August 2006 - jboss-dev-forums - Jboss List Archives

[Design of Security on JBoss] - Re: Changes to Realm Interface sought

by remy.maucherat＠jboss.com

No, this seems more like a job for a custom authenticator. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3962918#3962918 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3962918

19 years, 8 months

1
0
0 / 0

[Design of Security on JBoss] - Re: Changes to Realm Interface sought

by j2ee_junkie

sweet! That would really allow authentication to open up to more than just a username and password. The only argument that I could make would be if a Realm is an abstraction of a set of principals and the roles/permissions they are allowed, should a realm really have any knowledge of a httpServletRequest/Response? later, cgriffith View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3962912#3962912 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3962912

19 years, 8 months

1
0
0 / 0

[Design of JBoss Portal] - Re: theme portlet

by rali.genova＠jboss.com

Brand Conrol is a very good use, but the users are selecting their theme from a finite 'controlled' set of choices, that I would assume as brand compliant (if you could put it that way). But yes, we need to secure this portlet for the Final release for sure. rali View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3962902#3962902 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3962902

19 years, 8 months

1
0
0 / 0

[Design of JBoss Portal] - Stress/Load Testing plan/suggestions

by rali.genova＠jboss.com

I am making a plan for stress and load testing for Portal 2.4, but wanted some feedback on how real-usability those tests are. I have set up grinder and created 115 users in mySQL database for the first stage of testing - they can be increased to any number later. There would be a mixed set of users - those from 'Users' role and a bunch of 'Admins' - so we can exploit secured portlets as well (CMS being the most important). Here is an abridged outline to the scenario: USERS *user logs in *change the zip of weather portlet to check local forecast *click on some of the news headlines *minimize his weather portlet *edit some of his profile *(idle for 40-50 mins) *log back in *bring back the weather portlet, check a few other cities *logout ADMINS *log in *check deployed portlet instances *create a few CMS files *edit a few CMS files *logout There is only so much I can do with the out of the box portlets, and there will be many users logged in at the same time, doing pretty much the same things, although I will try to have them start at diff times and the tests will be run for 24 hours. Any comments, corrections, ideas are greatly appreciated. Thanks, Rali View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3962901#3962901 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3962901

19 years, 8 months

1
0
0 / 0

[Design of JBoss Portal] - Re: theme portlet

by james.cobb＠jboss.com

Users should never be able to change the themes for others. Only admins should do that. I think the admin should have the ability to globally change the themes. There may be some instances where the admin abuses this power but I think the vast majority won't use it on a "whim". I see it as a necessary tool to control your brand. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3962900#3962900 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3962900

19 years, 8 months

1
0
0 / 0

[Design of JBoss Portal] - theme portlet

by rali.genova＠jboss.com

I saw some strange behaviour of the themes this morning. Portal 2.4 (CR2) has the Theme portlet at the bottom of the Test page, and if two different users are logged in at the same time, one can change the theme from there and it persists across all users. This seems a little illogical and unnecessary. On the other hand, if a user specifies a theme within his profile, it remains constant, even if someone else changes the theme from the portlet. Maybe we should remove the portlet, or secure it? Although I don't see the use of Admins changing on a whim the theme for poor users, who still have 'Site Default' in their profile - imagine the confusion if your favorite theme changes one day, just because your portal admin decided purple is the new summer color. rali View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3962895#3962895 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3962895

19 years, 8 months

1
0
0 / 0

[Design of Security on JBoss] - Changes to Realm Interface sought

by anil.saldhana＠jboss.com

Remy/Mladen, I propose the following method addition to the Realm interface for Tomcat 6. This would take care of the needs for header based authentication (which may include some form of SSO/Identity Management usecases) and JSR-196 (Java Authentication Container SPI) needs. | public Principal authenticate(Request request, Response response, | LoginConfig loginConfig) throws Exception; | The current limitation with the Realm interface is the loss of the request object during authentication. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3962889#3962889 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3962889

19 years, 8 months

1
0
0 / 0

[Design of Clustering on JBoss (Clusters/JBoss)] - Re: JBAS-2394 - multicast addr not working

by bstansberry＠jboss.com

"bela(a)jboss.com" wrote : | 2) I didn't see that we use ${jboss.bind.address} in cluster-service.xml/tc5-cluster-service.xml, we should do this. JGroups should bind to whatever is passed to -b anyway. Adding bind_addr=${jboss.bind.address} to the configs would make this more explicit. But, a downside is it will encourage people to think they can change that parameter and always get the result they want. If they set bind_addr AND use -b, they're going to bind to jboss.bind.address, not to whatever the configured with the bind_addr property. Note for users wanting to know how to get around the above problem. Either: 1) Use JGroups 2.2.8 or higher, use bind_addr=address2 in the protocol stack config and start JBoss with -b address -Dignore.bind.address=true 2) Don't configure bind_addr in the protocol stack config. Start JBoss with -b address1 -Dbind.address=address2 (with the parameters in that order.) View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3962872#3962872 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3962872

19 years, 8 months

1
0
0 / 0

[Design of Clustering on JBoss (Clusters/JBoss)] - Re: JBAS-2394 - multicast addr not working

by dimitris＠jboss.org

Right, so the only thing left is to find out what's those fixed TCP ports and the random UDP ones are used for, and whether those setting need to be externalized. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3962861#3962861 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3962861

19 years, 8 months

1
0
0 / 0

[Design of JBoss Eclipse IDE (dev)] - Re: WAS: Hibernate Tools not forward compatible with WTP (@h

by dlmiles

"max.andersen(a)jboss.com" wrote : hmm - at the time we created the updatesite the full featureset would be 80 megs extra. That might have changed and they might have divided it up into more workable pieces....sounds good if they have. Yes a "full featureset of WTP" would still be 80Mb I'm sure, but not what I'm pushing for. I want a "full featureset of hibernate tools pre-requisites" which just means: * fixing the features/org.hibernate.eclipse.feature_3.2.0.beta6a/feature.xml file and * including the relevant features/org.{eclipse,apache}.* files that are missing. * breaking apart the files on the update site into one feature per file, but the update site is more-or-less an unzipped HibernateTools-XYZ.zip file with an extra site.xml thrown in. So the only new work here is generation of the site.xml by an ANT task or something. AFAIK unless there were crossed dependancies within WTP (an error) it has always been built to work this way in theory. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3962860#3962860 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3962860

19 years, 8 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-dev-forums August 2006