[Design of Security on JBoss] - Re: SecurityContext
by scott.stark@jboss.org
Setting the security context has to be reconcilled with the security aspect behavior. If you do an explicit jaas login, all that really results is an authenticated subject. Instead of having a ClientLoginModule push this to a thread local, it could associate this info with the mc metadata repository at a request scope. The aspect checking the security context would use the metadata repository to pickup scope starting from the request and moving up to higher levels like deployment, security domain default, etc.
Alternatively we could look at Subject.doAs*()/Subject.getSubject(AccessControlContext acc) with validation of the authentication as data in the subject private credentials to better leverage the jaas apis.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3997403#3997403
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3997403
18 years, 2 months
[Design of Security on JBoss] - Re: SecurityContext
by anil.saldhana@jboss.com
Now where will the client side interceptors pick up the caller Security Context from? I need something like the old SecurityAssociation threadlocal.
This is just a minute issue but this is where I cannot throw away the threadlocal concept. In my current prototype, I have a SecurityContextAssociation with a single threadlocal to hold the securitycontext object. The Security Interceptor in the proxy looks at the threadlocal object to obtain the call-path security context. If it exists and it holds the invocation principal(means there is no explicit jaas login), I just send the security context over the invocation. If the invocation principal does not match with the SC on the threadlocal, it means there is an explicit jaas login - create a new SC (plug the call-path sc as its parent) and set this new SC on the threadlocal as well as sending it on the invocation. Takes care of end-to-end security.
The security context can hold the caller's security context and be passed via invocation. So we get the stack like behavior for the caller's context.
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3997373#3997373
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3997373
18 years, 2 months