run-as is a grant of one or more roles to the call context, but the identity is not well defined. The authentication is essentially bypassed so this is a trusted activity. The issue is what control should exist at the jca layer to set the trusted identity. As far as the data source is concerned, this is the establishment of a Subject with a valid PasswordCredential because the jdbc driver is stupid and has no notion of allowing access based on a trusted context.
View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=3866548#3866548 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=3866548 ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ JBoss-Development mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/jboss-development
