Re: Updating subject while service is deployed

Bob Scheifler wrote:
>> I'm thinking about the ability to update the Subject a service operates
>> under while it is active.
>
> The security context contains an access control context, which contains
> a domain combiner, which contains a reference to the Subject, not a copy
> of the Subject.  If you mutate the Subject, the domain combiner will
> subsequently use the new contents.  SubjectDomainCombiner has a caching
> optimization for read-only Subjects, so you may want to evaluate an
> operational system to see if there's any measurable impact to using
> a mutable Subject.

Thanks Bob, I never looked into the details of the ACC. Currently the
subject I create is read-only and I don't know whether I want to change
that into a mutable one. Looking into the source code of Subject I don't
dare to modify the set of principals due to concurrency issues. If I add
a principal and at the same time some of the code in the Jini ERI stack
iterates over the set op principals a ConcurrentModificationException is
not that far away.

I really would like to have the Subject immutable as only the framework
should be able to 'alter' the subject no matter what the permission are
of the server deployed. However I think there is another place where I
could replace the subject. I already have my own implementation of
SecurityContextSource so I'm in control of the SecurityContext that
returns the access control context and I could calculate a new acc when
I need a 'modified' Subject and attach that to the SecurityContext.

Do you envision problems in the current implementation of the Jini ERI
stack such as with caching of ACCs?
--
Mark

--------------------------------------------------------------------------
Getting Started:     http://www.jini.org/wiki/Category:Getting_Started
Community Web Site:  http://jini.org
jini-users Archive:  http://archives.java.sun.com/archives/jini-users.html
Unsubscribing:       email "signoff JINI-USERS"  to [email protected]