Re: JAAS Interface to sourceid

Back in March, a thread was started related to development of a JAAS
implementation that used SourceID.Java.  I'd like to register my interest in
this, as well.  If anyone is currently working on this, I would be
interested in collaborating.  If no one's currently involved, it's likely
that I'll be starting work in the next couple of weeks.

Assuming I do start an independent effort, would it be appropriate to open
up a SourceForge project or is there some other venue for such branch
projects?  I want my work to be as accessible as possible to others, and
working behind a firewall and simply submitting diffs doesn't seem the best
way to achieve that.

My own motivation for this work is that our org's current security system
(developed and used internally) is based on Win32-specific code with a
database backend.  Since we are moving more and more of our code to
Java/J2EE on Linux, it's in our best interests to move away from our old
methods and use cross-platform standards that are already available for
securing our apps.  Our current system provides a form of single-sign-on
which we must continue to provide to our users, and Liberty Protocol with
SourceID.Java appears to be a good java-based solution, esp. considering
that most of our apps are JSP/Servlet-based.

I can't just leave our support for authenticating other applications out of
the picture, however, so a JAAS implementation seems a likely way to fulfill
our obligation to client-server apps.

In addition, since JAAS uses pluggable authentication methods, I'm also
hoping that such an arrangement will help with some of the code-sharing
issues we've been having by virtue of being a public entity.  We often share
code with external agencies, but are unable to distribute our security
modules due to security restrictions.  Having a pluggable authentication
mechanism such as JAAS will allow external users of our code to implement
their own security plugins and still use our code unmodified.  Even better,
having SourceID as a publicly available implementation will allow them to
use the exact same code we are using for security!

I look forward to getting involved in this worthy effort.

jpt
------------------------------------
James Tillman
Advanced Systems Design
FDLE Webmaster
850-410-8415
[email protected]