jboss-dev-forums

[Jboss-dev-forums] [Design of Security on JBoss] - Re: Generalizing the JACC service

[<sco...@jb...>]

"mholzner" wrote : and just when you think it's all working ....
  | 
Since the jacc service is a vm global notion, it should not be bundled in the portal sar. If there are startup issues when seperating the jacc service, you need to introduce the required depends statements on the dependee services such as the tomcat sar.


View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3904891#3904891

Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3904891

[Jboss-dev-forums] [Design of Security on JBoss] - Re: Generalizing the JACC service

[<sco...@jb...>]

"mholzner" wrote : 
  | ...
  | If the installed Policy is infact an instance of the DelegatingPolicy, then what gets returned from the Policy.getPolicy() is never a DelegatingPolicy instance, but rather a DelegatingPolicy$PolicyProxy
  | 

This still should not be causing duplicate creation of the DelegatingPolicy since the DelegatingPolicy.getInstance() is a singleton factory method. The only way a duplicate should result is if there is an improper duplicate deployment of the jbosssx.jar into a scoped deployment. I'll look at what a redeployment of the jacc service does.

View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3904897#3904897

Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3904897

[Jboss-dev-forums] [Design of Security on JBoss] - Re: Generalizing the JACC service

[<ani...@jb...>]

Had a cursory look at the Sun's open source xacml implementation over the weekend. They have a very liberal license.

Plus the concept of PolicyFinderModule(s) that can locate policy files matches closely with our current pattern of LoginModule(s)/ServerAuthModule(s) used in the Security Layer. This default XACML implementation can be extended to provide a stackable JBoss  policy modules in for Authorization.

http://cvs.sourceforge.net/viewcvs.py/sunxacml/sunxacml/com/sun/xacml/finder/PolicyFinderModule.java?rev=1.4&view=markup

http://sunxacml.sourceforge.net/config.html 

With the new Authorization Service that has Authorization Managers decoupled from the Authentication Managers (unlike the legacy JaasSecurityManagers), we can have very interesting Authorization infrastructure setup, that is independent and pluggable.


View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3916375#3916375

Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3916375

[Jboss-dev-forums] [Design of Security on JBoss] - Re: Generalizing the JACC service

[<ani...@jb...>]

Scott, currently the PolicyConfiguration.linkConfiguration is not complete because it fails to link the internal ContextPolicy. (It is not implemented)

Here is a basic implementation that I did in the portal jacc layer (forked jacc layer).


  | ContextPolicy.java
  | 
  | void linkConfiguration(ContextPolicy link)
  |       throws PolicyContextException
  |    { 
  |       Enumeration en = this.excludedPermissions.elements();
  |       while(en != null && en.hasMoreElements())
  |          link.excludedPermissions.add((Permission)en.nextElement());
  |       
  |       en = this.uncheckedPermissions.elements();
  |       while(en != null && en.hasMoreElements())
  |          link.uncheckedPermissions.add((Permission)en.nextElement()); 
  |       if(!rolePermissions.isEmpty())
  |         link.rolePermissions.putAll(rolePermissions); 
  |    }
  | 

Basically the perms and roles from the parent get added into the child.

This worked for my usecase.

View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3919698#3919698

Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3919698