Re: Looking for simple servlet-to-javaspace example

Logan, Patrick wrote:
> Thanks. I am catching up now on the several responses. Here's one...
>
> Dan wrote...
>> To make security work, we need our wrapped servlet to be logged in
>> as a particular Subject via LoginContext.  The login information to
>> use for this is also in the Jini .config file.  Note that setting
>> this to null, will have the servlet running with no LoginContext
>> which in the insecure case will be fine.
>
> I personally am still wrapping my brain around JAAS, JBoss, and Jini,
> yet it does seem establishing the Subject for the servlet seems
> straightforward.
>

Certainly the code is simple - dunno about JBoss configuration tho'

> So jumping ahead of my reading a bit, I am assuming something like:
>
> (1) Some jini service will need certain permissions.
> (2) Some subject will be authenticated for using some servlet.
> (3) The permissions will be set up for that servlet such that the
>     subject has the roles that the servlet needs to use the jini
>     service.
>

Kind of - there's another angle to consider:

The service may enforce policies for authentication and authorization
(permissions associated with the Subject) based on Subject and
associated Principles.  Thus, if the client-side code (in this case the
Servlet) isn't associated with the appropriate Subject you will be nailed.

From the client perspective, we may need to grant the service's proxy
some permissions, particularly to try and authenticate itself as our
Subject.  Which means giving it AuthenticationPermission via a
ProxyPreparer.grant() call.

And obviously, if the Servlet is running under some Subject, it's
actions will be limited by the policy associated with that Subject.

> Basically yes?
>

You'll have to judge for yourself ;)

> As for codebases, etc....
>
> (a) As for codebases, etc. and servlets moving objects out into the
>     distributed jini world... for now I think the simplest thing is to
>     make the servlets be simple jini clients (e.g. they can get a
>     javaspace to do reads, writes, and takes) and either the Entry
>     classes are well-known on the servlet classpath (as well as any
>     other javaspaces worker that uses them), or...
>
> (b) The servlet uses a simple jini service which brings its own entry
>     classes with it and accesses the javaspace on behalf of the
>     servlet, or...
>

Yeah - okay, something like a simple Jini service with a JERI stub and
all entry's on the classpath.

> (c) Something else where the objects come from the jini world into the
>     servlet world rather than vice-versa, or...
>
> (d) Eventually get to where servlets can be providing objects with
>     codebases because it's really not that scary after all.
>

My favourite of course :)

> Thanks for the emails... I am chewing.

Chew slooooooowwwwwwwwwwwlllllllllly - indigestion is bad.

And no speaking when your mouth is full.....

;)


Dan.

--------------------------------------------------------------------------
Getting Started:     http://www.jini.org/wiki/Category:Getting_Started
Community Web Site:  http://jini.org
jini-users Archive:  http://archives.java.sun.com/archives/jini-users.html
Unsubscribing:       email "signoff JINI-USERS"  to [email protected]