Re: Best Practices for Handling Client Authentication

Hi Brian,

I think that both 1 and 2 should be doable.  I'm working towards
something similar, and I am not done writing/designing my support
classes.  If your methods are defined in an interface, you should be
able to define a proxy and intercept specific method calls wrapping
them with your Subject.doAs.   Or, if you wanted to apply this
functionality to an existing class, you should be able to use the
CGLIB library.  This way, you can separate your functional
requirement from the security needs of the application.

There is a good introductory article on this topic at: <http://
today.java.net/pub/a/today/2005/11/01/implement-proxy-based-aop.html>

Good luck.
-Ussama

On Apr 13, 2006, at 2:49 PM, Brian Ferris wrote:

> I'm setting up my Javaspace (using Blitz on the backend) to require
> client authentication using JAAS.  Everything is setup properly
> (constraints on the server side, LoginContext on the client side) and
> I've gotten my client to properly authenticate.  However, I've run
> into a general design question concerning LoginContexts.
>
> At some point I have to call Subject.doAs to elevate my privileges.
> I have two options:
>
> 1) I can call this method once to wrap all subsequent code
> 2) I can call this method every time I wish to access the privileged
> object (in this case my JavaSpace)
>
> The first option is tricky, because my application is quite complex
> and there is no one nice entry point to do the login.
>
> If anything, #2 appeals to me.  Specifically, it seems wrapping the
> Javaspace in some sort of Proxy that automatically catches method
> calls and recalls them with elevated privileges would be cool.  Has
> anyone every done something like this?  Are there any existing JINI
> support classes for doing this?  Or should I suck it up and go with
> option #1?
>
> Thanks,
> Brian Ferris
>
> ======================================================================
> =====
> To unsubscribe, send email to [email protected] and include in
> the body
> of the message "signoff JAVASPACES-USERS".  For general help, send
> email to
> [email protected] and include in the body of the message "help".
>
> To view past JAVASPACES-USERS postings, please see:
> http://archives.java.sun.com/archives/javaspaces-users.html
>
>

===========================================================================
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff JAVASPACES-USERS".  For general help, send email to
[email protected] and include in the body of the message "help".

To view past JAVASPACES-USERS postings, please see:
http://archives.java.sun.com/archives/javaspaces-users.html