Login modules are the public api into security, so yes, that
is the correct approach.
xxxxxxxxxxxxxxxxxxxxxxxx
Scott Stark
Chief Technology Officer
JBoss Group, LLC
xxxxxxxxxxxxxxxxxxxxxxxx
----- Original Message -----
From: "John Landers" <[EMAIL PROTECTED]>
To: "Jboss-User" <[EMAIL PROTECTED]>
Sent: Saturday, March 02, 2002 7:46 AM
Subject: Re: [JBoss-user] Q:Bean Security and JMX Another idea
> Couldn't I write a custom login module to handle
> this. If it is all done in the login module will I avoid Security Manager
> issue?
>
> One login module to check if I had saved off the principal and credential
> and place them into the shared_state
> ClientLoginModule do the SecurityAssociation.set.... since it will pull
them
> from the sharedState.
> One to get the shared the pricipal and credential from the shared_state
> and save them off.
>
> Sample auth.conf ordering.
>
> mydomain
> {
> CustomLoginModule to check for saved of principal/credentials.
> put them into the sharedState if found.
> ClientLoginModule from jboss
> UsersRolesLoginModule - A real login Module to do auth if none
> associated so far.
> CustomLoginModule to save of principal/credentials from shared_state.
> }
>
> Thanks,jcl.
>
> ----- Original Message -----
> From: "Scott M Stark" <[EMAIL PROTECTED]>
> To: "Jboss-User" <[EMAIL PROTECTED]>
> Sent: Friday, March 01, 2002 10:46 PM
> Subject: Re: [JBoss-user] Q:Bean Security and JMX
>
>
> > It won't be allowed when using a security manager unless
> > your code has been assigned permissions to perform this
> > access.
> >
> > xxxxxxxxxxxxxxxxxxxxxxxx
> > Scott Stark
> > Chief Technology Officer
> > JBoss Group, LLC
> > xxxxxxxxxxxxxxxxxxxxxxxx
> > ----- Original Message -----
> > From: "John Landers" <[EMAIL PROTECTED]>
> > To: "Jboss-User" <[EMAIL PROTECTED]>
> > Sent: Friday, March 01, 2002 8:04 PM
> > Subject: Re: [JBoss-user] Q:Bean Security and JMX
> >
> >
> > > Well I think I can answer my own question partly.
> > > I did a test and it works but the only problem is that
> > > it is JBoss specific. Waiting to see if anyone else has any ideas.
> > >
> > > I placed SecurityAssociation.getPrincipal()
> > > and
> > > SecurityAssociation.getCredential()
> > > into an object that the mbean thread has access to
> > > and before this thread goes to get a reference to the bean
> > > I called
> > > SecurityAssociation.setPrincipal(savedPrincipal);
> > > SecurityAssociation.setCredential(savedCredential);
> > >
> > > The bean then assumed the user that I pulled the principal from.
> > >
> > > Is this legal?
> > > I know it probably is not good practice to use JBoss internals.
> > >
> > > jcl.
> >
> >
> >
> > _______________________________________________
> > JBoss-user mailing list
> > [EMAIL PROTECTED]
> > https://lists.sourceforge.net/lists/listinfo/jboss-user
>
> _______________________________________________
> JBoss-user mailing list
> [EMAIL PROTECTED]
> https://lists.sourceforge.net/lists/listinfo/jboss-user
>
_______________________________________________
JBoss-user mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/jboss-user
