#81: support for user authorization
------------------------+---------------------------------------------------
Reporter: sxw | Owner: smoku
Type: enhancement | Status: new
Priority: major | Component: sm
Version: 2.1 | Resolution:
Keywords: | Blocking:
------------------------+---------------------------------------------------
Comment (by sxw):
Surely all of the connection authentication & authorisation happens before
the SM is started? The user needs to either be authenticated and
authorised, or rejected, as part of the initial stream authentication
handshake - so the authorisation has to happen at the c2s layer. By the
time the sm is invoked with the bind request, the stream is already
authenticated - and the only thing that's being requested there is tying a
particular JID to the request.
From a jabberd2 architecture point - the authreg layer is the logical
place to do authorization. For instance, even for users authenticated via
GSSAPI or EXTERNAL, the pam account layer should be called when the PAM
authreg module is in use. Either both c2s and sm need to have access to
PAM (and there needs to be a way or passing PAM handles between the two
processes - which is not pretty)), or all of the PAM calls have to happen
from the same process.
--
Ticket URL: <http://jabberd2.xiaoka.com/ticket/81#comment:2>
jabberd2 <http://jabberd2.xiaoka.com/>
jabberd2 project
_______________________________________________
jabberd2 mailing list
[email protected]
http://lists.xiaoka.com/listinfo.cgi/jabberd2-xiaoka.com
