Re: [jBoss-User] Security Walkthrough/How To/Tutorial, first cut

[Oleg Nitz]

On Saturday 23 December 2000 03:09, Charlie Read wrote:
> * Once authentication is done, how do you know
> what security identity is now effective within the
> session context for some bean?  Is that identity
> just the "subject" used for the login?
Security identity is stored on client, it is a user name used for 
login. On each method call this info is passed to the server and then 
is set to ThreadLocal variable, so that each thread knows who called 
it.

> * As the user (who has logged in) navigates through
> a web application, how is the security identity propagated
> (or sustained)?  
Sorry I know nothing about that.

> [Note: I've read about how EJB defines
> propagation of security contexts between beans -- is that
> feature implemented in jBoss?]
Yes, I think it should work. 
I didn't test this feature, though.

Oleg


--
--------------------------------------------------------------
To subscribe:        [EMAIL PROTECTED]
To unsubscribe:      [EMAIL PROTECTED]
List Help?:          [EMAIL PROTECTED]