryTest.groovy	Adds/updates unit and end-to-end tests validating the new mapping behavior and authentication enforcement.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.