I still have a bit of a learning curve on the JAAS
stuff, perhaps I should sit down with the spec and
the jBoss code. So, it is definately difficult for
me to see a viable soultion for using JAAS.
Heres what I'm trying to do:
I would like to have a servlet/jsp with a form.
This form will allow users to authenticate.
There will be a macro role of client.
Then there will be sub roles underneath each client.
It is extremely important that if one client logins in as
superuser that a test user at another client doesn't
obtain full access to the other client's data or the myriad of other
security
violations that seem possible due to these static
variables. So I was thinking that maybe you could rewrite
the module on the client side so that it didn't use
static variables.
Before I delved very deep into JAAS I was thinking that
we would be able to cache login in the middle tier.
Say in a stateful sessino bean. The web layer could cache
the handle to the bean in a session cookie or similar.
Then Whenever the servlet/jsp could obtain login info from
the bean and fire off a loginContext.login(). Now that I've
found that the user/password hangs around with the VM. I
am not sure what I could do. I've seen some posts concerning
1) SecurityAssociation.setServer()
2) create different LoginContexts SEQUENTIALLY or just call
SecurityAssociation.setPrincipal and SecurityAssociation.setCredential
But I can't find code examples nor did the posts mention how exactly
to implement such a work around or the outcome of such a work around.
-----Original Message-----
From: Oleg Nitz [mailto:[EMAIL PROTECTED]]
Sent: Tuesday, January 23, 2001 1:09 PM
To: Ferguson, Doug
Subject: Re: [jBoss-User] jaas
On Tuesday 23 January 2001 03:13, Ferguson, Doug wrote:
> Would it be possile to overload the loginModule on the client side
> to make this behave differently?
No, I don't think it's possible.
Why do you want this?
What behavior do you want to get?
Oleg
> -----Original Message-----
> From: Oleg Nitz
> To: dferugson
> Sent: 1/22/01 5:01 PM
> Subject: Re: [jBoss-User] jaas
>
> On Tuesday 23 January 2001 00:56, dferugson wrote:
> > Oleg Nitz wrote:
> > > On Monday 22 January 2001 23:55, dferugson wrote:
> > > > When you use the LoginContext to login on the client side,
> > > > it logs you in, but for how long? Until the life of the
> > > > method, as long as the LoginContext has scope?
> > >
> > > Until the exit of the client VM.
> > > The user name and password are stored in SecurityAssociation
> > > static variables.
> >
> > Static Variables! So, if I have a servlet that controls access to
> > a particular
> > method and an admin logs in then all subsequent users will have
> > admin access?
>
> Yes, unless you call SecurityAssociation.setServer(), which turns
> on ThreadLocal mechanism. In other words, each thread has its own
> values of the static variables. AFAIK in this way Tomcat security
> integration was done by Dan O'Connor. Again, I don't know details.
>
> Oleg
--
--------------------------------------------------------------
To subscribe: [EMAIL PROTECTED]
To unsubscribe: [EMAIL PROTECTED]
List Help?: [EMAIL PROTECTED]
