[jboss-jira] [JBoss JIRA] (ELY-444) AuthorizationIdentity and PermissionMapper

[David Lloyd (JIRA)]

    [ https://issues.jboss.org/browse/ELY-444?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13199058#comment-13199058 ] 

David Lloyd commented on ELY-444:
---------------------------------

I think we're already well-equipped for custom providers now: the security domain can now transform the SI to have any arbitrary permission enforcement model, even beyond permission mappers.

> AuthorizationIdentity and PermissionMapper
> ------------------------------------------
>
>                 Key: ELY-444
>                 URL: https://issues.jboss.org/browse/ELY-444
>             Project: WildFly Elytron
>          Issue Type: Enhancement
>          Components: API / SPI, Realms
>            Reporter: David Lloyd
>             Fix For: 1.1.0.Beta6
>
>
> When we initially designed the PermissionMapper we went to certain lengths to avoid exposing details of the realm.  But now as the API has evolved it is clear that the permission mapper will need access to more information.  The AuthorizationIdentity (or perhaps another object which includes the AuthorizationIdentity) should be made available to the permission mapper.
> In addition, this object could be expanded to include more information about the authentication, for example mechanism-specific information, which can feed into the authorization decision and could be useful for other things.  Examples include: authentication timestamp, mechanism name/kind, forwarding credentials, and other attributes which derive from the mechanism as opposed to the identity.



--
This message was sent by Atlassian JIRA
(v6.4.11#64026)