Andreas Höschler wrote:
It works for me with a Sun Ray 1. I have a private network at home,
using ipfilter on a Solaris machine as a NAT router. To make it work,
I only needed to set up Sun's DHCP server on the Solaris machine to
serve the private network. Older Sun Rays can only be configured
through DHCP. I don't use any special NAT rules for the device.
I only need to take my Java card home to get my work session at home.
This in interesting. If this works I have a lack of understanding.
Where does your sun ray at home know which srs server to connect to?
And what is a Java card? Are these the normal cards from Sun we use
for years with sun rays. As far as I know they are stateless and just
carry some unique id!? Unless you have configured your Solaris router
(DHCP server) in a special way, making it pass the ipaddress of the
srs server to the sun ray I wouldn't expect this to work.
This has to do with Sun's deployment and use of AMGH.
We have smartcards ("Java card" - right now no
applets or middlewhere, just a simple smartcard)
for badges. We use AMGH (aka "Regional Hotdesking"),
which allows mappings between parameters such
as smartcard ID to username and SRS server. This
feature is described in the Administration Guide and
also my blog http://blogs.sun.com/bobd
Our AMGH configuration uses a Sun-designed script
which interfaces with Sun's LDAP HR database and
retrieve the username and server mappings based on
the users smartcard ID and building location information.
AMGH users a PAM module in the Display Manager
(dtlogin/gdm) stack, so when you insert your card and
a new session is created it can access the card ID and
start the AMGH logic, which can result in a redirection
of the Sun Ray to the desired SRS server, carrying along
with it the discovered username which gets pushed into
the PAM stack at the destination server when the user
session starts up there.
You could do the same for your site by writing a simple
script that uses whatever databases you have with such
information at your site, and configuring AMGH for use
with it.
Moreover without ugly utilization/configuration of open vpn on both
sides the data between your sun ray and your srs server is transmitted
not encrypted, isn't it?
That's absolutely correct. The traffic used by AMGH
is on port tcp/7010 and is unencrypted unless you use
VPN either via the native firmware functionality or an
external tunnel. This is not secure against a spoofing
attack which could cause you to be redirected to another
server without some sort of VPN.
-Bob
Disclaimer: Opinions expressed in this mail are my own,
and are not necessarily shared by my employer
_______________________________________________
SunRay-Users mailing list
[email protected]
http://www.filibeto.org/mailman/listinfo/sunray-users
