Re: Jeri/SSL export question

On Sun, Mar 29, 2009 at 05:27:09PM -0600, Esmond Pitt wrote:
> Thanks Peter, I have in the server as discussed:
> 
> Exporter exporter = new BasicJeriExporter(ep, new
> ProxyTrustILFactory(serverConstraints, permClass), dgc, keepAlive,
> RemoteSubject.UUID);
> Remote stub = exporter.export(this);
> 
> and in the client:
> 
> ProxyPreparer	pp = new BasicProxyPreparer(true, clientConstraints, permissions);
> RemoteSubject	rs = (RemoteSubject)pp.prepareProxy(stub);
> // execute calls on rs
> 
> where RemoteSubject is my remote interface. The server implements
> ServerProxyTrust by returning a new BasicProxyTrustVerifier(stub). A
> breakpoint on this line is never reached.

How does the clinet get the value for "stub"?

> Again I have to say I'm still not 100% clear about all this,
> although the fog is clearing. Basically I'm trying to use JERI/SSL
> in the securest manner possible, and specifically with
> ServerProxyTrust.getProxyVerifier() being executed, without using my
> own proxy stubs.

I'm not sure what you mean by "without using my own proxy stubs".

> Further to this, it seems that the server's getProxyVerifier() method isn't
> being called because the stub passes one of the other verifiers first every
> time through Security$Context.isTrustedObject(). The ProxyTrustVerifier is
> configured as the 5th verifier, i.e. index [4], and i never gets beyond 2 in
> that loop, throughout all the recursions.
> 
> This seems odd to me. Surely the stub should pass +all+ the verifiers, not
> just one of them?

No, the stub (or any given object) only needs to be pass one verifier.
See the API doc for TrustVerifier.Context.isTrustedObject, and section
3.2.1 of the 2.x starter kit "overview" document[1].  The variety of
available verifiers serves to support verifying for different kinds of
objects or by using different mechanisms.  Note that the trust
verifier context can be invoked recursively for contained objects,
thus enlisting other verifiers to help fully verify a containing
object-- and that typically occurs when verifying a JERI stub.

-- Peter

[1] Online here:
    http://java.sun.com/developer/products/jini/arch2_0.html

--------------------------------------------------------------------------
Getting Started:     http://www.jini.org/wiki/Category:Getting_Started
Community Web Site:  http://jini.org
jini-users Archive:  http://archives.java.sun.com/archives/jini-users.html
Unsubscribing:       email "signoff JINI-USERS"  to [email protected]