Authentication and Authorization need to be two seperate security interceptors. Authentication needs to validate the principal and associate the Subject with the MethodInvocation. The Authorization interceptor will handle role based permissions and run-as identities. The default MDB interceptor chain should not include an Authentication interceptor. If the jboss.xml metadata is enchanced to allow for caller identity to be obtained from the JMS msg than the container invoker will associate this information with the call and the Authentication interceptor can be added to the interceptor chain.
xxxxxxxxxxxxxxxxxxxxxxxx Scott Stark Chief Technology Officer JBoss Group, LLC xxxxxxxxxxxxxxxxxxxxxxxx ----- Original Message ----- From: "Dave Smith" <[EMAIL PROTECTED]> To: "Scott M Stark" <[EMAIL PROTECTED]> Cc: <[EMAIL PROTECTED]> Sent: Thursday, January 31, 2002 8:56 AM Subject: Re: [JBoss-dev] JAAS with MDB > So then in JMSContainerInvoker add the code to read the jboss metadata > and then invoke the inteceptor chain with the appropreate princpal and > credidentals? Or should the JMS message actually set properties in the > message itself and a new Security Invoker to read this info and set the > principal and credidents. I have some time today and tomorrow to take a > crack at it. > > > Scott M Stark wrote: > > > Which is what I mean by MDBs needing a different SecurityInterceptor. > > > > xxxxxxxxxxxxxxxxxxxxxxxx > > Scott Stark > > Chief Technology Officer > > JBoss Group, LLC > > xxxxxxxxxxxxxxxxxxxxxxxx > > ----- Original Message ----- > > From: "Dave Smith" <[EMAIL PROTECTED]> > > To: "Scott M Stark" <[EMAIL PROTECTED]> > > Cc: <[EMAIL PROTECTED]> > > Sent: Thursday, January 31, 2002 7:47 AM > > Subject: Re: [JBoss-dev] JAAS with MDB > > > > > > > >>It actually goes a little furthur than that. I first tried to take out > >>the security interceptor in the MDB interceptior chain. This works fine > >>util your message bean then tries to call another EJB. So it would seem > >>that the Security Interceptor needs to just act as a login for the MDB. > >> > >>Scott M Stark wrote: > >> > >> > >>>MDBs need a different SecurityInterceptor that does not attempt > >>>to authenticate the caller as there is none defined. An extension > >>>would allow the caller to be obtained from JMS message properties. > >>>The properties could be specified in the jboss.xml descriptor in > >>>the message-driven bean section. > >>> > >>> > > > > > > > > _______________________________________________ > > Jboss-development mailing list > > [EMAIL PROTECTED] > > https://lists.sourceforge.net/lists/listinfo/jboss-development > > > > > > > > _______________________________________________ > Jboss-development mailing list > [EMAIL PROTECTED] > https://lists.sourceforge.net/lists/listinfo/jboss-development > _______________________________________________ Jboss-development mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-development
