Hi,
>
> How are the security credentials supposed to be passed from the
> handle to the
> EJB server in a client application like the one below:
>
> public class Foo {
> public static void main(String [] args){
> try {
>
> Handle hndl = ... // deserialize handle from a file
> Account acct = (Account) hndl.getEJBObject( );
> acct.withdraw(20000);
>
> }catch(Exception e){// do something}
> }
> }
>
There are two questions here:
1. How is does a client authenticate (or in other words how
does a client establish the security context)
Ans: JAAS provides a platform independent way of doing that.
EJB specification, does not talk about this per se. But, J2EE
has a concept of Application Clients. Application Client
Container authenticates the client (by popping up a dialog box
etc.) to the J2EE server (in a container specific way).
2. How can you propagate the "credentials" of the authenticated
client to the server.
Ans:
Security Context can be propagated from the client to the server
in a variety of ways: If the client uses IIOP, then ServiceContext
fields of a IIOP message could be used. or Once could send the
SecurityContext object as an additional (possibly hidden) argument.
If you are using SSL (for client authentication) as the
underlying transport for IIOP, the credentials from the client
could be exchanged during the underlying SSL handshake.
> If the withdraw method can only be accessed by a specific role or
> Principle (
> it doesn't accept anonymous clients), how is the client's
> identity passed to
> the server? Where is authentication of the client's identity performed?
>
> After talking with Rickard about this I have learned that JAAS provides an
> implicitly mechanism for performing authentication between a client and a
> remote server. That makes perfect sense, but it implies that the
> credentials
> of the client must be automatically loaded from the client's
> environment or
> that the application in questions must set the credentials before
> executing any
> code that uses JAAS.(The assumption is that the client was not
> connected to the
> server prior to the serializing the handle.)
>
JAAS is a most natural solution to this problem.
> This also implies that the JAAS must be used -- or some similar container
> specific mechanism -- OR that the EJB object has been deployed to accept
> anonymous clients. If none of this is true, executing methods on
> the EJBObject
> or even obtaining the EJB object reference from the handle should fail.
>
Yes. You are right.
Harish Prabandham
J2EE Reference Implementation
Javasoftware Division
Sun Microsystems.
===========================================================================
To unsubscribe, send email to [EMAIL PROTECTED] and include in the body
of the message "signoff EJB-INTEREST". For general help, send email to
[EMAIL PROTECTED] and include in the body of the message "help".
