Hi:
I think from the general discussion, my original point is not clear to
all of you.
Let me clarify...
(1) I know how to make it work, even using the MBean in JBoss for my
"client" -- but it's not at all portable to other app servers. The
point, however, is that I would like the "EJB" model to support this
kind of operation so that my application could be portable.
But the need to run things periodically or on a scheduled basis,
asynchronous from user interaction, seems like a fairly generic
requirement. Wouldn't it be nice if the EJB model supported this in a
portable way?
(2) Security model -- Edward went into some detail explaining the
"roles"-based security model in EJB. I understand the "roles" concept.
However, that doesn't do the trick for me.
As Scott hinted, my problem is users have access only to certain pieces
of information.
For example, my users can "subscribe" to search results. They define
search criteria and a time of day when they want to receive search
results. At that time of day, the system executes the search and emails
the result to them.
Now, not all users can access all information. So when the search
criteria says "find all messages using the words 'JBoss rocks' ", the
search results depend on who the caller is. If the caller has access to
all categories of messages, they may get more results than a caller who
can access a subset.
So I need to run the search as the user who owns the "search
subscription". This is why my application must change who the user is
to call the search engine.
I could change the "search" bean to receive the userID as an argument --
but then I've broken my security, because any client application can
call it with somebody else's userID.
Obviously I can build non-portable "work arounds" to get my job done.
(In fact, I'm doing it and it works just fine.)
It seems to me, however, the need to do this sort of thing is pretty
generic. It happens routinely in the OS world -- daemons or services
which "setUID" to run an activity. Why not strengthen the EJB model to
support it also, so such applications can be portable?
- Keith
-----Original Message-----
From: Rickard �berg <[EMAIL PROTECTED]>
To: jBoss <[EMAIL PROTECTED]>
Date: Friday, December 15, 2000 6:19 AM
Subject: Re: [jBoss-User] enhancing the EJB model
>Hi!
>
>"Kenworthy, Edward" wrote:
>> >"Kenworthy, Edward" wrote:
>> .>> >The only way I know how to do this now is to have a client which
calls
>> >> >the bean's method periodically. I can do this from outside of
JBoss, or
>> > >(cheating) by starting a thread from the bean's class when the
first
>> >>
>> >> You can't do this. Manipulating threads in EJB-land is
specifically
>> >> forbidden.
>>
>> > Note that servers are allowed to grant beans more permissions than
are
>> > stated in the spec (i.e. granting AllPermission is ok).
>>
>> Is this portable ?
>
>Depends on what you mean. You need to find a server that allow you to
>add the permission you need, but today all servers do.
>
>> >Judging from EJB-INTEREST postings from other vendors JBoss is more
or
>> >less the *only* server that will check for it...
>> >
>>
>> Actually WLS does, although I can't remember off the top of my head
whether
>> it does it at deploy or run-time (the former I think).
>
>You can't check this at deployment time... only runtime counts.
>
>> >Use an MBean to do this, as stated in other reply.
>>
>> Not portable :-)
>
>What do you mean? JMX MBeans are very portable.
>
>/Rickard
>
>--
>Rickard �berg
>
>Email: [EMAIL PROTECTED]
>
>
>--
>--------------------------------------------------------------
>To subscribe: [EMAIL PROTECTED]
>To unsubscribe: [EMAIL PROTECTED]
>Problems?: [EMAIL PROTECTED]
--
--------------------------------------------------------------
To subscribe: [EMAIL PROTECTED]
To unsubscribe: [EMAIL PROTECTED]
Problems?: [EMAIL PROTECTED]
