If anyone working on the security portion of J2 needs any help, I'm more than willing. I've used JAAS on past projects to authenticate and authorized users of our application to an Active Directory. JAAS is nice in that you implement a container interface, in our case it was the CustomRegistry from Websphere, and then configure the app server itself to bind to your LDAP (or any other) authentication server. Then in your web.xml, you would define roles and resource locking according to those roles. Finally at the level of the enterprise application resource (EAR), you assign users or groups in LDAP (again doesn't have to be LDAP) to those roles you defined in your web.xml.

That's a brief jist of process we took. I left out some parts because there is a bit more details, but I have to head to work. If anyone has specific questions, please send me an email.

James Nguyen
I/T Professional
IBM Global Services

At 07:50 AM 8/1/2003 -0700, Saddest OfAllKeys wrote:

There are two aspects to JAAS: authentication and
authorization.  The first addresses the question "who
are you?"; the second addresses "what are you allowed
to do?".

The tutorial at Sun is excellent, but I'm not familiar
enough with it to comment re: applicability to J2.

Mike


--- Ender_Hikmet_KILIÇOĞLU <[EMAIL PROTECTED]> wrote: > Jaas maybe usefull for authentication but security > concept need other logic > to implement like portlet security. I thing security > and authentication are > different concepts. > Also I am not a JASS guru :) > Ender > > > -----Özgün Ileti----- > Kimden: Weaver, Scott [mailto:[EMAIL PROTECTED] > Tarih: Friday, August 01, 2003 5:34 PM > Kime: 'Jetspeed Developers List' > Konu: RE: thanks for jetspeed-2 cvs and some > comments > > > > > > -----Original Message----- > > From: Massimiliano Dessi > [mailto:[EMAIL PROTECTED] > > Sent: Friday, August 01, 2003 10:15 AM > > To: Jetspeed Developers List > > Subject: Re: thanks for jetspeed-2 cvs and some > comments > > > > > Hi > > > After a short review I have a few question. > Maybe I didnot clearly > > > understood some point. > > > > > > So Theree is no security layer design for now. > > > > Jaas ? > > > > We were considering this, have you ever implemented > JAAS? It appears that > there is java environment information that needs to > be altered to use JAAS, > which seems a bit outside what we really need to do. > I could be wrong as I > know very little about JAAS. If you are willing > help work on a JAAS > implementation for Jetspeed 2 we would be more than > willing to take a look > at it again. > > > Compliments to commiters for the mockobjects and > the class test. > > Thanks, we are trying ;) > > > Anglonaweb it's built with a classtest for all > classes (eXtreme > > Programming > > school ;-) ) > > and the result it's a code more robust. > > It's a more important that the deveoper of a class > write its test class > > (before to the class), > > if a test it's write by another person the test > can not test the really > > work > > of a class. > > > > I suggest use of cruise control to operate a > continuous integration , with > > a > > ant script > > the build and the test are launch and a page with > a result of build > > (success > > or failed) and > > the result of the test are show. > > In this way a developer can test immediately if a > new integration break a > > build of the entire project. > > > > Maven automatically runs all unit tests and > generates test reports in both > text and XML format. I don't know much about cruise > control and I feel that > most of the developers will agree with we when I say > we really don't want > learn yet another build tool, at least not right > now. Heck, I barely know > Maven ;) > > > Sorry fo my bad english. > > > > Massimiliano Dessì > > > > > > > > > --------------------------------------------------------------------- > > To unsubscribe, e-mail: > [EMAIL PROTECTED] > > For additional commands, e-mail: > [EMAIL PROTECTED] > > > > > *===================================* > * Scott T Weaver * > * Jakarta Jetspeed Portal Project * > * [EMAIL PROTECTED] * > *===================================* > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: > [EMAIL PROTECTED] > For additional commands, e-mail: > [EMAIL PROTECTED] >


__________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com

---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]


James Nguyen
I/T Professional
600 Anton Boulevard - Suite 360
Costa Mesa, California 92626

"Cogito ergo sum"
        -Rene Descartes



---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Reply via email to