[Jboss-dev-forums] [Design of Security on JBoss] - Re: Mapping Application Roles to Declarative Role

[j2ee_junkie <do-...@jb...>]

Dear gang,

Well after a good night's rest (something of a rarety these days with my 3mo old son) and a shot of coffee, the light bulb over the head finally turned on.  I am reluctant to admit that it was not until then that I really understood the problem purposed and all of your suggestions.

That said, I would like to point out that the RealmMapping interface was designed to be a point of access for Principal to Role mapping.  As such there needs to be a way to configure this mapping for the RealmMapping implementor to store and use.  As Scott pointed out, currently this is a "legacy overloaded use of JAAS".  I now understand and agree.  Also, Scott has pointed out the benefits of creating a security context that can store this mapping, among other things.  This is good, but it still does not explain how to configure the mapping.  For that, I seem to agree with Anil and Sohil.  The JaasSecurityManager as a RealmMapping should have a way to configure the mapping other than thru the use of the JAAS login.  The login config then seems to be the logical place to be extended to provide a per security domain mapping.

Another idea that comes to mind is to create a new AuthenticationManager and RealmMapping class (for this discussion I will call it NewSecurityManager) that performs JAAS login to obtain identity (like JaasSecurityManager), but does not depend on Roles to be assigned to Subject.  The login will just assign Principals to the Subject as JAAS  intended.

Then a pluggable means to configure the mapping from Principals to Application Role could be created.  Such pluggins could contact a persistent store (db, ldap, file) or be configured dynamically.  The pluggin used would be a NewSecurityManager config parameter.

Just my updated thoughts.  enjoy, cgriffith

View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3956191#3956191

Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=3956191