>From the j2ee component level there is only Container and Application >security. The problem is then really how we are creating the Subject when >there is no inherent Subject. Today this requires an unauthenticatedIdentity >setting on the associated security domain login module configuration, and >there is no way to override this using the application supplied security >context. The jca login modules could certainly support the notion of accepting >the CRI security information in preference to the statically defined anonymous >user identity. Nothing I read in the j2ee_connector-1_5-fr-spec in section >9.1.8.1 Contract for the Application Server, indicates this cannot be done as >there is the carte blanche 'implementation-specific security mechanisms and >configuration' phrase in the beginning:
anonymous wrote : | 9.1.8.1 Contract for the Application Server | | The application server may provide specific security services, such as principal mapping and delegation, and single sign-on, before using the security contract with the resource adapter. For example, the application server can map the caller principal to a resource principal before calling the createManagedConnection method to create a new connection under the security context of the resource principal. | | In container-managed sign-on, the application server is responsible for creating a Subject instance using its implementation-specific security mechanisms and configuration. This should happen before the application server calls the createManagedConnection method of the ManagedConnectionFactory. The resource adapter is driven by the application server and acts as consumer of security information in the created Subject. | I have a testcase scenario where I'm testing the different jca login module interaction with other j2ee components security contexts, and I need to access the database as an admin user to create the user with reduced permissions to validate in the context of the j2ee usage. Do you see a reason why the anonymous identity/proof of identity should not be from the request context? View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=3866245#3866245 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=3866245 ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ JBoss-Development mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/jboss-development
