Re: RE: Admin API and GUI

see inline

----- Original Message ----- 
From: Tim Anderson
To: openjms-developer
Sent: Tuesday, July 29, 2003 3:58 PM
Subject: [openjms-developer] RE: Admin API and GUI


I've committed the changes as is, but I would like to see
modifications as described previously.

One thing to note is that with the current implementation,
it is still possible to invoke admin API methods with
an unauthenticated connection, simply by not invoking
connect().
[K]
Thats correct, I didnt impl. this since I didnt know how you wanted it done.

This needs to be changed so that the admin connection
identifier is submitted with each admin request -
[K]
Do you want to use the ClientId, ConnectionId (returned form the server on
connect()) or both?
As I see it the ClientId alone is not unique enough since it is possible to
generate duplicates.

the server can verify this against the list of authenticated
admin connections before performing any operation.
[K]
This is as I see it a part of the authorization and should be treated in the
Acl.
We could of course make a quick solution for now by just check the id for
every operation.

Do you want to have a AuthorizationMgr to handle this or do you want to have
a common Mgr e.g. SecurityMgr to handle both Authentication and
Authorization??


Regards,

Tim