Re: SF Security: How to enable

Andreas Unterkircher wrote:
>> -- Note that when using security you cannot load descriptions from the
>> file system, the descriptions have to be contained in singed jars.
> 
> What we want to achieve is that only certain users can deploy into the 
> SF daemons we are running on several machines. If I understand correctly 
> to achieve this a user who wants to deploy when security is enabled has 
> to do:
> 
> - have the key
> - create the description (a ascii .sf file)
> - put the description in a jar
> - sign the jar
> - deploy
> 
> Am i right with this ? If yes, is there a sfStart script that does this 
> in a transparent way ? I mean the user still types "sfStart host name 
> description.sf" but behind the scenes the jar generation and signing 
> takes place.

The  world view has always been that you create and sign the JARs before 
you start.

There is some placeholder support for this in the Ant tasks, but as it 
doesn't have any tests, it still doesnt exist.


If it did exist, the code would contain:

* a <security> datatype with keystore, policy file, alias and security 
properties
* a <sf-sign> task that signs jars, using a nested or referenced 
<security> datatype
* all the ant tasks to start/call smartfrog to take a nested or 
referenced <security> datatype and to use it to set up their JVM properties.

what is not in the written-but-not-tested state is support for dynamic 
JAR file creation and signing if you have any inline application using 
<sf:deploy> or the like, which is something I've just added as JIRA 
feature SFOS-88.

I may add this, but would do it as part of the move to Ant1.7 only 
tasks. Is everyone ready for that?

-steve




-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV