Re: [classlib][auth]LoginContext should always invoke the LoginModules?

2006-10-16 Thread Stepan Mishura
On 10/14/06, Tim Ellison wrote: Stepan Mishura wrote: So we have following suggestions: 1) leave the check and document the difference with RI 2) follow RI and put a warning What warning did you have in mind? And don't say j.u.logging 'cos I can find out where you live you know :-) I

Re: [classlib][auth]LoginContext should always invoke the LoginModules?

2006-10-16 Thread Tim Ellison
Stepan Mishura wrote: On 10/14/06, Tim Ellison wrote: Stepan Mishura wrote: So we have following suggestions: 1) leave the check and document the difference with RI 2) follow RI and put a warning What warning did you have in mind? And don't say j.u.logging 'cos I can find out where

Re: [classlib][auth]LoginContext should always invoke the LoginModules?

2006-10-14 Thread Tim Ellison
Stepan Mishura wrote: So we have following suggestions: 1) leave the check and document the difference with RI 2) follow RI and put a warning What warning did you have in mind? And don't say j.u.logging 'cos I can find out where you live you know :-) Regards, Tim 3) do

Re: [classlib][auth]LoginContext should always invoke the LoginModules?

2006-10-11 Thread Stepan Mishura
So we have following suggestions: 1) leave the check and document the difference with RI 2) follow RI and put a warning 3) do LogingContext.logout() before the second login() 4) introduce a system property to follow RI Should we vote? Thanks, Stepan. On 9/29/06, Paulex Yang wrote: Hi, all

Re: [classlib][auth]LoginContext should always invoke the LoginModules?

2006-10-05 Thread Tim Ellison
Alex Astapchuk wrote: Tim Ellison wrote: Alex Astapchuk wrote: Hi Stepan, all, I think the spec. statement: A LoginContext should not be used to authenticate more than one Subject. was taken too strict: reusing LoginContext object to get the same set of credentials seemed odd. The decision

Re: [classlib][auth]LoginContext should always invoke the LoginModules?

2006-10-04 Thread Alex Astapchuk
Tim Ellison wrote: Alex Astapchuk wrote: Hi Stepan, all, I think the spec. statement: A LoginContext should not be used to authenticate more than one Subject. was taken too strict: reusing LoginContext object to get the same set of credentials seemed odd. The decision was mostly about

Re: [classlib][auth]LoginContext should always invoke the LoginModules?

2006-10-02 Thread Alex Astapchuk
Hi Stepan, all, I think the spec. statement: A LoginContext should not be used to authenticate more than one Subject. was taken too strict: reusing LoginContext object to get the same set of credentials seemed odd. The decision was mostly about resources. Indeed, the spec does not specify

Re: [classlib][auth]LoginContext should always invoke the LoginModules?

2006-10-01 Thread Stepan Mishura
On 9/29/06, Paulex Yang wrote: Hi, all I'm not a security expert, so please correct me if I miss something. I found some different behavior of Harmony and RI on javax.security.auth.login.LoginContext, the testcase[1] shows the difference. Actually I tried to create the event sequence like

Re: [classlib][auth]LoginContext should always invoke the LoginModules?

2006-10-01 Thread Stepan Mishura
On 9/30/06, Paulex Yang wrote: Paulex Yang wrote: Hi, all I'm not a security expert, so please correct me if I miss something. I found some different behavior of Harmony and RI on javax.security.auth.login.LoginContext, the testcase[1] shows the difference. Actually I tried to create

Re: [classlib][auth]LoginContext should always invoke the LoginModules?

2006-09-30 Thread Paulex Yang
Paulex Yang wrote: Hi, all I'm not a security expert, so please correct me if I miss something. I found some different behavior of Harmony and RI on javax.security.auth.login.LoginContext, the testcase[1] shows the difference. Actually I tried to create the event sequence like below: 1.

[classlib][auth]LoginContext should always invoke the LoginModules?

2006-09-29 Thread Paulex Yang
Hi, all I'm not a security expert, so please correct me if I miss something. I found some different behavior of Harmony and RI on javax.security.auth.login.LoginContext, the testcase[1] shows the difference. Actually I tried to create the event sequence like below: 1. create LoginContext