Re: New security implementation

Hi Simon,

This does not work exactly as you describe it below.

If "alice" was the authenticated identity and "bob" the delegate identity then the
required permissions would be the following:

grant codebase "jmxconnectorserver.jar" {

     permission <Any permission required by the JMX connector server's operations>;

     permission SubjectDelegationPermission "javax.management.remote.JMXPrincipal.alice";

}

grant principal javax.management.remote.JMXPrincipal "alice" {

     permission <Any permission required by Alice's operations>;

     permission SubjectDelegationPermission "javax.management.remote.JMXPrincipal.bob";

}

grant principal javax.management.remote.JMXPrincipal "bob" {

     permission <Any permission required by Bob's operations>;

}

As you can see the JMX Connector Server grant clause does not need to have the
SubjectDelegationPermission for Bob, just the SubjectDelegationPermission for
Alice is needed.

The JMX Connector Server grant clause only declares the SubjectDelegationPermission
for the authenticated identities.

Regards,
Luis

 > Bordet, Simone wrote:
 >
 > Ron, Eamonn, others,
 >
 > I've implemented what we've discussed to be the "proposed" implementation of the security implementation as outlined by Eamonn.
 > The goal is to avoid that code that creates the JMXConnectorServer requires every permission required by the MBeans the JMXConnectorServer can invoke.
 > Eamonn suggested to check for a SubjectDelegationPermission so that if the code creating the JMXConnectorServer has this permission, then this code needs no longer to have the permissions required by MBeans.
 >
 > Just to check that I have understood correctly, here's how it works:
 >
 > A client authenticates user "alice". On server side, the policy file allows "alice" to do something:
 >
 > grant principal "alice"
 > {
 >    MBeanPermission "*", "invoke";
 >    FilePermission "<<ALL FILES>>", "read";
 > }
 >
 > The policy file to setup for the code that started the connector server - the "current" implementation - is along these lines:
 >
 > grant codebase "jmxconnectorserver.jar"
 > {
 >    // Other I/O permissions
 >
 >    MBeanPermission "*", "invoke";
 >    FilePermission "<<ALL FILES>>", "read";
 > }
 >
 > MX4J allows also to specify - the "proposed" implementation - this grant block:
 >
 > grant codebase "jmxconnectorserver.jar"
 > {
 >    // Other I/O permissions
 >
 >    SubjectDelegationPermission "JMXPrincipal.alice";
 > }
 >
 > If the client authenticates "alice" and then delegates to "bob", any security-sensitive invocation results in a SecurityException: "jmxconnectorserver.jar" does not have permission to delegate to "bob" nor has the permissions "bob" needs. This is true even if "alice" has a SubjectDelegationPermission to "bob".
 >
 > If "jmxconnectorserver.jar" has SubjectDelegationPermission also for "bob", but "alice" does not, then a SecurityException is thrown (here nothing different from usual).
 >
 > If both "jmxconnectorserver.jar" and "alice" have SubjectDelegationPermission also "bob", then any security-sensitive invocation made as "alice" or "bob" will pass as specified by their corrispondent grant entries.
 >
 > This has been committed to HEAD. Feel free to try it out and report any mistake.
 >
 > Thanks,
 >
 > Simon


-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl