[jboss-dev-forums] [Design of Security on JBoss] - Security Client SPI

[anil.saldhana@jboss.com]

There have been usage of SecurityAssociation directly in the client code by users as well as JEMS projects.  We really need to be getting a Client SPI from the security project.

The SPI should include things like passage of username/password, callback handler, jaas config name (if the SPI implementation has to do JAAS).

The SPI implementation can make use of SASL on which GSS can be placed. GSS works on the concept of tokens and can use encryption.  

One concept that I have not checked out is whether SASL needs both SASL client as well as SASL server because SASL is primarily used for a challenge/response type scenario.  I want to be just doing SASL client.

A rough outline of the security client spi is:

  | public interface SecurityClient
  | {
  |      public void setUserName(String username)
  |      public void setPrincipal(Principal p)
  |      public void setCredential(Object cred)
  |      public void setJaasConfigName(String str)
  | 
  |      //Advanced stuff for GSS
  |      public setEncryption(String algo)
  | }
  | 

I will work out the SPI in the next few days.

View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4041574#4041574

Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4041574