Re: Why is there no ServerMinPrincipalType constraint
Mark Brouwer <[email protected]>
| Newsgroups | gmane.comp.java.sun.jini |
|---|---|
| Message-ID | <[email protected]> |
Bob Scheifler wrote: >> I was looking for a ServerMinPrincipalType but it appears there is no >> such constraints, is there a particular reason for that? I was intending >> to let people configure proxy preparers that could say. "Trust each >> server that can authenticate with at least one principal that matches a >> X500Principal or KerberosPrincipal". > > It's not there because to me it doesn't express something useful. > Just knowing that the server authenticated itself, but not knowing who > it authenticated as, doesn't in general convey any level of trust. Is that really true? Assuming I'm in a network and the server is able to authenticate as some Kerberos principal that means that he has been granted one in the KDC and that seems a certain level of trust to me. Also in a PKI environment in which I have an X.500 principal in my trust store it means that the entity at the other end is known by me. -- Mark -------------------------------------------------------------------------- Getting Started: http://www.jini.org/wiki/Category:Getting_Started Community Web Site: http://jini.org jini-users Archive: http://archives.java.sun.com/archives/jini-users.html Unsubscribing: email "signoff JINI-USERS" to [email protected]