Read JMX Through an HTTP Proxy Using Jolokia

If a Java deployment already exposes an authorized Jolokia endpoint, a monitoring client can read JMX attributes through an ordinary HTTP forward proxy. The client speaks HTTP to Jolokia, which performs the JMX operation on the application side.

monitor → HTTP proxy → HTTPS Jolokia endpoint → MBean

This route needs an HTTP-capable management endpoint. Pointing an unchanged native JMX client at the web proxy does not create one.

For example, a read of the JVM's heap usage can be expressed as a POST request:

curl --proxy http://proxy.example.net:8080 \
  --header 'Content-Type: application/json' \
  --data '{"type":"read","mbean":"java.lang:type=Memory","attribute":"HeapMemoryUsage","path":"used"}' \
  https://monitor.example.net/jolokia/

The endpoint and proxy are placeholders. This uses a read operation; the HTTP method POST carries Jolokia's JSON request rather than implying a JMX write. Jolokia also supports GET requests for simple operations, while JSON POST avoids some of the URL escaping needed for complex MBean names.

For an HTTPS management endpoint, the forward proxy needs to allow the relevant tunnel destination. TLS should still verify monitor.example.net. The proxy's own hostname and certificate, if the proxy connection itself uses TLS, describe a separate hop.

Keep the two authentication decisions separate. curl's proxy-authentication options supply a proxy account. The endpoint's authentication supplies the management identity, and Jolokia's policy determines which MBeans and operations it can access. Permission to use the forward proxy is not permission to administer the JVM.

The response has two layers as well: HTTP transport status and Jolokia's JSON operation result. Inspect the returned status and value rather than accepting any body as a successful metric. Proxy errors, endpoint authentication failures and missing MBeans require different changes.

If the deployment exposes only a native JMX connector, choose a route compatible with that connector or arrange an approved HTTP management endpoint. An SSH local forward is another transport design, but it remains a connection to the native service; it does not change its protocol into Jolokia's HTTP API.