[Jboss-dev-forums] [Design of Security on JBoss] - Re: Generalizing the JACC service

[<sco...@jb...>]

Something has to set the caller identity. Any fallback has to rely on some component establishing the caller identity. The PolicyContext is not magically populated by nothing out of the ether surrounding the jboss server. Its populated by the authentication interceptors in the web and ejb containers. The simplified api is a dicussion for the authentication service (http://www.jboss.com/index.html?module=bb&op=viewtopic&t=67191). 

Once simple change could be an extension to the PolicyContext is a ProtectionDomain handler.


View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3895873#3895873

Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3895873