Oracle11g的JDBC驅動遭遇WARNING: Error while registering Oracle JDBC Diagnosability MBean.

今天白珏的信雅達影像系統遷移到11g數據庫時，他們有個應用啓動初始化JDBC數據源時總是出現下面的錯誤：

Oct 17, 2012 4:46:45 PM oracle.jdbc.driver.OracleDriver registerMBeans

WARNING: Error while registering Oracle JDBC Diagnosability MBean.

java.security.AccessControlException: Access denied (javax.management.MBeanTrustPermission register)

        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:157)

        at java.lang.SecurityManager.checkPermission(SecurityManager.java:594)

        at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.checkMBeanTrustPermission(DefaultMBeanServerInterceptor.java:1742)

        at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.registerMBean(DefaultMBeanServerInterceptor.java:353)

        at com.sun.jmx.mbeanserver.JmxMBeanServer.registerMBean(JmxMBeanServer.java:515)

        at oracle.jdbc.driver.OracleDriver.registerMBeans(OracleDriver.java:360)

        at oracle.jdbc.driver.OracleDriver$1.run(OracleDriver.java:199)

        at java.security.AccessController.doPrivileged(AccessController.java:197)

        at oracle.jdbc.driver.OracleDriver.<clinit>(OracleDriver.java:195)

        at java.lang.J9VMInternals.initializeImpl(Native Method)

        at java.lang.J9VMInternals.initialize(J9VMInternals.java:196)

        at java.lang.Class.forNameImpl(Native Method)

        at java.lang.Class.forName(Class.java:130)

        at org.apache.commons.dbcp.BasicDataSource.createDataSource(BasicDataSource.java:1130)

        at org.apache.commons.dbcp.BasicDataSource.getConnection(BasicDataSource.java:880)

        at I.C.getConnection(XUBL)

        at com.sunyard.sunflow.db.pool.ConnectionManager.getConnection(XUBL)

        at com.sunyard.sunflow.db.pool.ConnectionManager.init(XUBL)

        at com.sunyard.sunflow.SunflowEngine.XUBL(XUBL)

        at com.sunyard.sunflow.SunflowEngine.main(XUBL)

        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:79)

        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

        at java.lang.reflect.Method.invoke(Method.java:618)

        at com.sunyard.sunflow.tool.EngineStartor.main(EngineStartor.java:114)

之前用他們使用的jdbc driver的版本是ojdbc4.jar，現在換成11g的數據庫後相應的把jdbc driver換成ojdbc5.jar，但是使用新的驅動程序總是會出現上面的問題，只要換回老的驅動就一切OK。

重點關注一下錯誤信息中的Access denied字眼，說明這應該是新版jdbc驅動中的某種訪問策略拒絕的問題。在MOS找到一篇與之相同的文章，果然需要修改java的策略文件$JAVA_HOME/jre/lib/security/java.policy，照着文檔在java.policy文件中添加如下內容後再次啓動就OK了：

// JMX Java Management eXtensions

permission javax.management.MBeanTrustPermission"register";

 

		" Error while registering Oracle JDBC Diagnosability MBean. java.security.AccessControlException: access denied (javax.management.MBeanTrustPermission register) " When Using JDBC Driver 11g [ID 1229803.1]	轉到底部

---

修改時間: 2012-4-30 類型: PROBLEM 狀態:MODERATED 優先級:3

註釋 (0)

In thisDocument

Symptoms

 

Changes

 

Cause

 

Solution

---

This document is being delivered to youvia Oracle Support's Rapid Visibility (RaV) process and therefore has not beensubject to an independent technical review.

Appliesto:

JDBC - Version 11.1.0.7 and later
Information in this document applies to any platform.
***Checked for relevance on 30-Apr-2012*** 

Symptoms

When running a job from Weblogic application, the followingmessage is displayed:


Sep 21, 2010 11:46:35 AM oracle.jdbc.driver.OracleDriver registerMBeans
WARNING: Error while registering Oracle JDBCDiagnosability MBean.
java.security.AccessControlException: accessdenied (javax.management.MBeanTrustPermission register)


The issue does not occur with JDBC 10.2.0.2; occurs with JDBC 11.1.0.7 and 11.2.0.1.

Changes

JDBC driver was upgraded from 10.2.0.2 to 11.1.0.7
JDK was upgraded to 1.6 from 1.5.

Cause

This issue is caused by missing permissionjavax.management.MBeanTrustPermission "register".

In 11g the driver registers an MBean. It did not in 10g.
The driver registers the MBean using the standard Java APIs. Those APIs requirethe permission. In order to run correctly the driver code base requires thispermission. Without the permission the driver does not run correctly.

Solution

Include the permissionjavax.management.MBeanTrustPermission "register" in the securitypolicy file /opt/apps/java/jdk160_20/jre/lib/security/java.policy:

grant {
// JMX Java Management eXtensions
permissionjavax.management.MBeanTrustPermission "register";
};

In order to run correctly the driver code base requires this permission. 

If the JRE is shared by different applications, and you only require it for aparticular application, specify an additional policy file when invokingexecution of this application. 
This can be done via the "-Djava.security.policy" command lineargument, which sets the value of the java.security.policy property. Forexample, if you use


-Djava.security.policy=someURL

for some application, where someURL is a URL specifying the location of apolicy file, then the specified policy file will be loaded in addition to allthe policy files that are specified in the security properties file.

If you use: 


-Djava.security.policy==someURL

(note the double equals) then just the specified policy file will be used; allthe ones indicated in the security properties file will be ignored.

More information on this can be found at:
http://download.oracle.com/javase/6/docs/technotes/guides/security/PolicyFiles.html
Section: Specifying an Additional Policy File at Runtime.