springframework-developer

[Springframework-developer] JAAS

[Isabelle M. <met...@pa...>]

Hi everyone,

I'm doing some stuff with JAAS at work, and it seems like it would be a nice addition to Spring. Basically JAAS is a pluggable authentication and authorization framework. So you can have a database service provider, an LDAP service provider, a file service provider etc... but the API stays the same.

What do you think?

In the meantime I'm also reading up on JMX, will have some suggestions shortly.

Finally, I think we need to come up with a tutorial and docs. I could do those as well, but could Rod please prioritize and let me know?

Isabelle

-- 
Isabelle Muszynski
Zandweellaan 4
2660 Antwerpen
Belgium
Tel. 32-(0)3-830 18 54
Mobile: 32-(0)485 49 50 89

[Springframework-developer] JAAS

[Isabelle M. <met...@pa...>]

No, JAAS is not only a server thing. But most servers provide a way to plug into their JAAS infrastructure. And I guess not all servers provide everything. So we would need stuff like :

(1) abstract Principal
(2) abstract LoginModule
(3) concrete LoginModule's for database, file and ldap authentication
(4) concrete Principals, for ex. using Roles
(5) an access control framework using the PrivilegedAction JAAS stuff (Rod : I guess this would be an aspect on actions !!!)

Isabelle

-- 
Isabelle Muszynski
Zandweellaan 4
2660 Antwerpen
Belgium
Tel. 32-(0)3-830 18 54
Mobile: 32-(0)485 49 50 89

Re: [Springframework-developer] JAAS

[Luke T. <luk...@fr...>]

Isabelle Muszynski wrote:
> Hi everyone,
> 
> I'm doing some stuff with JAAS at work, and it seems like it would be
> a nice addition to Spring. Basically JAAS is a pluggable
> authentication and authorization framework. So you can have a
> database service provider, an LDAP service provider, a file service
> provider etc... but the API stays the same.
> 
> What do you think?

Isn't JAAS less of an application framework thing than a server 
infrastructure thing (in a J2EE context). I know JBoss uses JAAS to 
allow you to plug-in various different types of security infrastructure 
or to write your own, but wouldn't you just be duplicating this?

Luke.

-- 
  Luke Taylor.                      Monkey Machine Ltd.
  PGP Key ID: 0x57E9523C            http://www.monkeymachine.ltd.uk