> >* Are these credentials valid for this user?
> >* Change the credentials for this user.
> >* Does this user have this capability?
> >
> Question: Don't those depend on the security scheme? Let me explain.
> Consider "Are these credentials valid for this user?" The only way to
> test that is to do something like data.getACL().hasPermission(). But,
> if I don't have permissions in my scheme, I'm screwed. Once again there
> is no standard way to change credentials.
Just to clarify, I understand "user credentials" to mean "user name
and password", and "are these credentials valid for this user?" to
me means "is this usr/pwd valid?". Likewise, "change the credentials
for this user" means "change this user's password", and finally (and
MOST importantly), "does this user have this capability?" means "can
this user perform this operation?". Sorry for the confusion.
> I think the only thing Turbine needs to worry about is the User object
> and associating it with the session.
>
> I suppose we need something like this.
>
> interface Credentials {}
> interface User {
> getName() // Or get Id, or something...
> }
> interface SecurityManager {}
I would do something like this:
interface Credentials {}
interface Permission {}
interface PermissionSet {}
interface User {
getName(); // Or get Id, or something...
}
interface SecurityManager {
boolean validateUserCredentials(User user, Credentials credentials);
boolean changeUserCredentials(User user, Credentials credentials);
boolean userHasPermissions(User user, PermissionSet ps);
}
> Then in the rundata object, instead of a getACL(), we have
> getCredentials(). And on go on my merry way using my own security
> scheme I specified in my TR.props,
>
> security.credentials.class=com.somewhere.project.security.CustomCr
> edentials
> security.manager.class=com.somewhere.project.security.CustomSecuri
> tyManager
> security.user.class=com.somewhere.project.om.TorqueUser
>
> Notice there are no standard methods in the interface except getName()
> in the User object. It could also have the getCredentials method if you
> wanted. We could then distribute custom security implementations.
I believe what you are talking about is the same as what I said, modulo
the naming differences.
> Are there other places where the security system is used that I'm not
> thinking of? We really don't have much to worry about. Just the
> RunData object.
>
> - Dan Diephouse
Opinions, anyone else?
--
Gonzalo A. Diethelm
[EMAIL PROTECTED]
--
To unsubscribe, e-mail: <mailto:[EMAIL PROTECTED]>
For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>
