Re: Throwing an exception to indicate a failed authentication

Section 19.2 of the J2EE Connector Architecture version 1.5 document is
fairly clear on which exception should be expected in the various scenarios
described below.  As with any spec, there is always wiggle room for
interpretation.  But, in the case of the SecurityException, the spec is
pretty clear that this is used between the Application Server and the
Resource Adapter (not between the client application and the app server or
resource adapter):

   javax.resource.spi.SecurityException:  ASecurityException indicates
   error conditions related to the security contract between an application
   server and
   resource adapter...

And, the ResourceAllocationException can be thrown by either the
Application Server or the Resource Adapter:

   javax.resource.spi.ResourceAllocationException:  This exception is
   thrown by an application server or resource adapter to indicate a
   failure to
   allocate system resources, such as threads and physical connections...

Since the signature for the getConnection() method only has the parent
javax.resource.ResourceException, that's the only requirement.  And, the
only exception that you can definitely count on across application servers.
As shown above, the spec outlines expectations for other exceptions, but
since the "contract" on getConnection isn't specific enough, you can't
count on it.

-----------------------------------------------------------
Kevin Sutter, WebSphere Distributed (J2EE Connectors)
mail:      [email protected], Kevin Sutter/Rochester/IBM




             New Stephen
             <Stephen.New@MINC
             OM.COM>                                                    To
             Sent by: "A               [email protected]
             public list for                                            cc
             J2EE Connector
             architecture                                          Subject
             interest."                Throwing an exception to indicate a
             <CONNECTOR-INTERE         failed authentication
             [email protected]>


             03/17/2004 01:10
             AM


             Please respond to
              "A public list
                 for J2EE
                 Connector
               architecture
                interest."







Hi. We are implementing a J2CA (version1.0) Resource Adapter in order to
provide access to our own EIS. I've got a couple of questions to ask:

Firstly, is it appropriate to throw a javax.resource.spi.SecurityException
from an implementation the
javax.resource.cci.ConnectionFactory.getConnection() method when a Resource
Adapter client has insufficient privileges to access the underlying EIS?
The description of javax.resource.spi.SecurityException, in section 12.2
J2CA spec v1.0, seems to indicate that this is an appropriate exception for
these circumstances. However, the fact that this exception belongs to an
"SPI" package makes me wonder whether it is appropriate to throw this
exception out through the "CCI".


Secondly, we are choosing to throw this SecurityException out of our
implementation of
javax.resource.spi.ManagedConnectionFactory.createManagedConnection() when
it has been detected that authentication with the EIS has failed. We are
expecting that this exception will be propagated to the client of the
Resource Adapter. However, this is beyond our control because the
application server intervenes.
ManagedConnectionFactory.createManagedConnection() is actually being called
by the implementation of javax.resource.spi.ConnectionManager that is
provided by IBM's Websphere Application Server (WAS). WAS chooses to catch
this SecurityException and throw (instead) a
javax.resource.spi.ResourceAllocationException.  So, our
ConnectionFactory.getConnection() has asked WAS's ConnectionManager to
allocate a connection, and this ConnectionManager has thrown a
ResourceAllocationException.

In my mind, there seems to be a bit of a gap in the J2CA spec. The spec
does not prescribe what sort of exception should be thrown from
ConnectionFactory.getConnection() in these circumstances. So, we cannot
tell our clients what sort of exception to expect for a failed
authentication, and we are at the mercy of the application servers
implementation as to exactly which exception will be thrown.

Is my summation correct? Or am I missing something. Would anyone care to
comment?

Thanks very much,
Stephen New


--
This transmission is for the intended addressee only and is confidential
information. If you have received this transmission in error, please notify
the sender and delete the transmission. The contents of this e-mail are the
opinion of the writer only and are not endorsed by the Mincom Group of
companies unless expressly stated otherwise.
===========================================================================
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff CONNECTOR-INTEREST". For general help, send email
to [email protected] and include in the body of the message "help".

===========================================================================
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff CONNECTOR-INTEREST".  For general help, send email to
[email protected] and include in the body of the message "help".