I am looking at some production deployment options and had a few questions.
We want all communications to be over SSL. One mechanism for doing this would be to run JNDI, EJB Invocations, etc over HTTPS. It seems fairly straightforward to perform lookups using HttpNamingContextFactory and to use the HttpInvoker service over SSL for EJB invocations. I have a few questions though: 1) Is the HttpInvoker slower than the RMI/JRMP invoker? Any drawbacks to the HttpInvoker? 2) I really want to lock down the server and not allow anyone to mistakenly use non-SSL sockets. Would it be safe (is it possible?) to disable the JRMPInvoker and use only the LocalInvoker and the HttpInvoker for calling EJBs? 3) The docs mention creating a stateless-http-invoker invoker-proxy-binding and binding it directly to the beans you are deploying. Would there be any issues with just changing the definition of the "Standard Stateless SessionBean" container-configuration so it uses the stateless-http-invoker instead of the stateless-rmi-invoker? Can the server run with just the HTTPs port open? If naming, invocation are running over HTTPS, and JMS is only used locally on the server, it would seem feasible to turn off all of the remote access ports other the HTTPS. Has anyone ever attempted operation in such a fashion? View the original post : http://www.jboss.org/index.html?module=bb&op=viewtopic&p=3871807#3871807 Reply to the post : http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&p=3871807 ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ JBoss-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/jboss-user
