Re: mx4j-Bugs-969175: Security and delegation

 > Bordet, Simone wrote:
 >
 > AFAIK, the JDK ships only the SASL API (no SASL providers), and last time I
 > checked the cryptix provider, it was full of bugs, even for plain
 > authentication.

FYI, in J2SE 1.5 the SunSASL provider supports the following client and server mechanisms:

     * Client Mechanisms
           o PLAIN (RFC 2595). This mechanism supports cleartext username/password authentication.
           o CRAM-MD5 (RFC 2195). This mechanism supports a hashed username/password authentication scheme.
           o DIGEST-MD5 (RFC 2831). This mechanism defines how HTTP Digest Authentication can be used as a SASL mechanism.
           o GSSAPI (RFC 2222). This mechanism uses the GSSAPI for obtaining authentication information. It supports Kerberos v5 authentication.
           o EXTERNAL (RFC 2222). This mechanism obtains authentication information from an external channel (such as TLS or IPsec).

     * Server Mechanisms
           o CRAM-MD5
           o DIGEST-MD5
           o GSSAPI (Kerberos v5)

And in Java DMK 5.1 the JavaDMKSASL provider supports the SASL PLAIN Server Mechanism and offers support
for all the SunSASL mechanisms on J2SE 1.4.

Regards,
Luis


-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click