Re: Jeri/SSL export question

On Mon, Mar 30, 2009 at 04:47:34PM -0600, Esmond Pitt wrote:
> The client got the stub via a registry lookup.

Does the stub have no codebase annotation?  That would be another case
where BasicJeriTrustVerifier (along with verifiers for subcomponents
like SslTrustVerifier) should be able to verify an uncustomized JERI
stub without requiring ProxyTrustVerifier, because without a codebase
annotation the dynamic proxy class's loader should be a "relatively
local" loader trusted by BasicJeriTrustVerifier.

> There are no dynamic proxies in the system, only stubs generated by JERI.

(A stub resulting from exporting with JERI generally has a dynamic
proxy as its outermost object, so I'm not sure you meant to say that.)

> So should I not be expecting the ServerProxyTrust method to be
> called, is that what it comes down to?

Not if the stub can be verified without using ProxyTrustVerifier, like
as described above, because BasicJeriTrustVerifier is sufficient.

Passing this verification means that the stub can be trusted to
implement constraints on remote invocations, like Integrity.YES,
ServerAuthentication.YES, and ServerMinPrincipal, so that the client
can be sure that invocations on the stub only communicate with the
specified principal, regardless of from where or whom the stub was
initially obtained.

-- Peter

--------------------------------------------------------------------------
Getting Started:     http://www.jini.org/wiki/Category:Getting_Started
Community Web Site:  http://jini.org
jini-users Archive:  http://archives.java.sun.com/archives/jini-users.html
Unsubscribing:       email "signoff JINI-USERS"  to [email protected]