[jboss-dev-forums] [Design of JBoss Remoting, Unified Invokers] - Remoting 3 Security

[david.lloyd@jboss.com]

Some random thoughts about security in Remoting 3.

Authentication - SASL looks like a good option to support client authentication.   The API makes it look pretty easy.  I know that SRP was proposed at one point as well.  Can an SRP mechanism be added to SASL?  My first glance makes me think "yes".  But I don't know how this would work with other mechanisms (e.g. GSS).

Encryption - currently there is SSL support for certain protocols (http mainly?).  It does not look to me like SSL is supported for socket/multiplex/bisocket (see my wiki posting for how/why these could be unified).  SSL/TLS should be available for the "default" transport for sure.


View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4060919#4060919

Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4060919