Re: ClientAuthentication questions
Mark Brouwer <[email protected]>
| Newsgroups | gmane.comp.java.sun.jini |
|---|---|
| Message-ID | <[email protected]> |
Vinod Johnson - Sun Microsystems wrote: > In the case of BasicInvocationDispatcher, its dispatch method does the > following: > "The checkConstraints method of the inbound request is called with the > constraints that must be enforced for that remote method,...." > The SslServerEndpoint implementation will at this point enforce the > ClientAuthentication.YES. Access control checks are only performed once > the constraints are known to be satisfied. Does that behavior address > your concern? Yes, thanks for the explanation Vinod, I must admit it is a complicated puzzle the security stuff but always the pieces seems to fit :-). Effectively in this case this would mean you could grant an AccessPermission for all protection domains for a method as long as you enforce ClientAuthentication.YES as part of the server constraints. Although I already decided to start implementing an access control check mechanism that is not security policy based as it provides me more granularity (parameters and return types) and once you have such a thing the next small step is to dynamically change these access control permissions for deployed services. -- Mark -------------------------------------------------------------------------- Getting Started: http://www.jini.org/wiki/Category:Getting_Started Community Web Site: http://jini.org jini-users Archive: http://archives.java.sun.com/archives/jini-users.html Unsubscribing: email "signoff JINI-USERS" to [email protected]