Re: SF Security: How to enable

Hi Andreas,

the requirement of having a description in a signed jar file is because
the parser loads .sf using a secure class loader.After that, and
provided that you do not add extra classes, there is no more need of
signed jar since the parser will talk "directly" with a SSL connection 
to the target daemon and send component descriptions objects (not the
original jar file!).

What I mean with the above is if you can load a .sf from a source that
you trust (i.e., not using the class loader, just get the input
stream...) then you can feed that to the parser directly and everything
should work... You could have a simple component that do that. That 
approach is equivalent from a security point of view to bundle into the
SFStart a transparent "load the .sf from a stream, patch jar, and  sign"
model. However, you should be careful where the .sf is loaded from since
there is no authentication of the file...

Regarding multiple users/ domains the current security does not support
it. That was the goal of SF Security 2, currently in limbo. If you need
to do that you will have to do it "at the border", e.g., have a proxy
that authenticates a customer, checks what he wants to do and do the
deployment on behalf of the customer. (the customer cannot do
deployments directly (otherwise he gets full privileges...), but uses 
a proxy for ALL interactions with SmartFrog.

Hope this helps,

Antonio



On Thu, 2007-03-08 at 09:28, Andreas Unterkircher wrote:
> > -- Note that when using security you cannot load descriptions from the
> > file system, the descriptions have to be contained in singed jars.
> 
> What we want to achieve is that only certain users can deploy into the 
> SF daemons we are running on several machines. If I understand correctly 
> to achieve this a user who wants to deploy when security is enabled has 
> to do:
> 
> - have the key
> - create the description (a ascii .sf file)
> - put the description in a jar
> - sign the jar
> - deploy
> 
> Am i right with this ? If yes, is there a sfStart script that does this 
> in a transparent way ? I mean the user still types "sfStart host name 
> description.sf" but behind the scenes the jar generation and signing 
> takes place.
> 
> Thanks,
> Andreas
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> > 
> > ---
> > 
> > For more info refer to this previous thread. 
> > http://thread.gmane.org/gmane.comp.java.smartfrog.devel/811
> > 
> > We will update the Tutorial to cover this topic but if you still have
> > problems, please ask again.
> > 
> > Regards,
> > 
> > Julio Guijarro
> > 
> > -----Original Message-----
> > From: smartfrog-support-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> > [mailto:smartfrog-support-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org] On Behalf Of
> > Sabharwal, Ritu (STSD)
> > Sent: 06 March 2007 11:01
> > To: Omer Khalid
> > Cc: Smartfrog Support
> > Subject: Re: [Smartfrog-support] SF Security: How to enable
> > 
> > Hello Omer,
> > 
> > Please follow the instructions in sfUserManual under section 6 titled 
> > "Enabling Security".
> > 
> > Thanks & Regards,
> > Ritu.
> > 
> > Omer Khalid wrote:
> > 
> >> Dear "SmartFrog Experts",
> >>
> >> I have been looking for a step-by-step guide on how to enable SF 
> >> security. So far I have managed to find bit and pieces in different 
> >> places :-(.
> >>
> >> I am wondering if there exist a concise documents? It would be a great
> > 
> >> help if some one could send me the pointer to it.
> >>
> >> Many thanks in advance!
> >>
> >> Omer
> >>
> >> -- 
> >> ---------------------------------------------------------------
> >>
> > 
> >> CERN - European Organization for Nuclear
> >> IT Department,  CH-1211 Geneva 23, Switzerland
> >>
> >> Phone: +41 (0) 22 767 7996
> >> Fax:     +41 (0) 22 767 4900
> >> E-mail : [email protected] <mailto:[email protected]>
> >> Homepage: http://cern.ch/Omer.Khalid
> >>
> >> -----------------------------------------------------------------------
> > -
> >> -----------------------------------------------------------------------
> > --
> >> Take Surveys. Earn Cash. Influence the Future of IT
> >> Join SourceForge.net's Techsay panel and you'll get the chance to share
> > your
> >> opinions on IT & business topics through brief surveys-and earn cash
> >> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVD
> > EV
> >> -----------------------------------------------------------------------
> > -
> >> _______________________________________________
> >> Smartfrog-support mailing list
> >> Smartfrog-support-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> >> https://lists.sourceforge.net/lists/listinfo/smartfrog-support
> >>  
> >>
> > 
> > 
> > 
> > ------------------------------------------------------------------------
> > -
> > Take Surveys. Earn Cash. Influence the Future of IT
> > Join SourceForge.net's Techsay panel and you'll get the chance to share
> > your
> > opinions on IT & business topics through brief surveys-and earn cash
> > http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDE
> > V
> > _______________________________________________
> > Smartfrog-support mailing list
> > Smartfrog-support-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> > https://lists.sourceforge.net/lists/listinfo/smartfrog-support
> > 
> > -------------------------------------------------------------------------
> > Take Surveys. Earn Cash. Influence the Future of IT
> > Join SourceForge.net's Techsay panel and you'll get the chance to share your
> > opinions on IT & business topics through brief surveys-and earn cash
> > http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> > _______________________________________________
> > Smartfrog-support mailing list
> > Smartfrog-support-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> > https://lists.sourceforge.net/lists/listinfo/smartfrog-support
> 


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV