Re: Why is there no ServerMinPrincipalType constraint
Bob Scheifler <[email protected]>
| Newsgroups | gmane.comp.java.sun.jini |
|---|---|
| Message-ID | <[email protected]> |
> I was looking for a ServerMinPrincipalType but it appears there is no > such constraints, is there a particular reason for that? I was intending > to let people configure proxy preparers that could say. "Trust each > server that can authenticate with at least one principal that matches a > X500Principal or KerberosPrincipal". It's not there because to me it doesn't express something useful. Just knowing that the server authenticated itself, but not knowing who it authenticated as, doesn't in general convey any level of trust. > There is a ClientMinPrincipalType and ClientMaxPrincipalType so I would > have expected it to be there for the server part as well. One theory behind the client type constraints was that it would permit reuse of a single configuration file against different logins. Whether that actually holds useful in practice, I don't know. IIRC, back when thread-local context constraints were part of the proposed design, there was a theory they could be used to constrain without revealing specific identities to untrusted code, but that's gone by the boards. - Bob -------------------------------------------------------------------------- Getting Started: http://www.jini.org/wiki/Category:Getting_Started Community Web Site: http://jini.org jini-users Archive: http://archives.java.sun.com/archives/jini-users.html Unsubscribing: email "signoff JINI-USERS" to [email protected]