Re: CORBA and GSSUP fix -- please review

2006-02-13 Thread Andy Piper
At 05:14 PM 2/10/2006, Aaron Mulder wrote: Sorry, you're crediting me with a lot more CORBA knowledge than I deserve. :) In particular, I'm not sure what the right IIOP URL or corbaname URL should be. Let me give you a more specific scenario: Let's say I have a session bean running in

Re: CORBA and GSSUP fix -- please review

2006-02-13 Thread Jeppe Sommer (Trifork)
The [EMAIL PROTECTED] form is also what we use in the Trifork Server/ORB... Andy Piper wrote: At 03:51 PM 2/10/2006, Aaron Mulder wrote: Just to be clear, I'm talking about GSSUP authentication (where the client sends a token containing a username and password and an encoded domain name) not

Re: CORBA and GSSUP fix -- please review

2006-02-10 Thread Jeppe Sommer (Trifork)
According to the CORBA 3.0.3 spec (and I believe the original CSIv2 spec says the same): Scoped-Username GSS Name Form The scoped-username GSS name form is defined as follows, where name_value and name_scope contain a sequence of 1 or more UTF8 encoded characters. scoped-username ::=

Re: CORBA and GSSUP fix -- please review

2006-02-10 Thread Andy Piper
I don't believe it's actually required to provide the username in the client identity field if you have a password. You can simply provide an auth token containing both username and password and set the identity token to ITTAbsent. We (WLS) only fallback on ITTPrincipleName if there is no

Re: CORBA and GSSUP fix -- please review

2006-02-10 Thread Aaron Mulder
Just to be clear, I'm talking about GSSUP authentication (where the client sends a token containing a username and password and an encoded domain name) not one of the principal name strategies (e.g. ITT*). Jeppe, I'm not clear whether the GSS Name Form you're describing applies to the username in

Re: CORBA and GSSUP fix -- please review

2006-02-10 Thread Andy Piper
At 03:51 PM 2/10/2006, Aaron Mulder wrote: Andy, is there some good documentation on exposing an EJB via CORBA in WebLogic, or configuring an EJB reference to connect to a remote CORBA EJB? I might as well try a WebLogic-to-Geronimo test to help resolve this. Its enabled by default. In theory

Re: CORBA and GSSUP fix -- please review

2006-02-10 Thread Andy Piper
At 03:51 PM 2/10/2006, Aaron Mulder wrote: Just to be clear, I'm talking about GSSUP authentication (where the client sends a token containing a username and password and an encoded domain name) not one of the principal name strategies (e.g. ITT*). Jeppe, I'm not clear whether the GSS Name Form

Re: CORBA and GSSUP fix -- please review

2006-02-10 Thread Aaron Mulder
Andy, Sorry, you're crediting me with a lot more CORBA knowledge than I deserve. :) In particular, I'm not sure what the right IIOP URL or corbaname URL should be. Let me give you a more specific scenario: Let's say I have a session bean running in Geronimo, so the Geronimo side of the

CORBA and GSSUP fix -- please review

2006-02-09 Thread Aaron Mulder
So it turns out our GSSUP token encoder set the username to [EMAIL PROTECTED] and the GSSUP token decoder did not lop off the @domain part, so Geronimo could not talk to itself using GSSUP. I changed the token encoder to just pass the username straight through -- there is a separate field in the