[
https://issues.apache.org/jira/browse/DERBY-4990?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12988884#comment-12988884
]
Kim Haase commented on DERBY-4990:
----------------------------------
The topic "Granting permissions to Derby"
(http://db.apache.org/derby/docs/dev/devguide/cdevbabejgjd.html) lists
permissions that should be granted to derby.jar. But from reading the
demo/templates/server.policy file it appears that SocketPermissions are added
to derbynet.jar, not derby.jar. So perhaps this topic is not the right place to
add information about the permission needed for LDAP?
The main place where the Network Server is discussed is the Admin Guide. It
would perhaps make sense to add this information to "Customizing the Network
Server's security policy"
(http://db.apache.org/derby/docs/dev/adminguide/tadminnetservcustom.html),
since this topic discusses SocketPermission already.
I'll file a patch to this effect. More suggestions are welcome.
One thing I notice is that the three sample policy files in the Dev Guide
(http://db.apache.org/derby/docs/dev/devguide/devguide-single.html#cdevcsecure871387)
also seem a little out of date, compared to the current policy template, which
has 8 permissions while the examples have only 5 or 6:
permission java.lang.RuntimePermission "createClassLoader";
permission java.util.PropertyPermission "derby.*", "read";
permission java.util.PropertyPermission "user.dir", "read";
permission java.util.PropertyPermission "derby.storage.jvmInstanceId",
"write";
// The next two properties are used to determine if the VM is 32 or 64 bit.
permission java.util.PropertyPermission "sun.arch.data.model", "read";
permission java.util.PropertyPermission "os.arch", "read";
permission java.io.FilePermission "${derby.system.home}","read";
permission java.io.FilePermission "${derby.system.home}${/}-",
"read,write,delete";
Should they be updated, or were they simplified on purpose? Thanks for any
advice.
> Documentation should state a custom security policy being required to use
> LDAP in conjunction with network driver
> -----------------------------------------------------------------------------------------------------------------
>
> Key: DERBY-4990
> URL: https://issues.apache.org/jira/browse/DERBY-4990
> Project: Derby
> Issue Type: Task
> Components: Documentation
> Reporter: Thomas Hill
> Assignee: Kim Haase
>
> The documentation is lacking a statement that defining and using a >custom<
> security manager template is required when wanting to use LDAP authorization
> provider in conjunction with the network driver client. driver. Otherwise,
> i.e. just using the default security policy will lead to socket permission
> errors. Details on which permission exactely needs to be granted to which
> code base would be very helpful.
> Chapter 'Running Derby under a security manager', section 'granting
> permissions to Derby' in the Developer's guide seems a good place to mention
> the permission java.net.SocketPermission as optional, but required to be set
> when wanting to use LDAP authorization in conjunction with the network client
> driver and defining the authorisation provider properties as system-level
> properties.
> Adding this to the documentation and preferrably also providing some more
> guidance seems desirable as migrating off the builtin user system to LDAP is
> strongly recommened and the documentation has explicit statements about
> security risks otherwise incurred.
> I also realized that the template included in the documentation at
> http://db.apache.org/derby/docs/10.7/adminguide/tadminnetservbasic.html and
> the default template included in 10.7.1.1 software are no longer in sync.
--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
