October 2007 - jboss-dev-forums - Jboss List Archives

[Design of Security on JBoss] - Re: SRP and SASL

by anil.saldhana＠jboss.com

David, when you said that you were going to be doing SRP with SASL, I was visualizing you providing some type of GSS Adapter for SRP. I think that is how the world does it with SASL. I need to refresh my knowledge of sasl/gss to get back. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4097010#4097010 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4097010

18 years, 5 months

1
0
0 / 0

[Design of Messaging on JBoss (Messaging/JBoss)] - Re: Deadlock in JBoss Messaging during JBoss5 shutdown

by timfox

"adrian(a)jboss.org" wrote : [The client side should not hang or break if the Server/ServerPeer vanishes, | it should behave in a reasonable way, i.e. give a reasonable error message. Yes, the client should get the following error message: throw new MessagingJMSException("Cannot handle invocation since messaging server is not active (it is either starting up or shutting down)"); Clebert- is this not what you are seeing? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4097009#4097009 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4097009

18 years, 5 months

1
0
0 / 0

[Design of Messaging on JBoss (Messaging/JBoss)] - Re: Deadlock in JBoss Messaging during JBoss5 shutdown

by adrian＠jboss.org

"clebert.suconic(a)jboss.com" wrote : There are two problems here: | | I - The MDB is being stopped after the ServerPeer... I will verify how to enforce the dependency. | This is not a dependency issue. Simple example, what if the ServerPeer is remote? The ServerPeer should try to notify all clients that their connection is broken before shutting down. The client side should not hang or break if the Server/ServerPeer vanishes, it should behave in a reasonable way, i.e. give a reasonable error message. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4097007#4097007 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4097007

18 years, 5 months

1
0
0 / 0

[Design of Security on JBoss] - Re: SRP and SASL

by david.lloyd＠jboss.com

Incidentally, GNU Crypto (and now, I guess, Classpath) has an SRP SASL implementation as well (based on the same spec I'm using). It's pretty complex compared to mine though (they use password file management). But I plan to use it for interoperability testing. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4097006#4097006 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4097006

18 years, 5 months

1
0
0 / 0

[Design of Security on JBoss] - Re: SRP and SASL

by scott.stark＠jboss.org

Ok, I'll take a look at it when I get a chance. Another workaround is to just fix the parameters for a user via lookup outside of the sasl exchange, or fix them period. This is discussed some in this paper: http://srp.stanford.edu/srp6.ps Encoding the information in the 'password' would also not be that bad. Just make it the base64 representation of the byte[] from an ObjectOutputStream containing the serialized parameters. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4096995#4096995 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4096995

18 years, 5 months

1
0
0 / 0

[Design of AOP on JBoss (Aspects/JBoss)] - Re: ClassLoading Module usage

by adrian＠jboss.org

Don't forget that any changes to the RealClassLoader need doing to BaseClassLoader and the RepositoryClassLoader and that both need to flush any global cache in the domain/repository they belong to. I think just flushing a single class or resource url should suffice? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4096991#4096991 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4096991

18 years, 5 months

1
0
0 / 0

[Design of Security on JBoss] - Re: SRP and SASL

by david.lloyd＠jboss.com

Oops, wrong URL. Try: https://svn.jboss.org/repos/sandbox/david.lloyd/remoting3/core-proto/src/... instead. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4096986#4096986 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4096986

18 years, 5 months

1
0
0 / 0

[Design of Security on JBoss] - Re: SRP and SASL

by david.lloyd＠jboss.com

"scott.stark(a)jboss.org" wrote : But can't you pass in the verifier as the "password'? You could. That would be kind of ugly though. PasswordCallback sends in a char[]; you'd have to send in the verifier, salt, N, and generater values all encoded in the password somehow. "scott.stark(a)jboss.org" wrote : I guess I would have to see what the current mapping of srp to sasl is. Is it checked in somewhere? I hadn't bothered checking it in because it doesn't actually *work* yet. But on the other hand, that hasn't stopped me before, so... https://svn.jboss.org/repos/sandbox/david.lloyd/remoting3/core-proto/impl... View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4096984#4096984 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4096984

18 years, 5 months

1
0
0 / 0

[Design of JBoss jBPM] - Re: Extension of the Designer

by tom.baeyens＠jboss.com

IMO, we need a limited grammar to express the configuration options for a node. That would help to provide better support for this pluggability in the designer. I think we should be thinking in the following direction: 1) limit the grammar to configure node-action properties to strings, numbers, lists and maps 2) helper classes to make it easy to build a form. the node grammar could be input. maybe even a simple special xml language for forms a la XForms could be made to create the eclipse node-action configuration forms. 3) a default way on how a grammar is translated to xml in the process definition. That way, the only input that the designer would need to plug a new node type are: * icon * grammar * form (either a class or an xml document) If default grammer-to-xml is used, then the grammar would be sufficient input for the parsing of the process during deployment in the runtime engine. So the important point IMO is that we need to think about a simple grammar to express node configuration options. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4096983#4096983 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4096983

18 years, 5 months

1
0
0 / 0

[Design of Security on JBoss] - Re: SRP and SASL

by scott.stark＠jboss.org

But can't you pass in the verifier as the "password'? I guess I would have to see what the current mapping of srp to sasl is. Is it checked in somewhere? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4096981#4096981 Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4096981

18 years, 5 months

1
0
0 / 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

jboss-dev-forums October 2007