Re: demo site
Blaine Simpson <[email protected]>
| Newsgroups | gmane.comp.java.mx4j.devel |
|---|---|
| Message-ID | <[email protected]> |
Bordet, Simone wrote: > Hi, > > [snip] > > JSR 160 connector server can run under a security manager, and the specification allows you to fine-tune the security. > You can, for example, write a HTML front end that uses JSR 160 rmi connector that connects to a security-manager running connector server. > > As far as I can see this is the only way to allow anyone to perform actions on the server, but restrict the server to certains operations only. > > For example, you can specify that the connector server can only register MBean of classes com.simpson.* and you can show a bunch of them in the gui. > > Running under a security manager means that any sensitive operation can be restricted: opening sockets, reading files, creating classloaders, and so on. > > I think the architecture can be: > > JVM 1 > The web container and the JSR 160 client > No security manager > web.xml configured to restrict access to resources, or to force login. Requiring a login defeats the purpose of a demo site serving the public at large. Perhaps you mean login for privileged functions like administration? For the primary function, manipulating MBeans, I can't think of how we could do any meaningful restrictions in web.xml, since our purpose is for anonymous users to be able to use these functions according to the restrictions imposed by Jmx server running in JVM 2. Maybe I'm missing something? > JVM 2 > JSR 160 connector server > Running under security manager > security file restrict operations as needed. This is where we would restrict to a set of classes and other resources, correct? (As I said above, I think that this provides all the protection needed. If Jmx client-side restrictions also needed, please explain why). > browser --> web server | jsr160 client --> jsr160 server > > Explanation of how to set it up is here (I know, it can be improved ;) > http://mx4j.sourceforge.net/docs/ch03s09.html > > I'll be glad to help you in the process. > > What do you think ? > > Thanks ! > > Simon -- ICF: 703-934-3692 Cell: 703-944-9317 ------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click