Re: ClientMinPrincipal versus ClientMaxPrincipal

Bob Scheifler wrote:
>> In a subject with multiple principals that can be used for client
>> authentication will the net effect of setting ClientMinPrincipal(A) as
>> constraint be the same as with ClientMaxPrincipal(A) where A is a single
>> principal?
>
> Min(A) allows the possibility of authenticating as additional principals;
> Max(A) does not.  But that possibility only matters if the RMI impl is
> capable of multi-principal authentication; the standard JERI transports
> are not.

I should have added "in the context of the current SSL and Kerberos
implementation that only support one principal". I've read the specs and
reading it is no problem, my 'problem' is with translating that
in the way the endpoints will deal with them (at all times).

As I'm missing a straight "yes" or "no" from your answer, I'll give it
another try. The problem I have with Min(A) and Max(A) is that the specs
for the (Kerberos and SSL) endpoints don't explicitly mention how a
principal is selected in the process, that is likely because the specs
for the constraints and the fact these are supported by the endpoints
should make that obvious, I probably need some more "hand-holding".

Example: I have a subject with Principal A, B en C and out of those 3
principals I want to be sure that when I authenticates to the server it
must use A. In this case I think both Min(A) and Max(A) will have the
same net effect (my original question), am I right here? My reasoning,
Max(A) will limit the set of principals available and Min(A) will make
sure principal A is selected and as the endpoints don't support multiple
principals for authentication only A will be selected.

But in case both A and C are both allowed [1] for client authentication
should I configure Max(A, C) or should I use a
ConstraintAlternatives(Min(A), Min(C)).

Or in other words is Max() nothing more than a way to create a subset
out of the complete set of principals that an endpoint is able to pick
one principal out of (for Kerberos and SSL).

You see my hope is that I can only use Max() and forget about Min()
altogether in the context of endpoints that only have support for one
principal to authenticate as.

[1] I still have a todo related to Tim Blackman's questions in
http://archives.java.sun.com/cgi-bin/wa?A2=ind0608&L=jini-users&P=R1095&I=-3
that when everything is in place I can do some tests for. It still has
to be seen whether I should deny allowing multiple principals to be
available for the purpose of authentication as client. At this time I'm
only intending to issue a warning when multiple principals are available
and they are not limited to a set of one for the purpose of proxy
preparation.
--
Mark

--------------------------------------------------------------------------
Getting Started:     http://www.jini.org/wiki/Category:Getting_Started
Community Web Site:  http://jini.org
jini-users Archive:  http://archives.java.sun.com/archives/jini-users.html
Unsubscribing:       email "signoff JINI-USERS"  to [email protected]