Re: secure modification of lookup attributes
Gregg Wonderly <[email protected]>
| Newsgroups | gmane.comp.java.sun.jini |
|---|---|
| Message-ID | <[email protected]> |
Daniela Inclezan wrote: > I have a boolean lookup attribute whose value should be modified only by > authorized entities and not by anyone else. > What is the most efficient way to securely modify lookup attibutes > provided by the ServiceUI? Service lookup attributes are visible in the JoinAdmin interface, typically. If a service implements JoinAdmin, then it can trivially delegate those operations onto call to JoinManager methods, and provide a simple persistence layer to store those values. Entry values which are part of the service registration should be maintained using this mechanism in almost all cases. So, then you'll take advantage of security mechanisms which already are available but just need to be exploited. Here's the points of implementation which I think you should look at. 1. Reggie's Exporter should assert security that only lets in those who should be registering and configuring service registrations. 2. Your services implemented interface should include JoinAdmin, and those associated methods should have security asserted which restricts access accordingly. Now, Jini security is something that is much bigger than these two items. Currently, to actually take advantage of identity based security, using only what the JTSK provides, you'll need to make use of X.500 certificates or Kerberos ticketing. If neither of those is possible, then you'll need to investigate some of the features of the JERI stack to see how you might provide other identity information into the Invocation Layer. The http://pastion.dev.java.net project has a bunch of raw examples of different ways to integrate username/password authentication into the JERI stack as well as using it externally with a factory type of mechanism which you might use in your services. Please ask some more questions or tell us some more about your constraints on security deployment to help us know more about how to direct you to a solution. Gregg Wonderly -------------------------------------------------------------------------- Getting Started: http://www.jini.org/wiki/Category:Getting_Started Community Web Site: http://jini.org jini-users Archive: http://archives.java.sun.com/archives/jini-users.html Unsubscribing: email "signoff JINI-USERS" to [email protected]