Re: ClientAuthentication questions
Vinod Johnson - Sun Microsystems <[email protected]>
| Newsgroups | gmane.comp.java.sun.jini |
|---|---|
| Message-ID | <[email protected]> |
> > I have the feeling that client authentication is not enforced in this > way because you might 'reuse' a secure server endpoint for multiple > exports and sometimes you can have methods for which client > authentication is not required. I'm aware that ClientAuthentication.YES > can be enforced on the proxy by the server constraints, but this can be > by-passed by a malicious client by communicating directly to the > ServerEndpoint. > In the case of BasicInvocationDispatcher, its dispatch method does the following: "The checkConstraints method of the inbound request is called with the constraints that must be enforced for that remote method,...." The SslServerEndpoint implementation will at this point enforce the ClientAuthentication.YES. Access control checks are only performed once the constraints are known to be satisfied. Does that behavior address your concern? > Therefore I assume that access control is the only 'real' protection, > however that introduces a problem for what I'm trying to accomplish. I -- - vinod -------------------------------------------------------------------------- Getting Started: http://www.jini.org/wiki/Category:Getting_Started Community Web Site: http://jini.org jini-users Archive: http://archives.java.sun.com/archives/jini-users.html Unsubscribing: email "signoff JINI-USERS" to [email protected]